CS0-003 Match each regulatory framework to its focus. Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  GDPR: Protecting personal data of EU citizens

  Why this is correct

  The General Data Protection Regulation (GDPR) is a comprehensive EU regulation that governs the processing of personal data of individuals in the European Economic Area, with extraterritorial reach. It establishes principles such as data minimization, purpose limitation, and rights like access, rectification, and erasure. Non-compliance can result in fines up to 4% of annual global turnover or €20 million, whichever is higher.

• ✓

  HIPAA: Safeguarding protected health information

  Why this is correct

  HIPAA's Privacy Rule creates national standards for protecting individually identifiable health information, termed protected health information (PHI), held or transmitted by covered entities and their business associates. It mandates safeguards for all forms of PHI, including electronic, paper, and oral, and grants patients rights over their health data. The Security Rule specifically addresses administrative, physical, and technical protections for electronic PHI.

• ✓

  PCI DSS: Securing credit card transactions and data

  Why this is correct

  PCI DSS is a contractual security standard imposed by the major payment card brands to reduce cardholder data breaches. It applies to all entities that store, process, or transmit cardholder data or sensitive authentication data, regardless of size. The standard requires network segmentation, encryption, access controls, continuous monitoring, and regular security testing to secure credit card transactions and related data.

• ✓

  SOX: Ensuring accuracy of financial reporting

  Why this is correct

  The Sarbanes-Oxley Act (SOX) is a U.S. federal law enacted to improve corporate governance and the accuracy of financial reporting after major accounting scandals. It requires CFOs and CEOs to certify the correctness of financial statements and mandates management's assessment of internal controls over financial reporting. Independent auditors must also attest to these controls, and the law establishes criminal penalties for fraudulent financial activities.

• ✗

  HIPAA: Securing credit card transactions

  Why it's wrong here

  This pairing misinterprets HIPAA's purpose: HIPAA exclusively protects protected health information (PHI) within the healthcare industry, including medical records and patients' identifiable health data. It contains no provisions addressing credit card transactions or payment card data. Securing credit card data is regulated by the PCI DSS, which is specifically designed to protect cardholder information during payment processing.

• ✗

  GDPR: Regulating financial disclosures

  Why it's wrong here

  GDPR is fundamentally a data protection and privacy regulation that governs the collection, processing, and storage of personal data belonging to EU/EEA residents. It does not address financial reporting or disclosure requirements; those are regulated by SOX, which focuses on corporate financial statement accuracy and internal controls. Therefore, attributing financial disclosure regulation to GDPR reflects a conflation of securities law with data protection law.

Go deeper

Related to this question