Drag and Drop Compliance Frameworks to Their Purposes
DRAG DROP
Move each framework from the list on the left to the correct purpose on the right.
Note: You will receive partial credit for each correct answer.
Community Insight
The core trap is confusing similar-sounding regulations; you must match GDPR to EU privacy, HIPAA to US healthcare, and PCI-DSS to payment card security.
This CompTIA Security+ SY0-601 drag-and-drop question tests the ability to map specific compliance frameworks to their primary regulatory purposes.
Candidates often swap HIPAA and GDPR because both deal with personal data protection, failing to recognize the geographic (US vs EU) and industry-specific (healthcare vs general) distinctions.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
GDPR (General Data Protection Regulation) is the comprehensive data privacy law for the European Union, making it the correct match for protecting EU members' personal information. HIPAA (Health Insurance Portability and Accountability Act) is a US federal statute designed specifically to protect sensitive patient health information, aligning with healthcare data protection. PCI-DSS (Payment Card Industry Data Security Standard) is an industry-led standard focused on securing credit card transactions, directly matching the protection of credit card information.Why Other Candidate Answers Are Wrong
Other common frameworks like SOX or FERPA do not fit these specific definitions. SOX focuses on corporate financial reporting accuracy, while FERPA protects educational records, neither of which are listed in the target descriptions. Confusing these leads to incorrect mapping.Community Comment Notes
As Roattana noted, the key is recognizing the specific domain: "Protects the personal information of members of the European Union" maps strictly to GDPR, while healthcare points to HIPAA.Exam Strategy
Memorize the acronyms and their full names along with their primary jurisdiction or industry focus. Use keyword association: 'EU' for GDPR, 'Health/Patient' for HIPAA, and 'Card/Payment' for PCI-DSS.
Frequently Asked Questions
What is the difference between GDPR and HIPAA?
GDPR is a broad EU regulation for all personal data, while HIPAA is a US law specifically for protected health information.
Does PCI-DSS apply to all businesses?
No, PCI-DSS applies only to organizations that handle branded credit cards, such as merchants and payment processors.