This is a complete practice paper for the CQI and IRCA ISO 27001 Lead Auditor exam: 40 questions worth 80 marks, weighted across the five domains exactly as the real paper is. It is free, there is no sign-up, and every answer is explained.

Every question below was written for this page by 3FOLD TRAINING's tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING's own graded mock exams or reproduces what one of them tests. Real exam questions are covered by the confidentiality terms every candidate agrees to before sitting, so any site offering them holds material it should not have.

How closely does this match the real paper?

Question for question and mark for mark. The examination is 40 questions worth 80 marks across five domains, the marks are not spread evenly, and the paper below reproduces the whole structure:

The construction rules are matched too. Domains 1 to 3 may tie a short situation to a single question, and their questions are worth 1 or 2 marks. Domains 4 and 5 use scenarios only — described situations carrying several questions each, worth 2 or 3 marks — and every question in them stands on its own. Six of the forty are multiple-response items, the format candidates most often say caught them out.

Domains 1 to 3 draw on a small syllabus that every practice paper has to sample, so some of the ground here is ground you will meet elsewhere. What is not repeated is the question: no wording, no option set and no distractor is shared with any other paper, and each item turns on a different discrimination from the ones already in circulation. Domains 4 and 5 are built entirely on material no other paper of ours examines.

How should you sit it?

Sit it in one go, under the conditions you will actually face. Put the standard beside you, because the real exam is an open book, and put your phone in another room, because the real exam is proctored. Answer every question in order and do not go back — the real paper will not let you. Then mark it in marks rather than in questions right, and work out your score by domain before you look at your total.

Every question carries its mark value, exactly as the real paper does: 1 and 2 marks in Domains 1 to 3, and 2 and 3 in Domains 4 and 5. Score in marks rather than in questions right, because that is how the domain minima are measured. The published time allocation gives Domains 4 and 5 roughly twice as long per question as the domains at the front, which is worth pacing to. Where a question asks for more than one answer, select exactly the number asked for: partial marks apply throughout, and nothing CQI publishes says a wrong selection is deducted.

Give yourself 1 hour 45 minutes, which is what the real paper allows. If English is not your first language, an additional 30 minutes can be requested through your provider before the course and CQI decides it, so practise in whichever you will actually get. The one habit this paper is here to build is finishing. Candidates who run out of time almost always spend it in the three small domains at the front, which carry 24 marks between them, and arrive at the two that carry 56 with the clock against them. See CQI and IRCA on online exams.

One habit is worth building here, because the real exam enforces it. CQI's guidance for learners states that once you have answered a question and clicked Next, you cannot navigate backwards to change your answer. There is no final sweep. Practice deciding and moving on.

How do you score it?

Two conditions have to be met and most candidates only remember the first. You need 40 of the 80 marks overall, which is 50 per cent. You also need the minimum mark in every domain: 3, 3, 3, 14 and 8. Those are absolute marks, not percentages, and missing one of them fails the paper however comfortable the total looks.

So mark it by domain first. Add the total afterwards. A score of 48 out of 80 with 12 in Domain 4 is a fail, and finding that out here is the entire point of sitting a mock.

The paper

Fill in the form below to unlock your Free ISO 27001 Lead Auditor Mock Exam: 40 Questions.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Domain 1 — Concepts and principles of management standards and systems — questions 1 to 6, 8 marks Question 1. (1 mark) An organisation records that everyone in scope has attended an information security induction, and offers the attendance register as evidence of competence. Judged against the standard, what is wrong with that?

A. Attendance registers are not documented information and so cannot be offered as evidence at all

B. Attendance evidences awareness; competence has to be established on education, training or experience

C. Induction must be repeated annually before it can be offered as evidence of anything

D. Competence evidence must be held by the individual concerned rather than by the organisation

None

Question 2. (1 mark) A manager tells you that information security is handled by the IT department, so the ISMS scope is the IT estate. Why is that reasoning wrong?

