Match each compliance framework to its primary focus.
Drag a concept onto its matching description — or click a concept then click the description.
Data protection and privacy for EU citizens
Information security management system standard
Cybersecurity risk management framework
Healthcare data privacy and security in the US
Service organization controls for data security
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
GDPR: Focuses on data privacy and protection for individuals in the EU
Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
GDPR: Focuses on data privacy and protection for individuals in the EU
Why this is correct
The General Data Protection Regulation (GDPR) is a comprehensive legal framework enacted by the European Union to safeguard the personal data and privacy of all individuals within the EU and European Economic Area. It mandates strict requirements for how organizations collect, process, store, and dispose of personal data, granting individuals significant rights over their information. Non-compliance can lead to substantial penalties, emphasizing its critical role in modern data protection.
ISO 27001: Focuses on information security management systems
Why this is correct
ISO 27001 is an internationally recognized standard that provides a systematic approach to managing sensitive company information so that it remains secure. It specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) within the context of the organization's overall business risks. This framework helps organizations identify, assess, and treat information security risks effectively across all types of information.
SOC 2: Focuses on controls related to security, availability, processing integrity, confidentiality, and privacy
Why this is correct
Service Organization Control 2 (SOC 2) reports are audit reports that evaluate a service organization's controls relevant to the security, availability, processing integrity, confidentiality, and privacy of user data. These reports, based on the AICPA's Trust Service Criteria, provide assurance to customers and business partners regarding the effectiveness of internal controls over information systems. They are crucial for cloud service providers and other technology organizations handling sensitive client data.
GDPR: Focuses on financial reporting controls
Why it's wrong here
The General Data Protection Regulation (GDPR) is fundamentally concerned with the privacy and protection of personal data for individuals, particularly within the European Union. Its scope does not extend to financial reporting controls, which are typically addressed by regulations like the Sarbanes-Oxley Act (SOX) in the United States. Therefore, asserting that GDPR focuses on financial reporting controls is incorrect, as it misrepresents the core purpose and regulatory domain of GDPR.
ISO 27001: Focuses on data privacy for EU citizens
Why it's wrong here
ISO 27001 establishes a framework for an organization's overall Information Security Management System (ISMS), encompassing a broad range of security aspects beyond just data privacy. While an ISMS can support privacy objectives, ISO 27001's primary focus is on managing information security risks comprehensively, including availability and integrity, not exclusively on data privacy for EU citizens. The latter is the specific domain of the GDPR, which is a regulatory mandate.
SOC 2: Focuses on international trade regulations
Why it's wrong here
SOC 2 reports are designed to provide assurance about a service organization's controls related to the security, availability, processing integrity, confidentiality, and privacy of the data they process for clients. These reports are internal control audits, not regulatory frameworks governing international trade. International trade regulations involve customs, tariffs, and export controls, which are entirely separate from the scope and purpose of SOC 2 audits.
Go deeper
Learn chapter
Core Security Concepts
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
Key term
Information security management
Information security management is the systematic process of developing, implementing, monitoring, and improving policies, procedures, and controls to protect an organization's information assets from threats and ensure confidentiality, integrity, and availability.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.