Professional Documents
Culture Documents
www.pecb.com
PECB-820-1-ISO 27001LA Exam Preparation Guide
The objective of the “Certified ISO/IEC 27001 Lead Auditor” examination is to ensure that the
candidate has the knowledge and the skills to plan and perform an Information Security
Management System (ISMS) audit compliant with the ISO/IEC 27001:2013 standard.
Furthermore, the objective of the examination is to ensure that the candidate has acquired the
knowledge to master audit principles and techniques, and to manage (or be part of) audit teams
and audit programs in compliance with ISO/IEC 17021-1 certification process and guidelines of
ISO 19011.
Auditors seeking to perform and lead Information Security Management System (ISMS)
certification audits
Project managers or consultants seeking to master the Information Security Management
System audit process
Individuals responsible for maintaining conformance with Information Security
Management System audit process
Members of an information security team
Expert advisors in information technology
Technical experts seeking to prepare for an Information Security Management System
audit
Page 2 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
1. Understand and explain the operations 1. Knowledge of the application of the eight ISO
of the ISO organization and the management principles to information security
development of information security 2. Knowledge of the main standards in
standards information security
2. Ability to identify, analyze and evaluate 3. Knowledge of the different sources of
the information security compliance information security requirement for an
requirements for an organization organization: laws, regulations, international
3. Ability to explain and illustrate the main and industry standards, contracts, market
concepts in information security and practices, internal policies
information security risk management 4. Knowledge of the main information security
4. Ability to distinguish and explain the concepts and terminology as described in ISO
difference between information asset, 27000
data and record 5. Knowledge of the concept of risk and its
5. Understand, interpret and illustrate the application in information security
relationship between the concepts of 6. Knowledge of the relationship between the
asset, vulnerability, threat, impact and concepts of asset, vulnerability, threat, impact
controls and controls
7. Knowledge of the difference and characteristics
of security objectives and controls
8. Knowledge of the difference between
preventive, detective and corrective controls
and their characteristics
Page 3 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Page 4 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
1. Understand, explain and illustrate the 1. Knowledge of the main audit concepts
application of the audit principles in the and terminology as described in ISO
context of an ISO 27001 audit 19011
2. Ability to identify and judge situations that 2. Knowledge of the differences between
would discredit the professionalism of the the types of audits such as first party,
auditor and the PECB code of ethics second party and third party audit
3. Ability to identify and evaluate ethical 3. Knowledge of the following audit
problems taking into account the principles: integrity, fair presentation,
obligations related to sponsors, audittee due professional care, confidentiality
and law enforcement or regulatory independence and evidence-based
authorities approach.
4. Ability to explain, illustrate and apply the 4. Knowledge of professional responsibility
audit evidence approach in the context of an of an auditor and the PECB code of
ISO 27001 audit ethics
5. Ability to explain and compare the types and 5. Knowledge of evidence based approach
characteristics of evidence in an audit
6. Ability to determine and justify what type of 6. Knowledge of the different types of
evidence and how much evidence will be evidences: physical, mathematical,
required in the context of a specific ISMS confirmative, technical, analytical,
audit mission documentary and verbal
7. Ability to determine and evaluate the level of 7. Knowledge of the quality of audit
materiality and apply the risk based evidences (appropriate, reliable, reliable
approach during the different phases of an and sufficient) and the factors that will
ISO 27001 audit influence them.