A. Information security covers information in every form, including paper, conversations and what people know

B. The scope must always be the whole legal entity, and partial scopes are not permitted

C. Information security is the responsibility of top management rather than of any single department

D. The IT estate changes too often for a scope defined that way to remain accurate

None

Question 3. (2 marks) Which statements about Clause 4.2 and interested parties are correct? Choose the best three.

A. The organisation determines who the interested parties relevant to its ISMS are

B. It must determine which of those parties' requirements are relevant to information security

C. Every requirement an interested party expresses becomes a requirement of the ISMS

D. Some of those requirements will be legal or regulatory, and others contractual

E. Interested parties must be consulted before the ISMS scope can be determined

Question 4. (1 mark) Under which of the four themes in the 2022 edition of Annex A does a control on secure development sit?

A. Organisational controls

B. People controls

C. Physical controls

D. Technological controls

None

Question 5. (2 marks) At what point in the process does an organisation establish the criteria by which it will accept information security risks, and who sets them?

A. After the risk assessment, once the organisation can see the range of risks it actually faces

B. As part of defining the risk assessment process, and the organisation sets them itself

C. At the certification audit, where the certification body agrees them with the organisation

D. When the risk treatment plan is approved, since acceptance is a treatment decision

None

Question 6. (1 mark) Which of these is required of the information security policy?

A. That it is reviewed and re-approved by top management every twelve months

B. That it states the organisation's risk acceptance criteria and its risk assessment method

C. That it is signed by every member of staff as a record of their awareness

D. That it is available as documented information, communicated internally, and available to interested parties as appropriate

None

Domain 2 — Audit concepts and auditor responsibilities — questions 7 to 12, 8 marks Question 7. (1 mark) An organisation's own internal audit team audits its ISMS against ISO/IEC 27001 and reports to its own management. What kind of audit is that?

A. A second-party audit, because the auditors are auditing on behalf of another part of the business

B. A first-party audit, carried out by or on behalf of the organisation on itself

C. A third-party audit, because the criterion is an external standard rather than an internal one

D. It is not an audit in the sense the standard uses, because no external party is involved

None

Question 8. (2 marks) An audit team leader has three days for a Stage 2 audit and cannot cover every process in the scope. Applying the principles of auditing, how should the available time be allocated?

A. Equally across all processes in scope, so that no area can claim it was overlooked

B. To the areas the auditee nominates as most important to its business

C. To the areas of highest risk and to what has changed since the last audit

D. To the areas where nonconformities were found at the previous audit, and nowhere else

None

Question 9. (1 mark) During the audit the team leader and the auditee cannot agree on whether a finding is a nonconformity, and the disagreement is still unresolved when the audit ends. What does the principle of fair presentation require?

A. That the unresolved disagreement is recorded and reported in the audit report

B. That the finding is withdrawn, on the basis that a disputed finding cannot be sustained

C. That the matter is referred to the certification body for a decision before the report is issued

D. That the finding is downgraded to an observation, to reflect the lack of agreement about it

None

Question 10. (2 marks) Halfway through an audit an auditor realises that the process owner she is about to interview is the person who recruited her into her previous job, and that they remain friendly. Which of these are correct? Choose the best three.

A. She should declare the relationship to the audit team leader

B. The team leader should consider reallocating that area to another team member

C. Nothing need be done unless she believes the friendship would actually affect her judgement

D. Whether a reasonable observer would doubt her impartiality is the test, not whether she feels impartial

E. The audit should be suspended and the certification body informed before it continues

Question 11. (1 mark) An audit programme covers twelve of an organisation's suppliers over three years, and a single audit of one of them is being planned. Which statement is correct?

A. The audit programme and each individual audit within it share a single set of objectives

B. An audit programme is required only where the audits are conducted by a certification body

C. An individual audit's scope is fixed by the programme and may not be varied for that audit

D. The programme frames a planned series of audits; each audit inside it is established with its own objectives, scope and criteria

None

Question 12. (1 mark) While sampling records an auditor sees commercially sensitive pricing information that has nothing to do with information security. What does the confidentiality principle require?

