Free PECB Certified ISO/IEC 27001 Lead Auditor Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO/IEC 27001 Lead Auditor practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An auditor finds that a security procedure has a weakness that an attacker could exploit. How should the auditor characterize that weakness?

   1. A.A vulnerability in the security procedureCorrect answer: A
   2. B.A threat event against the procedure
   3. C.A security control within the procedure
   4. D.An adverse impact on the organization

   Explanation: NIST defines a vulnerability as a "Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source." The exploitable procedural weakness is therefore a vulnerability; a threat, a control, and an impact describe different aspects of risk.

   Reference: NIST Computer Security Resource Center Glossary: Vulnerability — Definitions, FIPS 200 definition

2. 2An organization has determined controls for its ISMS risk treatment. Why should it compare those controls with ISO/IEC 27001 Annex A?

   1. A.To identify any necessary control inadvertently omittedCorrect answer: A
   2. B.To make every Annex A control mandatory without exception
   3. C.To replace its risk assessment with the Annex A list
   4. D.To require that every necessary control comes from Annex A

   Explanation: The auditing practice note explains that comparison is used "to discover if any necessary control has been inadvertently omitted". It is a completeness check; necessary controls can also come from other sources.

   Reference: ISO/IEC 27001:2022 — Statement of Applicability and Conformity Discussion — p. 3, Summary

3. 3A PECB-certified auditor has a financial relationship with an audit client that might impair judgment. What does the PECB code expect the auditor to do?

   1. A.Inform the employer or client of the interestCorrect answer: A
   2. B.Conceal it until the audit report is issued
   3. C.Let the client decide findings without disclosure
   4. D.Record it only in personal notes after the audit

   Explanation: The source states: "Informing their employer or client of any business interests or affiliations which might influence or impair their judgment." Disclosure of interests that may impair judgment is required by the stated code; delaying or hiding the conflict does not satisfy it.

   Reference: PECB Code of Ethics Violation Policy — Code of Ethics, item 5

4. 4After stage 1, how should its results be used when preparing the stage 2 certification audit plan?

   1. A.Use the stage 1 outcome to inform the stage 2 planCorrect answer: A
   2. B.Hold the stage 1 outcome until stage 2 has finished
   3. C.Discard stage 1 results if no nonconformity was raised
   4. D.Treat all stage 1 observations as verified stage 2 findings

   Explanation: The guidance says: "Use the outcome of Stage 1 audit to plan the stage 2". Stage 1 results inform planning; withholding, discarding or treating them as already verified stage 2 findings does not do so.

   Reference: ISO 9001 Auditing Practices Group: Audit Planning — p. 2, Useful Tips to Auditors

5. 5During a stage 1 certification audit, the team reviews site conditions and talks with staff. What is the purpose of this activity in the ISO/IAF two-stage guidance?

   1. A.Determine the client's preparedness for stage 2Correct answer: A
   2. B.Demonstrate full conformity of every process before stage 2
   3. C.Complete the certification decision on the basis of stage 1
   4. D.Verify the effectiveness of every control required by the ISMS

   Explanation: The ISO/IAF guidance states: "evaluating the client's location and site-specific conditions, and undertaking discussions with the selected personnel in order to determine the preparedness of the client for the stage 2". The cited stage 1 activity helps assess readiness for stage 2, rather than completing the certification decision or replacing the next stage.

   Reference: ISO 9001 Auditing Practices Group: Two Stage Initial Certification Audit — p. 1, Stage 1 activities

6. 6An organization replaces an obsolete procedure with its current version to address a detected nonconformity. How does the ISO/IAF guidance classify this immediate action?

   1. A.CorrectionCorrect answer: A
   2. B.Corrective action
   3. C.Cause analysis
   4. D.Risk acceptance

   Explanation: The ISO/IAF guidance defines correction as an "action to eliminate a detected nonconformity". It gives replacing an obsolete procedure as an example; eliminating the cause to prevent recurrence is a separate consideration.

   Reference: ISO 9001 Auditing Practices Group: Review and Closing of Nonconformities — p. 2, Review of Actions in Response to a Nonconformity

7. 7A person managing an ISMS audit programme wants to improve it over time. Which activity does ISO/IAF guidance identify as an input to that evaluation?

   1. A.Monitor individual audits as input to programme evaluationCorrect answer: A
   2. B.Review the initial schedule without examining the audits performed
   3. C.Evaluate the programme using budgets but excluding audit execution
   4. D.Evaluate the programme using planned dates without audit results

   Explanation: ISO/IAF guidance states: "Individual audits are monitored for evaluation and improvement of the audit program". Monitoring the individual audits provides information for evaluating and improving the programme.

   Reference: ISO 9001 Auditing Practices Group: Effective Use of ISO 19011 — p. 3, Managing an audit program

8. 8A cloud provider allocates shared physical resources dynamically among multiple customers. Which cloud characteristic does this illustrate?

   1. A.Measured service
   2. B.Resource poolingCorrect answer: B
   3. C.Broad network access
   4. D.On-demand self-service

   Explanation: NIST states: "The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand." Dynamic sharing among consumers is resource pooling; the other terms describe usage metering, network access, and customer provisioning.

   Reference: The NIST Definition of Cloud Computing — Section 2, Essential Characteristics and Service Models, p. 2

9. 9An organization uses a necessary information security control that it designed itself and that is not listed in Annex A. What should its Statement of Applicability do with that control?

   1. A.Include the necessary controlCorrect answer: A
   2. B.Exclude it because it is not in Annex A
   3. C.Include it only if the certification body designed it
   4. D.Replace it with the nearest Annex A control

   Explanation: The ISO/IEC 27001 auditing practice note specifies "if the organization uses a control that is not in Annex A, then for conformity with ISO/IEC 27001, 6.1.3 d) it must be included in the SOA". The custom necessary control must be documented in the SoA; its absence from Annex A does not justify exclusion or forced replacement.

   Reference: ISO/IEC 27001:2022 — Statement of Applicability and Conformity Discussion — p. 4, Helping an Auditee Interpret the Use of SoA

10. 10A PECB professional wants to share a former client's confidential audit documents as a reference for a new client. What does PECB's policy identify as necessary to avoid the specific violation it describes?

    1. A.Obtain the other parties' consent before sharingCorrect answer: A
    2. B.Obtain only the new client's consent before sharing
    3. C.Treat the former client's consent as unnecessary after the audit
    4. D.Assume consent was implicit in the former audit engagement

    Explanation: PECB lists sharing confidential documents as a reference for a new client "without the other parties’ consent" as a violation. The former-client confidentiality obligation remains after the engagement; a new client’s consent alone does not establish the other parties’ consent.

    Reference: PECB Code of Ethics Violation Policy — Code of Ethics, item 6