CAS-004 Governance, Risk, and Compliance Practice Question
A small business is implementing a privacy impact assessment (PIA) for a new application that processes personal data of EU citizens. Which TWO of the following are required under GDPR?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Describe the processing operations and purposes
GDPR requires a PIA when processing is likely to result in high risk to individuals, and the PIA must describe the processing and assess necessity and proportionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain approval from a data protection authority before processing
Why it's wrong here
Prior consultation is only required if the PIA indicates high risk that cannot be mitigated.
- ✗
Appoint a data protection officer (DPO)
Why it's wrong here
Appointment of a DPO is required in certain circumstances, but not specifically as part of a PIA.
- ✗
Publish the PIA on the company website
Why it's wrong here
GDPR does not require publication; it may be kept internal.
- ✓
Describe the processing operations and purposes
Why this is correct
Correct: The PIA must include a description of the processing.
- ✓
Assess the necessity and proportionality of the processing
Why this is correct
Correct: The PIA must assess necessity and proportionality.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.