A. That the information is reported to the audit client, who is entitled to what the audit finds

B. That the auditor safeguards the information and does not use it improperly

C. That the auditor stops the audit until the auditee removes the information from the sample

D. That the auditor records having seen it, so the auditee cannot later allege a breach

None

Domain 3 — Planning the audit — questions 13 to 18, 8 marks Question 13. (2 marks) Which of these would make an audit team leader judge that a planned Stage 2 audit is not feasible? Choose the best three.

A. The auditee has several nonconformities outstanding from its last surveillance audit

B. The auditee has declined to make its cloud management console available for inspection

C. The auditee's information security manager will be on leave during the audit dates

D. The team does not include anyone competent in the specialist technology in scope

E. The time available is not sufficient to cover the scope with any useful sample

Question 14. (1 mark) An opening meeting for a three-day Stage 2 audit at a 200-person organisation is being planned. How formal should it be?

A. Always highly formal, with a written agenda, formal minutes and a signed attendance record

B. Informal, since formality belongs to the closing meeting where the findings are presented

C. Formality is not prescribed; it is scaled to the audit, but the same matters are confirmed

D. As formal as the auditee would prefer, since the meeting is held largely for the auditee's benefit

None

Question 15. (1 mark) Why is the Stage 2 audit plan shared with the auditee before the audit begins?

A. So that the auditee can raise any objection to the scope before the team arrives

B. So that the auditee can make the right people and records available at the right times

C. So that the auditee can prepare the evidence the team has said it intends to sample

D. So that the auditee formally accepts the plan, after which it may not be varied

None

Question 16. (2 marks) An organisation operates from nine sites of similar size and function, all within one ISMS scope. What principally determines how many of them a certification audit visits?

A. All nine, since certification covers every site named in the scope

B. A sample determined on risk, the similarity of the sites, and the audit-time requirements

C. One site, since the ISMS is a single management system however many sites operate it

D. The number the auditee is willing to fund travel to within the audit-time allowance

None

Question 17. (1 mark) Before Stage 1, what should the audit team ask the auditee to provide?

A. Records of every internal audit and management review held since the ISMS was established

B. A completed self-assessment of the organisation against each of the 93 Annex A controls

C. Evidence that all nonconformities raised at any previous audit have been closed out

D. The documented information the standard requires, including the scope, policy and Statement of Applicability

None

Question 18. (1 mark) Part of a Stage 2 audit will be conducted remotely, with evidence shown by screen share. What should be settled at planning rather than discovered on the day?

A. That the auditee has consented in writing to the session being recorded

B. That the auditee's staff are trained in the conferencing software the team uses

C. That the connection, the access and the way evidence will be shown are workable

D. That the remote portion will be no more than half of the total audit time

None

Domain 4 — Conducting the audit — questions 19 to 32, 36 marks Every organisation described on this page is invented for teaching. Any resemblance to a real company, in name or in circumstances, is coincidental. Scenario: Penwithen Analytics Penwithen sells a subscription analytics platform to retail clients and holds shopper behaviour data for 40 million end customers. It has 260 staff and is at its second surveillance audit. Its largest client contract requires breach notification within 24 hours; the risk register does not mention it. Eighteen months ago Penwithen launched a second product, hosted separately, through which most new customer data now flows — the certified scope statement names only the original platform. Threat detection is outsourced to a managed security provider under a contract signed at certification. A data engineer left in March; her laptop and phone are still listed to her in the asset inventory and no return record exists. Questions 19 to 22 are based on this scenario. Each one stands on its own. Question 19. (3 marks) Judged against Clause 4.3, what is the difficulty with Penwithen's certified scope?

A. Nothing, provided the second product is covered by its own separate certification

B. The scope was not re-approved by top management when the second product launched

C. Most new customer data now flows through a system the scope does not cover

D. A scope statement must name every system the organisation operates, and this one does not

None

Question 20. (3 marks) One obligation Penwithen has taken on contractually is nowhere reflected in its risk register. Against which requirement does that failure most directly run?

