PECB ISO-IEC-27001 Lead Auditor Practice Exams
Last updated on Oct 21,2026- Exam Code: ISO-IEC-27001 Lead Auditor
- Exam Name: PECB Certified ISO/IEC 27001 Lead Auditor exam
- Certification Provider: PECB
- Latest update: Oct 21,2026
Which is not a requirement of HR prior to hiring?
- A . Undergo background verification
- B . Applicant must complete pre-employment documentation requirements
- C . Must undergo Awareness training on information security.
- D . Must successfully pass Background Investigation
C
Explanation:
According to ISO/IEC 27001:2022, clause 7.2.2, the organization shall ensure that all persons who have access to information are aware of the information security policy and their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance2. Therefore, awareness training on information security is a requirement for all persons, not just new hires.
Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) | CQI | IRCA
Why should materiality be considered during the initial contact?
- A . To determine the audit duration
- B . To obtain reasonable assurance that the audit can be successfully completed
- C . To define processes for minimizing detection risks
B
Explanation:
Materiality should be considered during the initial contact to obtain reasonable assurance that the audit can be successfully completed. Determining materiality helps establish the threshold for the significance of audit findings, ensuring that the audit focuses on substantial issues that could impact the audit conclusions.
Reference: ISO 19011:2018, Guidelines for auditing management systems
Why should materiality be considered during the initial contact?
- A . To determine the audit duration
- B . To obtain reasonable assurance that the audit can be successfully completed
- C . To define processes for minimizing detection risks
B
Explanation:
Materiality should be considered during the initial contact to obtain reasonable assurance that the audit can be successfully completed. Determining materiality helps establish the threshold for the significance of audit findings, ensuring that the audit focuses on substantial issues that could impact the audit conclusions.
Reference: ISO 19011:2018, Guidelines for auditing management systems
Why should materiality be considered during the initial contact?
- A . To determine the audit duration
- B . To obtain reasonable assurance that the audit can be successfully completed
- C . To define processes for minimizing detection risks
B
Explanation:
Materiality should be considered during the initial contact to obtain reasonable assurance that the audit can be successfully completed. Determining materiality helps establish the threshold for the significance of audit findings, ensuring that the audit focuses on substantial issues that could impact the audit conclusions.
Reference: ISO 19011:2018, Guidelines for auditing management systems
The following are the guidelines to protect your password, except:
- A . Don’t use the same password for various company system security access
- B . Do not share passwords with anyone
- C . For easy recall, use the same password for company and personal accounts
- D . Change a temporary password on first log-on
B,C
Explanation:
The following are guidelines to protect your password, except for easy recall use the same password for company and personal accounts; do not share passwords with anyone. Using the same password for company and personal accounts is not a guideline to protect your password, as it increases the risk of compromising your password if one of your accounts is hacked or breached. You should use different and unique passwords for each account, and change them regularly. Sharing passwords with anyone is not a guideline to protect your password, as it reduces the security and accountability of your password. You should keep your password confidential and never disclose it to anyone, even if they claim to be authorized or trustworthy. Don’t use the same password for various company system security access is a guideline to protect your password, as it prevents unauthorized access or misuse of your password if one of the systems is compromised or breached. You should use different and complex passwords for each system, and follow the password policies and standards of the organization. Change a temporary password on first log-on is a guideline to protect your password, as it prevents unauthorized access or misuse of your password if the temporary password is intercepted or leaked. You should change the temporary password to a personal and secure password as soon as possible, and avoid using default or predictable passwords.
Reference: CQI & IRCA ISO 27001:2022 Lead Auditor Course Handbook, page 43. : [ISO/IEC 27001 LEAD AUDITOR – PECB], page 15.
DRAG DROP
Select the words that best complete the sentence to describe an audit finding.
Explanation:
"An audit finding is the result of the evaluation of the collected audit evidence against audit criteria." The words that best complete the sentence to describe an audit finding are evaluation and evidence. According to ISO 19011:2022, an audit finding is the result of the evaluation of the collected audit evidence against audit criteria12. The other options are either not related to the definition of an audit finding or do not fit the sentence grammatically.