8. Ability to judge the appropriate level of 8. Knowledge of the risk based approach
reasonable assurance needed for a specific in an audit and the different types of risk
ISO 27001 audit mission related to audit activities such as:
Inherent risk, control risk and detection
risk
9. Knowledge of the concept of materiality
and its application in an audit
10. Knowledge of the concept of reasonable
assurance and its applicable in an audit
Page 5 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
1. Understand and explain the steps and 1. Knowledge of the main responsibilities of the
activities to prepare an ISMS audit, audit team leader and audit team members
taking in consideration the specific 2. Knowledge of the roles and responsibilities of
context and conditions of the mission technical experts used for an audit
2. Understand and explain the roles and 3. Knowledge of the definition of audit objectives,
responsibilities of the audit team leader, audit scope and audit criteria
audit team members and technical
4. Knowledge of the difference between the ISMS
experts
scope and the audit scope
3. Ability to determine, evaluate and
5. Knowledge of the elements to review during
confirm the audit objectives, the audit
the feasibility study of an audit
criteria and the audit scope for a
specific ISO 27001 audit mission 6. Knowledge of the cultural aspects to consider
in an audit
4. Ability to do a feasibility study of an
audit in the context of a specific ISO 7. Knowledge of the characteristics of audit terms
27001 audit mission of engagement and the best practices to
establish a first contact with an audittee
5. Ability to explain, illustrate and define
the characteristics of the audit terms of 8. Knowledge of the preparation of an audit plan
engagement and apply the best 9. Knowledge of the preparation and
practices to establish a first contact with development of audit working paper
an audittee in the context of a specific 10. Knowledge of advantages and disadvantages
ISO 27001 audit mission of using audit checklists
6. Ability to develop audit working papers 11. Knowledge of the best practices to creation
and to elaborate appropriate audit test audit test plans
plans in the context of a specific ISO
27001 audit mission
Page 6 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
1. Ability to organize and conduct the 1. Knowledge of the objectives and the content of
opening meeting in the context of a the opening meeting of an audit
specific ISO 27001 audit mission 2. Knowledge of the difference of the stage 1
2. Ability to conduct a stage 1 audit in the audit and the stage 2 audit
context of a specific ISO 27001 audit 3. Knowledge of stage 1 audit requirements,
mission and taking into account the steps and activities
documentation review conditions and 4. Knowledge of the documentation review criteria
criteria 5. Knowledge of the documentation requirements
3. Ability to prepare the audit plan for stated in ISO 27001
stage 2 audit, containing all the 6. Knowledge of stage 2 audit requirements,
necessary documents and the steps and activities
assignment of the auditors and 7. Knowledge of best practices of communication
technical experts for the stage. during an audit
4. Ability to conduct a stage 2 audit in the 8. Knowledge of the roles and responsibilities of
context of a specific ISO 27001 audit guides and observers during an audit
mission by applying the best practices 9. Knowledge of the conflict resolution techniques
of communication to collect the 10. Knowledge of evidence collection procedures:
appropriate evidence and taking into observation, documentation review, interviews,
account the roles and responsibilities of analysis and technical verification
all people involved 11. Knowledge of evidence analysis procedures:
5. Ability to conduct audit tests, corroboration and evaluation
appropriate procedures, as well as the 12. Knowledge of main concepts, principles and
non-conformity reports statistical techniques used in an audit
6. Ability to explain, illustrate and apply 13. Knowledge of the main audit sampling methods
statistical techniques and main audit and their characteristics
sampling methods
7. Ability to gather appropriate evidences
objectively from the available
information in an audit and to evaluate
them objectively
Page 7 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Page 8 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Page 9 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Based on these seven domains and their relevance, twelve (12) questions are included in the
exam, as summarized in the following table:
Level of Understanding
(Cognitive/Taxonomy) Required
Points per Questions that Questions that Number of % of test Number % of
question measure measure Questions devoted to of points Points
Comprehension, Synthesis and per content each per per
Application and Evaluation area content compete competen
Analysis area ncy cy
domain domain
Fundamental 5 X 2 16.67 15 20
principles and
concepts of
Information
Security 10 X
Management
System (ISMS)
Information
5 X
Security 2 16.67 10 13.33
Content Area/Competence Domains
Management
5 X
System (ISMS)
Closing an 10 X 3 25 25 33.33
ISO/IEC 27001
audit 5 X
10 X
Managing an 5 X
ISO/IEC 27001 2 16.67 10 13.33
audit program 5 X
Total Points 75
Number of Questions per level
7 5
of understanding
% of Test Devoted to each
level of understanding 58.33 41.67
(cognitive/taxonomy)
After successfully passing the exam, candidates will be able to apply for the credentials of
Certified ISO 27001 Lead Auditor, depending on their level of experience.
Page 10 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Candidates will be required to arrive at least thirty (30) minutes before the beginning of the
certification exam. Candidates arriving late will not be given additional time to compensate for
the late arrival and may be denied entry to the exam room (if they arrive more than 5 minutes
after the beginning of the exam scheduled time).
All candidates will need to present a valid identity card with a picture such as a driver’s license
or a government ID to the invigilator.
