200-201 Security Concepts Practice Question

An organization is required to protect cardholder data. Which compliance framework applies to this requirement?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

PCI DSS

PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that handle credit card data.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
ISO 27001
Why it's wrong here
ISO 27001 certifies an information security management system, not cardholder data handling, so it does not satisfy the PCI DSS requirement. It is tempting because ISO 27001 is a recognised security standard, and it would be correct where the goal is demonstrating a governed ISMS rather than card-data compliance.
✗
HIPAA
Why it's wrong here
HIPAA protects protected health information in US healthcare, not cardholder data, so it imposes no card-data controls. It is tempting because HIPAA is a well-known security regulation, and it would be the correct framework where the requirement is safeguarding medical records rather than payment cards.
✗
GDPR
Why it's wrong here
GDPR governs personal data of EU residents, not payment card data, so it does not mandate the PCI DSS controls the stem requires. It is tempting because GDPR is a widely known data-protection regulation, and it would be correct where the requirement is lawful processing of personal data rather than cardholder protection.
✓
PCI DSS
Why this is correct
PCI DSS is the payment card industry standard governing organisations that store, process or transmit cardholder data. Its twelve requirements mandate controls such as encryption, access restriction and network monitoring, directly satisfying the stem's cardholder data protection obligation.

Go deeper