ISO-27001-LA practice examsIn development
PECB ISO/IEC 27001 Lead Auditor
The PECB ISO/IEC 27001 Lead Auditor certification validates the competence to audit Information Security Management Systems (ISMS) against the ISO/IEC 27001 standard. It covers audit principles from ISO 19011, audit planning and execution, evidence gathering, nonconformity writing, and the certification process under ISO/IEC 17021. This credential is essential for professionals who lead or participate in ISMS audits for certification bodies, internal audit teams, or consulting firms.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| ISMS and Audit Fundamentals | 25% |
| Planning an ISO 27001 Audit | 25% |
| Conducting an ISO 27001 Audit | 30% |
| Concluding and Following Up | 20% |
Two sample questions
1. During the on-site Stage 2 audit, the auditor finds that the organization's risk assessment was last performed 26 months ago and there is no evidence of any review or update since then, despite several major organizational changes including a cloud migration. This finding should be raised as a nonconformity against:
- ISO 19011, since auditors must review risk assessments annually
- Annex A control A.5.7 — Threat intelligence
- Clause 6.1.2 and Clause 8.2 — ISO 27001 requires risk assessments to be performed at planned intervals and when significant changes occur
- Clause 9.1 — Monitoring, measurement, analysis and evaluation only
Why: Clause 6.1.2 establishes the risk assessment process, and Clause 8.2 (Information security risk assessment) requires the organization to perform risk assessments at planned intervals or when significant changes are proposed or occur. A cloud migration is a significant change that triggers the requirement for a risk assessment review. 26 months without reassessment despite major changes is a clear nonconformity against Clause 8.2, and potentially Clause 6.1.2.
2. During a recertification audit, the auditor finds that the organization has maintained consistent conformity for three years with only minor improvements. There is no evidence of proactive enhancement of the ISMS. Should this concern the auditor?
- No concern — consistent conformity for three years demonstrates a stable and effective ISMS
- Potentially concerning — Clause 10.2 requires continual improvement, and three years with no proactive enhancement may indicate the ISMS is stagnating rather than improving
- No concern — continual improvement is only required during the first year after certification
- Automatically raise a major nonconformity since improvement must be demonstrated annually
Why: Clause 10.2 requires continual improvement. While stability is positive, three years without proactive enhancement raises questions about whether the organization is genuinely pursuing continual improvement.
The real ISO-27001-LA exam
| Length | 180 minutes |
|---|---|
| Questions | 12 essay-type questions |
| Pass mark | 70% |
| Price | $450 USD |
| Recommended before you sit it | 2+ years info security auditing experience recommended |
| Valid for | Credential maintained via CPD |
Exam facts as published by PECB; always check the vendor’s page before you book.
Study ISO-27001-LA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.