The questions are essay type questions. This type of format was chosen because the intent
is to determine whether an examinee can write a clear coherent answer/argument and to
assess problem solving techniques. Because of this particularity, the exam is set to be “open
book” and does not measure the recall of data or information. The examination evaluates,
instead, comprehension, application, analysis, synthesis and evaluation, which mean that even
if the answer is in the course material, candidates will have to justify and give explanations, to
show they really understood the concepts. At the end of this document, you will find sample
exam questions and their possible answers.
As the exams are “open book”; candidates are allowed to use the following reference materials:
The use of electronic devices, such as laptops, cell phones, etc., is not allowed.
All attempt to copy, collude or otherwise cheat during the exam will automatically lead to the
exam’s failure.
PECB exams are available in English. For availability of the exam in a language other than
English, please contact examination@pecb.com
Results will be communicated by email in a period of 6 to 8 weeks, after taking the exam. The
results will not include the exact grade of the candidate, only a mention of pass or fail.
Candidates who successfully complete the examination will be able to apply for a certified
scheme.
In the case of a failure, the results will be accompanied with the list of domains in which the
candidate had a low grade, to provide guidance for exams’ retake preparation.
Page 11 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Candidates who disagree with the exam results may file a complaint. For more information,
please refer to www.pecb.com
There is no limit on the number of times a candidate may retake an exam. However, there are
some limitations in terms of allowed time-frame in between exam retakes, such as:
If a candidate does not pass the exam on the first attempt, he/she must wait 15 days for
the next attempt (1st retake). Retake fee applies.
Note: Students, who have completed the full training but failed the written exam, are eligible to
retake the exam once for free within a 12 month period from the initial date of the exam.
If a candidate does not pass the exam on the second attempt, he/she must wait 3
months (from the initial date of the exam) for the next attempt (2nd retake). Retake fee
applies.
If a candidate does not pass the exam on the third attempt, he/she must wait 6 months
(from the initial date of the exam) for the next attempt (3rd retake). Retake fee applies.
After the fourth attempt, a waiting period of 12 months from the last session date is required, in
order for candidate to sit again for the same exam. Regular fee applies.
For the candidates that fail the exam in the 2nd retake, PECB recommends to attend an official
training in order to be better prepared for the exam.
To arrange exam retakes (date, time, place, costs), the candidate needs to contact the PECB
partner who has initially organized the session.
CLOSING FILES
Candidates who want to request that their file be reopened must do so in writing, and pay the
required fees.
EXAMINATION SECURITY
Page 12 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
PECB examination content, they violate the PECB Code of Ethics. PECB will take action
against individuals who violate PECB Policies and the Code of Ethics. Actions taken may
include permanently barring individuals from pursuing PECB credentials and revoking
certifications from those who have been awarded the credential. PECB will also pursue legal
action against individuals or organizations who infringe upon its copyrights, proprietary rights,
and intellectual property.
1. Evidence in an audit
Determine how you would verify each of the following control measures. You must provide
examples of evidence you would look for to have a reasonable guarantee that the control
measure has been effectively implemented. State at least two elements of proof for each.
Possible answers:
- A non-conformity was observed because the Human Resources team was not aware
of the procedure that requires them to validate all future employee references before
hiring them.
Possible answers:
I agree. This solves the problem that was ignorance of the procedure. As auditor, a
sampling will be performed during the surveillance audit to find out if the procedure is
followed.
Page 13 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Determine threats and vulnerabilities associated to the following situations and indicate the
possible impacts. Also indicate if the risks would affect confidentiality, data integrity and/or
availability.
For each risk identified, provide the appropriate controls (by providing the clause number of the
control) which allows to reduce, transfer or avoid risks.
Possible answers:
4. Classification of controls
For each of the following 5 controls, indicate if it used as a preventive, corrective, and/or
detective control; and indicate, if the control is an administrative, technical, managerial or legal
measure. Explain your answer.
Possible answers:
Page 14 of 15
PECB-820-1-ISO 27001LA Exam Preparation Guide
Possible answers:
Protection of logged information (A.12.4.2): Logging facilities and log information shall be protected
against tampering and unauthorized access.
Interview with the information security manager and validate the logging policy
objectives, interview with the network administrator to validate the operation of
Interview the controls in place to protect the logged information against sabotage and
unauthorized accesses.
Page 15 of 15