ISO 27001 Certified Implementer practice test
Built for the Certified Implementer of ISO/IEC 27001 exam: three-option multiple choice plus case studies with open questions, the part most people have never practised. Every question is original and written against ISO/IEC 27001:2022 (93 Annex A controls).
Try the free sample Buy the full set, $19 once
The free sample is 10 questions, graded, with no sign-up. Or get All-access for $9/month: every test on the site.
What the full set includes
- 70 original multiple-choice questions tagged by clause, with an explanation for every answer
- 9 case studies with model answers and point-by-point marking guides
- 3 timed practice exams (24/23/23 questions plus 3 case studies each)
- Study mode (instant feedback) and exam mode (120-minute timer, graded at the end)
- Drill by topic or only your weak spots; weak spots tracked across every attempt
- 106-term English-Dutch glossary that opens over any question without losing your place
Topics covered
- Clause 4 Context
- Clause 5 Leadership
- Clause 6 Planning and risk
- Clause 7 Support
- Clause 8 Operation
- Clause 9 Performance evaluation
- Clause 10 Improvement
- Annex A controls
- Certification process
- ISO 27000 family and structure
Sample questions
Question 1
An organisation is determining the issues relevant to its purpose under clause 4.1. Which of the following is an EXTERNAL issue?
- High staff turnover in the IT department
- A new national law that shortens the deadline for breach notification
- An outdated internal change management procedure
Show the answer
B. A new national law that shortens the deadline for breach notification. External issues come from the environment the organisation operates in: legal, regulatory, market, technological and social factors. Staff turnover and internal procedures are internal issues. Both kinds feed the risk assessment and the scope decision.
Question 2
Which of the following is NOT one of the ways top management must demonstrate leadership and commitment under clause 5.1?
- Ensuring that the resources needed for the ISMS are available
- Performing the internal audits personally
- Ensuring the ISMS achieves its intended outcomes
Show the answer
B. Performing the internal audits personally. Clause 5.1 lists commitments such as ensuring policy and objectives are established, integrating ISMS requirements into business processes, providing resources, communicating importance, ensuring outcomes, directing and supporting people, and promoting continual improvement. Top management directs and supports the audit function; it does not perform the audits.
Question 3
Which of the following is a requirement of the information security risk assessment process?
- It must use a quantitative method that expresses every risk in euros
- It must be performed by an external consultant to guarantee objectivity
- It must ensure that repeated risk assessments produce consistent, valid and comparable results
Show the answer
C. It must ensure that repeated risk assessments produce consistent, valid and comparable results. Clause 6.1.2 requires risk acceptance criteria, criteria for performing assessments, and a process that gives consistent, valid and comparable results. Qualitative or quantitative methods are both allowed, and who performs it is the organisation's choice.
Not affiliated with or endorsed by SECO-Institute, DNV, ISO or IEC. ISO/IEC 27001 is a trademark of its owners. The questions here are original practice material and are not the official exam.