ISO/IEC 27001 Lead Auditor

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Fundamental principles and concepts of an ISMS

   An email asking accounts staff to change a supplier's bank details arrived exactly as written, but it was sent from a look-alike domain controlled by a fraudster. Which information security property did the email controls fail to assure?

   1. Reliability
   2. Integrity
   3. Confidentiality
   4. Authenticity

2. Information security management system (ISMS)

   An organization seeking certification plans to exclude clause 8.2, performing information security risk assessments at planned intervals, because its Annex A controls already cover its risks. How should the auditor respond?

   1. Accept it, provided the Statement of Applicability justifies it.
   2. Reject it unless the risk treatment plan covers every risk.
   3. Reject it, as clauses 4 to 10 cannot be excluded.
   4. Accept it, provided top management formally approves the exclusion.

3. Fundamental audit concepts and principles

   An insurer operating in three countries asks the certification auditor to confirm, during its ISMS audit, that it complies with each country's data protection law. How should the auditor respond?

   1. Sample how legal requirements are identified and met, without certifying compliance.
   2. Confirm compliance for a sample of laws, using a data protection expert.
   3. Leave legal requirements out of the sample, as regulators assess compliance.
   4. Extend the audit time to confirm compliance in each sampled country.

4. Conducting an ISO/IEC 27001 audit

   An IT manager's own spreadsheet states that all 40 privileged accounts were reviewed in June. The auditor traced a risk-based sample of 10 entries to the review sign-offs and access records, and all 10 agree. How should the auditor treat the spreadsheet?

   1. Check the remaining 30 accounts before relying on it.
   2. Obtain the IT manager's signed statement that it is complete.
   3. Rely on it as corroborated evidence of the June review.
   4. Ask for the June review to be repeated in the auditor's presence.

5. Preparing an ISO/IEC 27001 audit

   Case study 1 - Linmoor Regional Hospital (5 questions) Linmoor Regional Hospital employs 1,900 staff on two sites: the main hospital and an outpatient clinic. Its ISMS covers the electronic patient record (EPR) system, the laboratory information system and the supporting IT operations. A certification body is conducting the stage 2 audit over three days, with audit team leader Nadia Osei and auditor Tom Rinaldi. Stage 1, held four weeks earlier, found that patient care depends most on the EPR. It also recorded one area of concern: no backup restore test had yet been performed. During stage 2, the team establishes the following facts. First, the IT team presents a restore test record dated last week and signed by the backup administrator. Second, the access procedure requires the EPR accounts of leavers to be disabled within 24 hours. In a sample of 25 leavers from the last six months, 7 accounts were still active, and 3 of them had been used after the person left. The hospital's own risk assessment rates leavers' access as a low risk. Third, the vendor of the laboratory information system has remote administrator access to it, but the vendor's contract contains no information security requirements. The last day of stage 2 is 14 March. At the closing meeting, the team will present its findings and explain how they affect its recommendation on certification. Question 1 of 5: Stage 1 found that patient care depends most on the EPR. Applying materiality, how should the stage 2 audit time have been allocated?

   1. Spread evenly over every Annex A control and both sites.
   2. Weighted towards processes whose documentation was approved at stage 1.
   3. Weighted towards EPR access control and backup.
   4. Weighted towards the outpatient clinic, the site least seen at stage 1.

6. Closing an ISO/IEC 27001 audit

   Case study 1 - Linmoor Regional Hospital (5 questions) Linmoor Regional Hospital employs 1,900 staff on two sites: the main hospital and an outpatient clinic. Its ISMS covers the electronic patient record (EPR) system, the laboratory information system and the supporting IT operations. A certification body is conducting the stage 2 audit over three days, with audit team leader Nadia Osei and auditor Tom Rinaldi. Stage 1, held four weeks earlier, found that patient care depends most on the EPR. It also recorded one area of concern: no backup restore test had yet been performed. During stage 2, the team establishes the following facts. First, the IT team presents a restore test record dated last week and signed by the backup administrator. Second, the access procedure requires the EPR accounts of leavers to be disabled within 24 hours. In a sample of 25 leavers from the last six months, 7 accounts were still active, and 3 of them had been used after the person left. The hospital's own risk assessment rates leavers' access as a low risk. Third, the vendor of the laboratory information system has remote administrator access to it, but the vendor's contract contains no information security requirements. The last day of stage 2 is 14 March. At the closing meeting, the team will present its findings and explain how they affect its recommendation on certification. Question 5 of 5: Suppose the leavers' finding is graded a major nonconformity. Stage 2 ended on 14 March, and the fix cannot be in place before 30 September. How should the recommendation be handled?

   1. Verify the fix at a follow-up visit in October, then recommend certification.
   2. Recommend certification on the dated plan and verify the fix at surveillance.
   3. Conduct another stage 2 audit after the fix, then decide on the recommendation.
   4. Regrade the finding as minor, as a credible dated plan is in place.

7. Managing an ISO/IEC 27001 audit programme

   FabriTech's chief executive asks to choose the leader of the team for its recertification audit, who would then pick the two other auditors. According to ISO 19011, who should select the audit team members, including the leader?

   1. FabriTech's chief executive, after consulting the programme manager as needed
   2. The team leader, subject to the programme manager's approval
   3. The programme manager, consulting the team leader where appropriate
   4. The programme manager jointly with FabriTech's chief executive

8. Fundamental principles and concepts of an ISMS

   An ISMS manager removes the data protection authority from the organization's interested parties, as there is no contract with it. The authority can investigate and fine the organization. Which element of the interested-party definition does that power demonstrate?

   1. It is affected by the organization's decisions or activities.
   2. It perceives itself to be affected by the organization's activities.
   3. It can affect the organization's decisions or activities.
   4. The organization has decided to address its requirements in the ISMS.

9. Information security management system (ISMS)

   An auditor drafts a nonconformity because backups are protected by a method that differs from the ISO/IEC 27002:2022 guidance for control 8.13. The backups follow the organization's backup policy and restore tests succeed. What is wrong with raising this nonconformity?

   1. It should cite Annex A control 8.13, not the ISO/IEC 27002 guidance.
   2. It should cite the backup policy rather than the ISO/IEC 27002 guidance.
   3. It treats ISO/IEC 27002 guidance as an auditable requirement.
   4. It needs risk owner acceptance for departing from ISO/IEC 27002 guidance.

10. Fundamental audit concepts and principles

    A reviewer says three firewall rules missing from his signed weekly review were authorized through the service desk. Those tickets have since been deleted, but the change advisory board's minutes, which list every authorized firewall change, are kept. What should the auditor do next?

    1. Obtain the reviewer's explanation as a signed written statement.
    2. Check that week's board minutes for the three firewall rules.
    3. Ask the service desk manager to confirm the three authorized rules.
    4. Re-perform that week's review from the attached rule export.

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.