Reference: 1: ISO 19011:2022, Guidelines for auditing management systems, Clause 3.11 n2: PECB Certified ISO/IEC 27001 Lead Auditor Exam Preparation Guide, Domain 5: Conducting an ISO/IEC 27001 audit
You are performing an ISMS audit at a residential nursing home (ABC) that provides healthcare services. The next step in your audit plan is to verify the information security of ABC’s healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organization outsourced the mobile app development to a professional software development company with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified.
The IT Manager presented the software security management procedure and summarised the process as following:
The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum.
The following security functions for personal data protection shall be available:
Access control.
Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and
Personal data pseudonymization.
Vulnerability checked and no security backdoor
You sample the latest Mobile App Test report, details as follows:
The IT Manager explains the test results should be approved by him according to the software security management procedure. The reason why the encryption and pseudonymisation functions failed is that these functions heavily slowed down the system and service performance. An extra 150% of resources are needed to cover this. The Service Manager agreed that access control is good enough and acceptable. That’s why the Service Manager signed the approval.
You are preparing the audit findings. Select the correct option.
- A . There is a nonconformity (NC). The organisation and developer do not perform acceptance tests. (Relevant to clause 8.1, control A.8.29)
- B . There is a nonconformity (NC). The organisation and developer perform security tests that fail. (Relevant to clause 8.1, control A.8.29)
- C . There is a nonconformity (NC). The Service Manager does not comply with the software security management procedure. (Relevant to clause 8.1, control A.8.30)
- D . There is NO nonconformity (NC). The Service Manager makes a good decision to continue the service. (Relevant to clause 8.1, control A.8.30)
C
Explanation:
During a third-party certification audit you are presented with a list of issues by an auditee.
Which four of the following constitute ‘external’ issues in the context of a management system to ISO/IEC 27001:2022?
- A . A rise in interest rates in response to high inflation
- B . A reduction in grants as a result of a change in government policy
- C . Poor levels of staff competence as a result of cuts in training expenditure
- D . Increased absenteeism as a result of poor management
- E . Higher labour costs as a result of an aging population
- F . Inability to source raw materials due to government sanctions
- G . Poor morale as a result of staff holidays being reduced
- H . A fall in productivity linked to outdated production equipment
A, B, E, F
Explanation:
According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), clause 4.1 requires an organization to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its ISMS2. External issues are those that originate from outside the organization, such as legal, regulatory, cultural, social, political, economic, natural and competitive factors2. Internal issues are those that originate from within the organization, such as governance, structure, roles and responsibilities, policies, objectives, culture, capabilities, resources and information systems2. Therefore, based on this definition, four examples of external issues in the context of a management system to ISO/IEC 27001:2022 are a rise in interest rates in response to high inflation (which affects the economic environment of the organization), a reduction in grants as a result of a change in government policy (which affects the political and legal environment of the organization), higher labour costs as a result of an aging population (which affects the social and demographic environment of the organization), and inability to source raw materials due to government sanctions (which affects the trade and supply environment of the organization)2. The other options are examples of internal issues, as they originate from within the organization or its activities. For example, poor levels of staff competence as a result of cuts in training expenditure (which affects the capabilities and resources of the organization), increased absenteeism as a result of poor management (which affects the culture and performance of the organization), poor morale as a result of staff holidays being reduced (which affects the motivation and satisfaction of the organization’s personnel), and a fall in productivity linked to outdated production equipment (which affects the efficiency and quality of the organization’s processes)2.
Reference: ISO/IEC 27001:2022 – Information technology C Security techniques C Information security management systems C Requirements
Scenario 2: Knight is an electronics company from Northern California, US that develops video game consoles. Knight has more than 300 employees worldwide. On the fifth anniversary of their establishment, they have decided to deliver the G-Console, a new generation video game console aimed for worldwide markets. G-Console is considered to be the ultimate media machine of 2021 which will give the best gaming experience to players. The console pack will include a pair of VR headset, two games, and other gifts.
