Drag and Drop Compliance Frameworks to Their Purposes
Short answer
GDPR matches Protects the personal information of members of the European Union. HIPAA matches Protects the healthcare information of individuals. PCI-DSS matches Protects the credit card information of individuals.
Question
Move each framework from the list on the left to the correct purpose on the right.
Note: You will receive partial credit for each correct answer.
Key Takeaways
The core trap is confusing similar-sounding regulations; you must match GDPR to EU privacy, HIPAA to US healthcare, and PCI-DSS to payment card security.
This CompTIA Security+ SY0-601 drag-and-drop question tests the ability to map specific compliance frameworks to their primary regulatory purposes.
Common mistake: Candidates often swap HIPAA and GDPR because both deal with personal data protection, failing to recognize the geographic (US vs EU) and industry-specific (healthcare vs general) distinctions.
Expert Analysis
Why the Answer Is Correct
GDPR (General Data Protection Regulation) is the comprehensive data privacy law for the European Union, making it the correct match for protecting EU members' personal information. HIPAA (Health Insurance Portability and Accountability Act) is a US federal statute designed specifically to protect sensitive patient health information, aligning with healthcare data protection. PCI-DSS (Payment Card Industry Data Security Standard) is an industry-led standard focused on securing credit card transactions, directly matching the protection of credit card information.
Why Other Candidate Answers Are Wrong
Other common frameworks like SOX or FERPA do not fit these specific definitions. SOX focuses on corporate financial reporting accuracy, while FERPA protects educational records, neither of which are listed in the target descriptions. Confusing these leads to incorrect mapping.
Community Comment Notes
As Roattana noted, the key is recognizing the specific domain: "Protects the personal information of members of the European Union" maps strictly to GDPR, while healthcare points to HIPAA.
Exam Strategy
Memorize the acronyms and their full names along with their primary jurisdiction or industry focus. Use keyword association: 'EU' for GDPR, 'Health/Patient' for HIPAA, and 'Card/Payment' for PCI-DSS.
Frequently Asked Questions
What is the difference between GDPR and HIPAA?
Does PCI-DSS apply to all businesses?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Roattana 👍 1• Protects the personal information of members of the European Union \(\rightarrow \) GDPR (General Data Protection Regulation) • Protects the healthcare information of individuals \(\rightarrow \) HIPAA (Health Insurance Portability and Accountability Act) • Protects the credit card information of individuals \(\rightarrow \) PCI-DSS (Payment Card Industry Data Security Standard) • Protects the educational records of individuals \(\rightarrow \) FERPA (Family Educational Rights and Privacy Act) • Protects information about individuals that is stored by federal agencies \(\rightarrow \) FISMA (Federal Information Security Modernization Act)
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.