easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Needs to ensure compliance with GDPR regarding…
An organization needs to ensure compliance with GDPR regarding data subject access requests. What is the MOST important control to implement?
⚠ Common exam trap
CompTIA often tests the distinction between security controls (like encryption) and compliance controls (like process and procedure), and the trap here is that candidates confuse data protection (confidentiality) with data subject rights (accessibility and timeliness), leading them to pick a technical control over a procedural one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a process to respond to access requests within one month
GDPR Article 12(3) requires organizations to respond to data subject access requests without undue delay and at the latest within one month. The most important control is a documented process that ensures timely identification, validation, and fulfillment of these requests, as failure to meet the deadline constitutes a direct compliance violation. Without this process, technical controls like encryption alone cannot satisfy the regulatory requirement for a verifiable response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all personal data at rest and in transit
Why it's wrong here
Encryption is important but does not directly satisfy access request requirements.
- ✗
Minimize the collection of personal data
Why it's wrong here
Data minimization is a principle but not the primary control for access requests.
- ✓
Implement a process to respond to access requests within one month
Why this is correct
GDPR mandates response to access requests within one month.
- ✗
Appoint a Data Protection Officer (DPO)
Why it's wrong here
A DPO is required under certain conditions but not specifically for access requests.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.