Over the years, the company has developed a good reputation by showing integrity, honesty, and respect toward their customers. This good reputation is one of the reasons why most passionate gamers aim to have Knight’s G-console as soon as it is released in the market. Besides being a very customer-oriented company, Knight also gained wide recognition within the gaming industry because of the developing quality. Their prices are a bit higher than the reasonable standards allow.
Nonetheless, that is not considered an issue for most loyal customers of Knight, as their quality is top-notch.
Being one of the top video game console developers in the world, Knight is also often the center of attention for malicious activities. The company has had an operational ISMS for over a year. The ISMS scope includes all departments of Knight, except Finance and HR departments.
Recently, a number of Knight’s files containing proprietary information were leaked by hackers. Knight’s incident response team (IRT) immediately started to analyze every part of the system and the details of the incident.
The IRT’s first suspicion was that Knight’s employees used weak passwords and consequently were easily cracked by hackers who gained unauthorized access to their accounts. However, after carefully investigating the incident, the IRT determined that hackers accessed accounts by capturing the file transfer protocol (FTP) traffic.
FTP is a network protocol for transferring files between accounts. It uses clear text passwords for authentication.
Following the impact of this information security incident and with IRT’s suggestion, Knight decided to replace the FTP with Secure Shell (SSH) protocol, so anyone capturing the traffic can only see encrypted data.
Following these changes, Knight conducted a risk assessment to verify that the implementation of controls had minimized the risk of similar incidents. The results of the process were approved by the ISMS project manager who claimed that the level of risk after the implementation of new controls was in accordance with the company’s risk acceptance levels.
Based on this scenario, answer the following question:
Based on scenario 2, the ISMS project manager approved the results of risk assessment.
Is this acceptable?
- A . No, the risk remaining after the treatment of risk should be approved by the top management at any stage
- B . No, the risk remaining after the implementation of new controls for the ISMS should be approved by the ISMS team
- C . Yes, the risk remaining after the treatment of risk should be approved by the ISMS project manager
A
Explanation:
In the context of ISO/IEC 27001, the approval of the risk assessment and the acceptance of the remaining risk levels after treatment are typically responsibilities of the top management. This is because top management is accountable for the information security management system and its outcomes, and they have the authority to accept risks on behalf of the organization12.
Reference: = The information provided is based on the standard practices of ISO/IEC 27001 risk assessment and treatment processes, which emphasize the role of top management in the approval and acceptance of risks
You are carrying out your first third-party ISMS surveillance audit as an audit team leader. You are presently in the auditee’s data centre with another member of your audit team and the organisation’s guide.
You request access to a locked room protected by a combination lock and iris scanner. In the corner of the room is a collection of hard drives piled on a desk. You ask the guide what the status of the drives is. He tells you the drives are redundant and awaiting disposal. They should have been picked up last week, but the organisation’s external provider of secure destruction services was unable to source a driver due to staff sickness. He says this has recently become more common though he does not know why. He then presents you with a job ticket that confirms the pickup has been rescheduled for tomorrow.
Based on the scenario above which three of the following actions would you now take?
- A . Record a nonconformity against control A.5.13 ‘labelling of information’ as the disk drives’ status was unclear
- B . Raise a nonconformity against control A.7.7, ‘clear desk and clear screen’ because the drives have been left unprotected on the desktop.
- C . Record an opportunity for improvement in respect of the external provider’s inventory management arrangements.
- D . Ensure that the organisation’s arrangements for the secure disposal and reuse of equipment have been adhered to.
- E . Record the finding but note no further action is required as the pickup has now been rescheduled.
- F . Raise a nonconformity against control A.7.5, ‘protecting against physical and environmental threats’ because the drives have been left exposed on the desktop.
- G . Ensure that the organisation’s arrangements for the life cycle management of storage media have been adhered to.
- H . Follow an audit trail to determine whether the organisation is complying with its obligations in respect of control A.5.22 ‘monitoring, review and change management of supplier services’.
DGH
Explanation: