Start here
Five free questions
See original questions, correct answers, distractor reasoning and sources without creating an account.
Try free questionsPECB exam preparation
ISO/IEC 27001 Foundationexam preparation
The ISO/IEC 27001 Foundation exam is a one-hour, closed-book PECB examination that tests foundational knowledge of information security management systems. It contains 40 multiple-choice questions, split equally across two competency domains, and has a 70% pass mark. Candidates are assessed on core information-security concepts, ISO/IEC 27001 requirements, risk management, Annex A controls, performance evaluation and continual improvement.
- Questions
- 40
- Pass mark
- 70%
- Domains
- 2
- Format
- Closed book
Choose what you need
Training, free examples and full preparation are separate.
Select the path that matches what you already have. Your Labs purchase unlocks only this exact exam.
Full Aegentra Labs access
$49 + GST for 1 month
Or $99 + GST for 12 months. Complete bank, casual mode, exam mode, saved results and domain feedback.
Choose Labs accessOfficial PECB training
Need the course and exam pathway?
Buy official course materials and the applicable examination pathway separately through Aegentra Academy.
View the official courseAeges AI · Learning Intelligence
Results analysed with Aeges AI
Complete a ISO/IEC 27001 Foundation practice session, then use Aeges AI learning intelligence to understand how your submitted answers performed across the qualification. For this exam, the analysis separates foundational ISMS concepts from the requirements, controls and management-system relationships that need more review.
See how Aeges AI works- Competency map
- 2 domains
- Learning signal
- Relative strength and gap
- Next decision
- Revision priority
Written by Harry Sidhu, ISO 27001 Lead Implementer · Director and Principal Consultant, Aegentra. Facts are checked against the published sources listed below.
Published exam facts
What is on the ISO/IEC 27001 Foundation exam?
These facts come from PECB’s published documents. Where PECB does not publish a detail, this page says so instead of repeating an unsupported figure.
- Questions
- 40
- Pass mark
- 70%
- Duration
- 60 minutes
Stand-alone and scenario-based multiple choice.
Equivalent to 28 correct answers from 40 questions.
Exam conditions
Closed bookNo reference materials are permitted. Prepare the core terminology, relationships and process sequence before the examination rather than relying on a reference index.
Retakes: Partner-delivered training includes the first attempt and one free retake within 12 months, subject to PECB examination rules.
Your revision map
How is the exam weighted across domains?
The published handbook allocates all 40 questions across 2 competency domains. The simulation below follows that allocation.
- Domain 150%20 questions
Fundamental principles and concepts of an information security management system
ISO management-system structure, confidentiality, integrity and availability, information and assets, threats, vulnerabilities, risk and emerging-technology concepts.
- Domain 250%20 questions
Information security management system requirements
Clauses 4 to 10, leadership, scope, objectives, risk assessment and treatment, competence, documented information, operations, audits, management review, corrective action and Annex A controls.
Question structure
What kinds of questions are asked?
Expect a mix of direct knowledge checks and applied scenarios. The emphasis is on choosing the action a competent foundation would take.
- Stand-alone multiple choice
- Independent three-option questions test terminology, purpose, relationships and the ability to recognise a sound management-system or risk-management practice.
- Short applied scenarios
- A concise organisational situation asks the candidate to select the response that best follows the standard, framework or published competency statement.
Study strategy
How should you sequence your study?
Move from information-security concepts into the ISMS lifecycle. The two domains are equally weighted, so do not spend all your time memorising Annex A controls while neglecting how clauses 4 to 10 operate together.
- Secure the core definitions. Be able to distinguish assets, information, threats, vulnerabilities, likelihood, consequences, risk and controls.
- Map clauses 4 to 10. Connect context, leadership, planning, support, operation, performance evaluation and improvement through the PDCA cycle.
- Trace one risk treatment. Follow a risk from criteria and assessment through treatment, residual-risk acceptance and the Statement of Applicability.
- Group Annex A controls. Use organisational, people, physical and technological themes and know the purpose of representative controls.
- Practise assurance concepts. Separate monitoring, internal audit, management review, correction, corrective action and continual improvement.
Where do candidates actually lose marks?
Foundation questions reward precise relationships. Similar-sounding terms are used as distractors because they lead to different management decisions.
- Confusing threat and vulnerability. A threat is a potential cause; a vulnerability is a weakness that can be exploited.
- Treating Annex A as the whole ISMS. The controls support risk treatment inside the wider management-system requirements.
- Skipping residual-risk acceptance. Treatment does not automatically make the remaining risk acceptable or authorised.
- Confusing correction and corrective action. Correction fixes the detected issue; corrective action addresses its cause and recurrence.
Candidate questions
ISO/IEC 27001 Foundation exam FAQs
Direct answers about time, materials, retakes, credentials and the knowledge expected before exam day.
How many questions are in the ISO/IEC 27001 Foundation exam?
The current English multiple-choice examination contains 40 questions. Aegentra Labs follows the published competency-domain allocation when building the full simulation, so the practice result reflects the structure of the examination rather than an arbitrary mix of topics.
How long is the ISO/IEC 27001 Foundation exam?
The published examination duration is 60 minutes. Candidates should reserve time to read scenario material, review flagged questions and complete a final check rather than budgeting every minute only for the first pass.
Is the ISO/IEC 27001 Foundation exam open book?
No. The current English Foundation examination is closed book. Candidates cannot use the standard, training material, personal notes or internet resources during the examination, so core concepts and relationships need to be understood before the session.
What score is required to pass the ISO/IEC 27001 Foundation exam?
The published pass mark is 70%. Aegentra Labs recommends consistently scoring above that threshold across every domain, because a strong total can conceal a weak competency area that remains important in professional practice.
What credential follows the ISO/IEC 27001 Foundation exam?
After passing, candidates can apply for the PECB Certificate Holder in ISO/IEC 27001 Foundation designation. Passing the examination satisfies the exam requirement, but professional certification levels may also require relevant work, project or audit experience and acceptance of the PECB Code of Ethics.