Five question types appear on the CQI and IRCA ISO 27001 Lead Auditor exam: multiple choice, multiple response, fill in the blanks, matching and sequencing. The last three are drag and drop rather than clicking a button, and all five are computer-marked. If you are preparing for a straightforward multiple-choice paper, you are preparing for the wrong examination.

The five question types in the CQI IRCA ISO 27001 Lead Auditor exam, as CQI and IRCA list them

CQI and IRCA list them in their guide for learners, and the list is worth taking literally because three of the five behave nothing like a conventional exam question.

Multiple choice. Choose the one correct answer. The familiar one.

Multiple response. Choose several correct answers.

Fill in the blanks. Drag the correct words into gaps in a sentence.

Matching. Drag responses to pair them correctly with items.

Sequencing. Drag responses into the correct order.

All of them are machine-marked, which is the reason the list looks like this. There is no written answer anywhere on the paper and nobody reads a word you produce. Everything you are asked is something a computer can score, which shapes what can be tested and how.

What each ISO 27001 Lead Auditor exam question type is really testing

Multiple choice suits a judgement with one defensible answer — which grading a finding attracts, which clause a requirement sits in, what an auditor should do next. The work is in the qualifier. Best, most appropriate and first mean more than one option is defensible and you are being asked to rank them. Not and except invert the whole question, and a qualifier misread is a question lost for a reason that has nothing to do with what you know.

Multiple response tests whether you know the whole of something rather than one instance of it — the elements a finding must contain, what an audit plan has to cover, which of a list are objective evidence. It is where partial marking does most of its work, and where the selection count matters most.

Fill in the blanks tests precise language. Because the words are supplied and dragged rather than typed, the wrong options can sit very close to the right ones — the difference between shall and should, between nonconformity and observation, between audit criteria and audit scope. This type rewards having read the standard’s own wording rather than a paraphrase of it.

Matching tests whether you can hold a set of related concepts apart — clauses against what they require, finding types against how they are treated, roles against responsibilities. It is unforgiving in a specific way: where the responses are used once each, a pair you get wrong can take a second pair with it, because the response you misplaced was needed elsewhere.

Sequencing tests process knowledge, and on a paper about auditing that means the order of something in an audit — the stages of an audit, the steps in handling a finding, the order of a closing meeting. Partial marking helps here, because getting most of an order right is not the same as getting none of it right.

The drag-and-drop problem in the ISO 27001 Lead Auditor exam

Three of the five types are drag and drop, and that has consequences beyond the mechanics.

They take longer. A multiple-choice question is one click. A sequencing question with six steps is six drags, each of which has to land. Under time pressure, on a trackpad, that is a real difference, and the paper does not give you extra time for it.

What is on the screen is what gets marked. Everything is scored by machine, so an item you meant to place and did not quite place is not read as intent — which makes a glance at the screen before you commit worth the two seconds it takes.

And you cannot go back to fix it. This is where the navigation rule bites hardest: once you click Next, the answer is final. On a drag-and-drop item that means checking the screen actually shows what you meant before you commit, every time.

Two practical consequences. Sit the examination on a computer with a proper mouse if you possibly can — the hardware rules require a computer or laptop anyway, and dragging with a trackpad is slower and fiddlier than dragging with a mouse. And practise the interaction, not only the content: the first time you meet a sequencing item should not be in the examination.

What the question type tells you about the ISO 27001 exam answer

There is a small tactical advantage in noticing which type you are looking at before you start reading the options, because each one constrains what a correct answer can look like.

If it is multiple choice, exactly one option is right, which means the other options are wrong rather than merely worse — unless the stem contains best or most, in which case they may all be defensible and you are ranking. Reading the stem for that qualifier before reading the options saves you from evaluating four plausible answers as if only one could be true.

If it is multiple response, read the stem for how many answers are wanted. Where a number is given it is information in itself: a question asking for three correct responses out of five is telling you that two are wrong, which makes elimination worth more than it would be otherwise.

If it is matching or sequencing, your certainties constrain the rest. Placing the pairs or steps you are sure of first narrows what can go where, so work outwards from those rather than taking the items in the order presented.

If it is fill in the blanks, the supplied words are the whole vocabulary. You are not being asked what you would say; you are being asked which of these words the standard uses. That is a different question, and it usually turns on precision the standard cares about more than everyday usage does.

Does the question type tell you which ISO 27001 exam domain you are in?

No, and it is worth saying so because people assume it does. The framework does not tie particular types to particular domains — any of the five could in principle appear anywhere. What it does constrain is the context a question sits in and what it is worth. In the first three domains an item may carry a short situation and must be worth one or two marks. In the domains covering the conduct and reporting of an audit, items sit inside scenarios and are worth two or three. These figures come from the examination framework CQI and IRCA issue with the examination policies before the course. It is a document learners are given rather than one published on a website, so you will not find it by searching. It is not a secret, though, and knowing the shape of the paper is part of preparing for it.

Frequently asked questions about CQI IRCA ISO 27001 exam question types

Where to go next: more ISO 27001 Lead Auditor exam preparation

How partial marks work explains what a partly correct answer is worth, and situations and scenarios explains the context these questions arrive in. The full exam guide covers the sitting itself.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.