CAS-004 Governance, Risk, and Compliance Practice Question
An organization is implementing a privacy program to comply with GDPR. Which of the following BEST describes the concept of 'privacy by design' as it applies to a new customer relationship management (CRM) system?
⚠ Common exam trap
CAS-005 often tests the misconception that privacy by design is about post-deployment activities like privacy notices or audits, rather than proactive architectural integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incorporating data minimization and access controls into the system architecture from the start.
Privacy by design is a foundational GDPR principle (Article 25) requiring data protection to be embedded into systems and processes from the outset, not bolted on afterward. Option A captures this by integrating data minimization and access controls into the CRM's architecture during design, which is exactly what 'by design' means. This proactive approach reduces compliance risk and prevents costly retrofits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Incorporating data minimization and access controls into the system architecture from the start.
Why this is correct
Privacy by design embeds data minimisation and access controls into the CRM architecture from inception, rather than retrofitting them later. This satisfies GDPR's requirement that protection be built into processing systems and default settings before personal data is collected.
- ✗
Assigning a data protection officer to review system logs quarterly.
Why it's wrong here
Privacy by design embeds data minimisation, purpose limitation and default protections into the CRM's architecture and configuration from the outset; quarterly log review is detective oversight after build. It tempts because a DPO is a GDPR requirement, but that role governs compliance rather than engineering controls into the system.
- ✗
Adding a privacy notice to the CRM after deployment.
Why it's wrong here
Bolting a privacy notice onto a live CRM is remediation after processing begins, whereas privacy by design requires data protection to be embedded into the system's architecture and defaults before any personal data is collected. It is tempting because transparency notices are a genuine GDPR requirement, but as an after-the-fact artefact they satisfy Article 13, not Article 25.
- ✗
Conducting a privacy impact assessment (PIA) after the system is live.
Why it's wrong here
Privacy by design requires assessing and mitigating risks before and during system development, not after go-live; a post-deployment PIA cannot reshape the CRM's data flows. It tempts because PIAs are a genuine GDPR accountability tool, but timing determines whether findings can still influence design.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.