A. Clause 4.2, in that a determined interested-party requirement has not been carried into the ISMS

B. Clause 8.1, in that the notification process has not been planned and controlled

C. A.5.20, in that information security has not been addressed within the supplier agreement

D. Clause 7.4, in that the organisation has not determined what it communicates and to whom

None

Question 21. (2 marks) The data engineer's laptop and phone are still listed to her, five months after she left. Which pair of controls has failed here?

A. A.5.9 inventory of information and other associated assets, and A.5.11 return of assets

B. A.5.10 acceptable use of information and other associated assets, and A.8.1 user endpoint devices

C. A.6.5 responsibilities after termination or change of employment, and A.5.18 access rights

D. A.7.9 security of assets off-premises, and A.7.10 storage media

None

Question 22. (3 marks) Consider the arrangement Penwithen has for detecting threats. Which of these does the standard require of it? Choose the best three.

A. That it ensures the outsourced process is controlled, because it remains responsible for it

B. That the provider holds its own ISO/IEC 27001 certificate covering the service

C. That the arrangement is determined and its controls are addressed in the agreement

D. That the monitoring the provider performs is analysed and evaluated by Penwithen

E. That Penwithen retains the capability to perform threat detection itself if the provider fails

Scenario: Ockbridge Components Ockbridge manufactures precision parts for aerospace customers, holding client drawings under export control, and has 480 staff across a factory and a design office. It is at Stage 2 of first-time certification. The information security policy was approved by the board nine months ago; it is on the shared drive and has not been circulated. Three named information security roles appear in the ISMS manual. Asked what her ISMS role involves, the quality manager named in one of them says she was not aware she held it. Questions 23 to 25 are based on this scenario. Each one stands on its own. Question 23. (2 marks) Ockbridge's information security manager says the policy has been communicated to everyone. Which single item of evidence would best test that claim?

A. The approved policy document, with the board minute recording its approval

B. The shared-drive folder listing, showing the policy in a location all staff can reach

C. A sample of staff asked what the policy requires of them in their own work

D. The information security manager's confirmation, recorded in your evidence notes

None

Question 24. (3 marks) The quality manager is named in the ISMS manual as holding an information security role and says she was not aware of it. What does this most directly indicate?

A. She is not competent to hold the role she has been given

B. Staff at Ockbridge do not know the information security policy

C. The ISMS manual does not accurately describe the ISMS as it operates

D. Responsibilities were assigned but never communicated within the organisation

None

Question 25. (2 marks) A team member is about to ask Ockbridge's IT manager: “You do brief staff on security matters regularly, don't you?” You stop him. Which rewrite is admissible?

A. Do you communicate with staff about information security at all?

B. How often do you brief staff on security matters — monthly, or less than that?

C. Show me where you determined what would be communicated, to whom, when and how

D. Would you say your security communication is effective, on the whole?

None

Scenario: Thrushmoor Housing Trust Thrushmoor manages 12,000 social housing tenancies and holds tenant financial and vulnerability data. It has 340 staff and is at its second surveillance audit. Its four information security objectives are specific and measured, and are reviewed at each management review; they are held in the ISMS folder. Last quarter an unauthorised access to tenant records was investigated: the tenancy system, the door-access system and the firewall each recorded the event, and the three timestamps differ by up to eleven minutes. The staff handbook published on the intranet is version 3; the document register shows version 5 as current and approved. Questions 26 to 28 are based on this scenario. Each one stands on its own. Question 26. (3 marks) Asked how staff know what the objectives are, Thrushmoor's information security manager says the management team is aware of them. What does Clause 6.2 additionally require?

A. That the objectives are approved by the board before the start of each review cycle

B. That each objective carries the number of a named risk drawn from the risk register

C. That the objectives are communicated, and that they are updated as appropriate

D. That the objectives are published to interested parties outside the organisation

None

Question 27. (2 marks) Consider what the three sets of records from last quarter's investigation could and could not establish between them. Which control does that most directly engage?

