Preparation guide
ISO 27001 Lead Auditor study guide
Use the source-backed decision map, original scenario and study sequence before practising.
Read the study guidePECB exam preparation
ISO/IEC 27001 Lead Auditorexam preparation
The ISO/IEC 27001 Lead Auditor exam is a three-hour, open-book PECB certification examination for professionals who plan, conduct and manage information security management system audits. It contains 80 multiple-choice questions across seven weighted competency domains and has a 70% pass mark. Conducting an ISO/IEC 27001 audit is the largest domain, followed by audit principles and information-security fundamentals.
- Questions
- 80
- Pass mark
- 70%
- Domains
- 7
- Format
- Open book
Choose what you need
Training, free examples and full preparation are separate.
Select the path that matches what you already have. Your Labs purchase unlocks only this exact exam.
Start here
Five free questions
See original questions, correct answers, distractor reasoning and sources without creating an account.
Try free questionsFull Aegentra Labs access
$49 + GST for 1 month
Or $99 + GST for 12 months. Complete bank, casual mode, exam mode, saved results and domain feedback.
Choose Labs accessOfficial PECB training
Need the course and exam pathway?
Buy official course materials and the applicable examination pathway separately through Aegentra Academy.
View the official courseAeges AI · Learning Intelligence
Results analysed with Aeges AI
Complete a ISO/IEC 27001 Lead Auditor practice session, then use Aeges AI learning intelligence to understand how your submitted answers performed across the qualification. For this exam, the analysis separates audit principles, preparation, evidence gathering, findings, closing activities and audit-programme decisions.
See how Aeges AI works- Competency map
- 7 domains
- Learning signal
- Relative strength and gap
- Next decision
- Revision priority
Written by Harry Sidhu, ISO 27001 Lead Implementer · Director and Principal Consultant, Aegentra. Facts are checked against the published sources listed below.
Published exam facts
What is on the ISO/IEC 27001 Lead Auditor exam?
These facts come from PECB’s published documents. Where PECB does not publish a detail, this page says so instead of repeating an unsupported figure.
- Questions
- 80
- Pass mark
- 70%
- Duration
- 180 minutes
Stand-alone and scenario-based multiple choice.
Equivalent to 56 correct answers from 80 questions.
Open-book materials
What you may bring- ISO standardA hard copy of the ISO/IEC 27001 standard
- Course materialsTraining course materials, through the PECB Exams app and/or printed
- Personal notesPersonal notes taken during the training course, through the PECB Exams app and/or printed
Retakes: Partner-delivered training includes the first attempt and one free retake within 12 months. PECB waiting periods and other examination rules still apply.
Your revision map
How is the exam weighted across domains?
The published handbook allocates all 80 questions across 7 competency domains. The simulation below follows that allocation.
- Domain 116.25%13 questions
Fundamental principles and concepts of an information security management system
Information-security concepts, assets, risk, legal and contractual requirements, control functions, cloud, outsourcing and emerging technology.
- Domain 210%8 questions
ISMS and ISO/IEC 27001 requirements
Clauses 4 to 10, Annex A, risk assessment and treatment, the Statement of Applicability, objectives, operations, measurement and improvement.
- Domain 317.5%14 questions
Fundamental audit concepts and principles
Audit types, principles, evidence, materiality, sampling, independence, competence, risk-based auditing and certification requirements.
- Domain 415%12 questions
Preparing an ISO/IEC 27001 audit
Audit feasibility, client acceptance, objectives, criteria and scope, team selection, document review, audit plans and working papers.
- Domain 522.5%18 questions
Conducting an ISO/IEC 27001 audit
Opening meetings, evidence collection, interviews, observation, technical sampling, control testing, audit findings and team communication.
- Domain 68.75%7 questions
Closing an ISO/IEC 27001 audit
Nonconformity classification, closing meetings, audit reports, recommendations, corrective-action review and follow-up activities.
- Domain 710%8 questions
Managing an ISO/IEC 27001 audit program
Programme objectives, resources, records, auditor performance, combined audits, surveillance, recertification and continual improvement.
Question structure
What kinds of questions are asked?
Expect a mix of direct knowledge checks and applied scenarios. The emphasis is on choosing the action a competent lead auditor would take.
- Stand-alone multiple choice
- Independent questions have three options: one keyed response and two plausible distractors. They test concepts, responsibilities, evidence and professional judgement.
- Scenario-based multiple choice
- A written organisational scenario supports related questions that require candidates to analyse evidence, identify weaknesses and choose the most appropriate next action.
- Evaluation-level decisions
- Higher-weighted domains ask candidates to compare reasonable alternatives and select the action that best achieves the intended outcome, not merely recall a definition.
Study strategy
How should you sequence your study?
The largest marks sit in planning and conducting the audit. Study ISO/IEC 27001 as audit criteria, then rehearse how an independent auditor turns risk, scope and sampling into defensible findings.
- Reframe the ISMS as criteria. For every clause and control theme, identify what evidence would demonstrate conformity and effectiveness.
- Learn the audit principles. Independence, evidence, due care, confidentiality and risk-based planning guide judgement when facts conflict.
- Build a risk-based audit plan. Use scope, objectives, previous results, significant changes and high-risk processes to allocate time and samples.
- Practise triangulation. Compare interviews, records, observations and technical evidence instead of relying on one source.
- Write and close findings. Connect criteria to objective evidence, then evaluate corrective-action plans and later effectiveness.
Where do candidates actually lose marks?
The exam tests auditor behaviour as much as technical knowledge. Answers that compromise independence or skip evidence are usually weaker even when they sound helpful.
- Auditing the checklist instead of the system. Conformity depends on processes, interactions, risks and outcomes—not document presence alone.
- Overstating a sample. A sample supports a bounded conclusion; it does not prove that every transaction is conforming.
- Prescribing the solution. The auditee owns root cause and corrective action; the auditor evaluates adequacy and effectiveness.
- Weak evidence language. Findings should identify what was examined, what was observed and which requirement was not fulfilled.
Candidate questions
ISO/IEC 27001 Lead Auditor exam FAQs
Direct answers about time, materials, retakes, credentials and the knowledge expected before exam day.
How many questions are in the ISO/IEC 27001 Lead Auditor exam?
The current English multiple-choice examination contains 80 questions. Aegentra Labs follows the published competency-domain allocation when building the full simulation, so the practice result reflects the structure of the examination rather than an arbitrary mix of topics.
How long is the ISO/IEC 27001 Lead Auditor exam?
The published examination duration is three hours. Candidates should reserve time to read scenario material, review flagged questions and complete a final check rather than budgeting every minute only for the first pass.
Is the ISO/IEC 27001 Lead Auditor exam open book?
Yes. The current English examination is open book, but permitted materials are limited to the main reference standard or framework, PECB training material and personal course notes. Internet searching and unrestricted reference material are not permitted.
What score is required to pass the ISO/IEC 27001 Lead Auditor exam?
The published pass mark is 70%. Aegentra Labs recommends consistently scoring above that threshold across every domain, because a strong total can conceal a weak competency area that remains important in professional practice.
What credential follows the ISO/IEC 27001 Lead Auditor exam?
Passing allows an application for the appropriate PECB ISO/IEC 27001 Auditor credential tier. Passing the examination satisfies the exam requirement, but professional certification levels may also require relevant work, project or audit experience and acceptance of the PECB Code of Ethics.