ISO/IEC 27001 Foundation

What to Expect on the ISO/IEC 27001 Foundation  Exam 

The PECB ISO/IEC 27001:2022 Foundation exam is a one-hour, closed-book test taken online under PECB’s remote proctoring. You’ll face 40 multiple-choice questions, each with exactly three answer options — only one correct. That narrower option count matters: it makes careless elimination mistakes more costly than on a standard four-option exam, because a wrong first instinct leaves you with a 50/50 guess instead of a 33/67 one.

A meaningful chunk of the exam isn’t straight recall. PECB builds scenario clusters into the Foundation exam — a short case description followed by a run of related questions, each worth points independently but all drawing on the same scenario. If you misread the scenario’s setup, you can lose multiple points in a row rather than just one. The rest of the exam is stand-alone questions that test a single fact or concept with no supporting context.

You need 70% to pass — 28 of 40 correct. If you’re sitting the exam in a language that isn’t your native one, PECB allows an extra 10 minutes on request for paper-based sittings; this doesn’t automatically apply to the online version, so confirm with your training provider or PECB directly if that applies to you.

Domain Breakdown

The split is even, but don’t let that fool you into studying both halves the same way. Domain 1 is largely conceptual — what an ISMS is, why organizations build one, core information security terminology. Domain 2 is where candidates actually lose points, because it requires you to map specific clause numbers and Annex A control categories to specific scenarios rather than just recognize a definition.

The Topics Candidates Consistently Underestimate

Clause numbering versus Annex A controls. A lot of Foundation candidates study ISO 27001 as one undifferentiated block. The exam doesn’t treat it that way. Clauses 4–10 (the management system requirements — context of the organization, leadership, planning, support, operation, performance evaluation, improvement) are tested separately from Annex A, which lists the actual security controls (organizational, people, physical, technological). Conflating “the standard requires risk assessment” (Clause 6) with “a specific Annex A control covers X” is a common source of wrong answers.

The PDCA/continual improvement framing. ISO/IEC 27001:2022 doesn’t use the Plan-Do-Check-Act language as explicitly as older management-system standards did, but the underlying logic — establish, implement, monitor, improve — still drives how questions about Clause 9 (performance evaluation) and Clause 10 (improvement) are framed. Candidates who memorize clause titles without understanding this cycle struggle with scenario questions that ask “what should happen next” after a nonconformity is found.

The distinction between certification and conformity. Several Foundation-level questions probe whether candidates understand that ISO/IEC 27001 certification applies to an organization’s ISMS, not to a product, service, or individual — and that “conformity” and “compliance” aren’t interchangeable in the standard’s own vocabulary. This is a conceptual trap, not a memorization one.

Risk treatment options. Candidates often know that risk assessment happens but are shakier on the four standard risk treatment choices (modify, retain, avoid, share) and which Annex A controls typically pair with which treatment approach in a scenario.

How to Use Practice Tests Effectively for ISO/IEC 27001 Foundation  Exam

Because a meaningful portion of the  exam is scenario-based, drilling isolated recall questions only gets you partway there. When you practice, read the full scenario before looking at any of its linked questions, and try to predict which clause or Annex A category the scenario is pointing at before you see the answer choices. That’s the actual skill being tested — pattern-matching a described situation back to the right part of the standard — not just knowing definitions cold.

Pay attention to wrong-answer patterns, not just your score. With only three options per question, PECB tends to build distractors that are “almost right” — a plausible-sounding answer that confuses two adjacent clauses or mixes up a control’s intent. If you notice you’re repeatedly drawn to the same type of distractor, that’s a more useful signal than a raw percentage.

Time yourself in blocks that match the  pacing: 40 questions in 60 minutes gives you roughly 90 seconds per question, less once you factor in reading scenario setups. Candidates who’ve never practiced under that constraint often run out of time on the scenario clusters specifically, because they re-read the case description for every linked question instead of once.

Common Mistakes That Cause Retakes

• Treating Domain 2 as “more Annex A controls to memorize” instead of understanding how clauses and controls work together in a described situation

• Skimming scenario setups and relying on the question stem alone, missing a detail (scope, role, or timing) that changes the correct answer

• Confusing ISO/IEC 27001 (the certifiable management system standard) with ISO/IEC 27002 (the control implementation guidance) — they’re related but tested differently

• Assuming the Foundation exam is purely definitional because it’s the entry-level credential; roughly half of it still requires applying a concept to a scenario, not just naming it

ISO/IEC 27001 Foundation Study Timeline by Starting Experience Level

New to information security and ISO management standards: Plan for the full two-day training course plus 3–5 additional days of independent review before sitting the exam. The 200-plus pages of official course material cover the standard’s structure, but first-time learners usually need extra time to get comfortable distinguishing clauses from Annex A controls.

Already working in IT, compliance, or risk, but new to ISO/IEC 27001 specifically: The training course plus 1–2 days of focused review on Annex A categories and clause numbering is usually enough. Your existing vocabulary carries over; what’s new is PECB’s specific framing and scenario style.

Retaking after a first attempt: PECB allows one free retake within 12 months of the original exam. Don’t just redo the same practice questions — go back through which domain cost you the most points (PECB’s fail notification identifies weak domains) and spend your retake prep almost entirely there. Most retake failures come from under-preparing Domain 2’s clause-to-control mapping, not from running out of general knowledge.