A. A.8.17, clock synchronisation, without which the sequence of events cannot be established

B. A.8.15, logging, since the events were recorded across three separate systems

C. A.5.25, assessment and decision on information security events, which the investigation performed

D. A.8.16, monitoring activities, since the access was detected rather than missed

None

Question 28. (3 marks) Compare what Thrushmoor's intranet serves to staff with what its document register holds. Which statements about the difference are correct? Choose the best two.

A. No finding arises until somebody is shown to have relied on the obsolete version

B. Documented information must be available where and when it is needed, and suitable for use

C. The obsolete version is in active use, which is what makes this more than a records problem

D. The document register is the controlling record, so the register being correct is sufficient

E. The finding should be raised against Clause 7.5.2, which governs how documents are updated

Scenario: Wrenfield Pathology Wrenfield provides laboratory testing to private clinics and holds patient results and identifiers. It has 150 staff and is at its second surveillance audit, in year two of the certification cycle. Its courier and its laboratory information system are both supplied by third parties, both classified critical, contracted four years ago; the supplier file holds the original due-diligence assessments and nothing since. No independent review of information security has been carried out. Questions 29 to 32 are based on this scenario. Each one stands on its own. Question 29. (3 marks) Wrenfield's two critical suppliers were assessed at onboarding and the supplier file holds nothing since. Which control does the gap fall under?

A. A.5.19, information security in supplier relationships

B. A.5.20, addressing information security within supplier agreements

C. A.5.21, managing information security in the ICT supply chain

D. A.5.22, monitoring, review and change management of supplier services

None

Question 30. (3 marks) Wrenfield's Statement of Applicability marks A.5.7 Threat intelligence as applicable and implemented. Asked to evidence it, the IT manager says the laboratory system vendor “sends us security bulletins”. How should the audit team proceed?

A. Accept the bulletins as evidence, since threat intelligence from a vendor is still threat intelligence

B. Establish whether the information is collected, analysed and used, which is what the control requires

C. Raise a nonconformity at once, on the basis that vendor bulletins cannot satisfy the control

D. Recommend that A.5.7 be recorded as not applicable, as Wrenfield is too small to operate it

None

Question 31. (2 marks) No independent review of information security has ever been carried out at Wrenfield. How should the audit team treat this?

A. As no finding, since the certification audits themselves are independent reviews

B. As an observation, since no requirement sets a frequency for such reviews

C. As a nonconformity, the control being applicable and not implemented

D. As a matter for the certification body, which decides whether the control applies

None

Question 32. (2 marks) The morning set aside for Wrenfield's laboratory information system cannot go ahead: the system is down and the vendor cannot restore access before the audit ends. What should the audit team leader do?

A. Extend the audit by a day, so that the scheduled coverage is achieved in full

B. Audit the area from the auditee's own documentation of the system instead

C. Continue as planned and note in the report that the system appeared unavailable

D. Adjust the plan, record the limitation, and tell the auditee and the audit client

None

Scenario: Caldwyn Legal Software Caldwyn supplies case-management software to law firms and hosts client matter files on its own infrastructure. It has 190 staff and has just completed Stage 2 of first-time certification. Of fifteen sampled starters, five had been given access to the production environment before their screening was complete. The audit team is drafting the report and preparing for the closing meeting. Caldwyn's account manager at the certification body has telephoned the team leader to say a major would be “commercially very difficult” for the relationship. Questions 33 to 37 are based on this scenario. Each one stands on its own. Question 33. (3 marks) A team member drafts: “Screening is not taken seriously and the HR team has been careless about letting people start early.” What is the most serious problem with it as a finding?

A. It judges people rather than describing what the evidence showed

B. It does not identify which of the five starters was affected first

C. It attributes the failure to HR when the access was granted by IT

D. It uses the word screening rather than the wording of the control

None

Question 34. (2 marks) Which version of the evidence sentence would best support this nonconformity?

