hardMultiple SelectObjective-mapped
CAS-004 Practice Question: A security architect is evaluating a new…
A security architect is evaluating a new cloud-based application that will process sensitive customer data. The architect must ensure compliance with GDPR and PCI DSS. Which THREE of the following controls should be implemented? (Select THREE.)
⚠ Common exam trap
The CAS-004 exam often tests the misconception that geo-fencing is a GDPR requirement, but GDPR focuses on the rights of data subjects and lawful processing, not on geographic blocking of access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a process for customers to request deletion of their personal data.
GDPR grants data subjects the right to erasure (Article 17), also known as the 'right to be forgotten.' Implementing a process for customers to request deletion of their personal data is a mandatory control for GDPR compliance, directly addressing this regulatory requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy geo-fencing to block access from non-EU countries.
Why it's wrong here
Geo-fencing is not a regulatory requirement; GDPR permits data transfer with safeguards.
- ✓
Implement a process for customers to request deletion of their personal data.
Why this is correct
Right to erasure is a key GDPR requirement.
- ✓
Use data masking for customer data in development and testing environments.
Why this is correct
Both GDPR and PCI DSS recommend masking to reduce exposure of sensitive data.
- ✓
Implement encryption at rest and in transit for all sensitive data.
Why this is correct
Required by both GDPR (data protection) and PCI DSS (encryption of cardholder data).
- ✗
Retain all access logs for a minimum of 7 years.
Why it's wrong here
GDPR requires data minimization; PCI DSS requires 1 year retention.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.