Courseiva
← CAS-005
Full test
mediumMultiple Choice

Identifying GDPR Article 32 Security Requirements

Exhibit

Refer to the exhibit.
```
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
  (a) the pseudonymization and encryption of personal data;
  (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
  (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
```

Refer to the exhibit. This clause is a requirement of which of the following?

Quick Answer

The answer is GDPR Article 32, which mandates appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing personal data. This is correct because the clause directly addresses the core requirement of Article 32: implementing measures like pseudonymization, encryption, and resilience of systems to protect against accidental loss or unauthorized access. On the CompTIA SecurityX CAS-004 exam, this tests your ability to map regulatory text to specific data privacy frameworks, often appearing in scenario-based questions where you must identify which GDPR article governs security of processing. A common trap is confusing Article 32 with Article 33 (breach notification) or Article 5 (data minimization principles), so focus on the explicit mention of “security measures” and “risk” as the key identifiers. Memory tip: think “32 = Security Trio” — pseudonymization, encryption, and resilience are the three pillars of Article 32’s requirements.

⚠ Common exam trap

A common pitfall is confusing the distinction between a regulatory requirement (GDPR) and a framework or sector-specific standard (PCI DSS, HIPAA, ISO 27001), leading candidates to choose a familiar security standard like PCI DSS or HIPAA without recognizing the unique pseudonymization and risk-based language that is exclusive to GDPR Article 32.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

GDPR Article 32.

The clause in the exhibit mandates a data processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization and encryption of personal data. This is a direct requirement of GDPR Article 32, which specifically addresses the security of processing personal data and is distinct from sector-specific or framework-based standards.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    PCI DSS.

    Why it's wrong here

    PCI DSS applies to organisations storing, processing or transmitting cardholder data, and its requirements are scoped to that environment. It is tempting because PCI DSS does mandate encryption of cardholder data in transit, and it would be correct if the exhibit quoted a card-data clause, but the clause shown belongs to a healthcare privacy and security regulation.

  • ✓

    GDPR Article 32.

    Why this is correct

    GDPR Article 32 mandates appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymisation, confidentiality, integrity, availability and resilience of processing systems, plus regular testing of those measures.

  • ✗

    ISO 27001.

    Why it's wrong here

    ISO 27001 specifies requirements for an information security management system, expressed as management-system controls rather than prescriptive cardholder-data clauses. It is tempting because ISO 27001 covers access control and cryptography, and it would be correct for an ISMS certification requirement, but the exhibit's wording matches a payment card standard.

  • ✗

    HIPAA Security Rule.

    Why it's wrong here

    The HIPAA Security Rule governs protected health information held by covered entities and business associates, so its clauses address ePHI safeguards rather than cardholder data. It is tempting because HIPAA does mandate administrative, physical and technical safeguards, and it would be the answer if the exhibit referenced ePHI, but the clause shown concerns payment card data.

About these practice questions

Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on CAS-005

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. An organization is evaluating its cloud service provider's security posture as part of third-party risk management. Which regulatory framework requires the organization to ensure that the provider has appropriate technical and organizational measures to protect personal data?

hard
  • A.PCI DSS
  • B.SOX
  • ✓ C.GDPR
  • D.HIPAA

Why C: The General Data Protection Regulation (GDPR) explicitly requires that data controllers (the organization) ensure that data processors (the cloud service provider) implement appropriate technical and organizational measures to protect personal data. This is mandated under Article 28 of the GDPR, which governs the relationship between controllers and processors, including contractual obligations for security measures. The regulation applies to any organization handling personal data of EU residents, regardless of where the cloud provider is located.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.