A. Screening evidence was missing for a number of the staff records examined

B. Five of fifteen sampled starters (refs S-104, S-107, S-109, S-113, S-116) had production access before screening completed

C. Several recent starters had production access before screening was completed

D. Screening records were incomplete across the sample and could not be reconciled to the access records

None

Question 35. (3 marks) The team wants to record that Caldwyn's staff were consistently open and produced evidence quickly, which made the audit easier. Where does that belong?

A. In the audit summary, as part of the narrative of how the audit went

B. In the nonconformity report, as mitigation against the grading

C. In the audit conclusions, as part of the team's judgement on the ISMS

D. In the opening section, as part of identifying the auditee

None

Question 36. (3 marks) What should the team leader do at the start of the closing meeting, before presenting the individual findings? Choose the best three.

A. Thank those present for their time and cooperation during the audit

B. Invite the auditee to state whether it accepts the findings in principle

C. Reaffirm the audit scope, the sampling limits and confidentiality

D. Set out the overall conclusions the team has reached

E. Explain the grading system that will be used for the nonconformities

Question 37. (2 marks) How should the team leader respond to the account manager's telephone call about the commercial difficulty of a major?

A. Note the concern and take it into account when the team agrees the grade

B. Grade the finding on the evidence, and report the approach if it is repeated

C. Refer the grading decision upward, so that the team leader is not the one deciding

D. Downgrade to a minor, since the certification body is entitled to manage its own relationships

None

Scenario: Ferrymead Ports Ferrymead operates cargo handling and customs documentation at two container terminals, holding consignment and customer commercial data. It has 900 staff and has held certification for five years. At this surveillance audit the team finds that the incident response procedure was last reviewed four years ago, that two incidents in the past year were never logged, and that a nonconformity raised at the previous surveillance audit about supplier review was recorded as closed on the strength of an email from the supplier manager saying it had been dealt with. Questions 38 to 40 are based on this scenario. Each one stands on its own. Question 38. (3 marks) What must Ferrymead's surveillance audit cover, whatever else the team chooses to sample?

A. Every clause of the standard and every applicable Annex A control

B. Only those areas where nonconformities were raised at the previous audit

C. A different sample from the previous year, with no other fixed requirement

D. The core management-system processes, and follow-up of the previous findings

None

Question 39. (2 marks) Given what the team has found at Ferrymead, what is within the certification body's power?

A. To suspend or withdraw the certificate, depending on the seriousness of what is found

B. To require re-certification from the beginning, since the certificate is now five years old

C. Nothing until the next re-certification audit, the certificate having already been issued

D. To extend the certificate's validity while the nonconformities are addressed

None

Question 40. (2 marks) The team's conclusion says Ferrymead's ISMS conforms except in the areas where nonconformities were raised. What should be added?

A. A statement that the certificate should be suspended pending corrective action

B. A list of the areas the team did not have time to examine on this visit

C. A statement that the conclusion rests on a sample and gives confidence rather than certainty

D. An estimate of how likely it is that similar failures exist elsewhere in the organisation

None

Time's up

What should you do with the result?

Look at the domain scores before the total, and at the reasons before the topics. If several questions went wrong for the same reason — grading on impression, reaching for the broadest clause, choosing the option that sounded most thorough — that is one problem to fix rather than several. Working the individual domain sets is the way to fix it:

• Domain 1 practice questions — concepts and principles, 6 questions, 8 marks.
• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 3 practice questions — planning the audit, 6 questions, 8 marks.
• Domain 4 practice questions — conducting the audit, 14 scenario questions, 36 marks.
• Domain 5 practice questions — reporting and closing out, 8 scenario questions, 20 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

If the trouble was writing and grading findings rather than recognising requirements, the ISMS audit findings grading exercise drills that directly, and the tips that actually move a score covers what to do in the fortnight before you sit. If a poor score has you looking for a shortcut, what exam dumps actually contain is worth five minutes first.

Frequently asked questions

Where to go next

This paper is free and there is no sign-up. 3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.