Domain 1 of the CQI and IRCA ISO 27001 Lead Auditor exam is six questions worth eight marks, with a minimum of three. These six practice questions match that count and test the same understanding, with a full explanation for every option.

Every question below was written for this page by 3FOLD TRAINING's tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING's own graded mock exams. Real exam questions cannot lawfully be published, and any site offering them is offering you something it should not have.

What does Domain 1 cover, and how hard is it?

Domain 1 is concepts and principles of management standards and systems. It covers what a management system is and why an organisation runs an ISMS, what confidentiality, integrity and availability mean in practice, how the standard is put together, and what certification is for.

Two things follow from that table. It is the shallowest domain on the paper — the only one set at understand rather than apply or evaluate — and it is one of the smallest, at 8 of the 80 marks. It is also the domain candidates over-prepare, because it is the most comfortable to revise.

Question values are fixed: two 2-mark questions and four 1-mark questions. Situations may be used, tied to a single question. Scenarios are not used in this domain. How the five domains differ sets out the rest.

How should you use this set?

This is the one set where the fix for a wrong answer is reading. Domain 1 is tested at understand and nothing else on the paper is, so a question that goes wrong here is almost always a definition or a structure that is not yet solid rather than judgement. Go back to the clause, not to more questions.

None of them predicts what you will be asked. They test the same understanding, in the two formats that carry most of the paper, so working through them shows you where you are weak while there is still time to act on it.

Every question below carries its mark value, and here the values are 1 and 2. With only eight marks available, one 2-mark question is a quarter of the domain, so score in marks rather than in questions right. Where a question asks for more than one answer, select exactly the number asked for: partial marks are given on all questions, and nothing CQI publishes says a wrong selection is deducted from a right one.

Two things about the real paper are worth carrying into this set. You cannot navigate backwards once you have clicked Next. And the exam is open book, which matters most in this domain: a definition you can find in thirty seconds is not the same problem as one you cannot place at all. See CQI and IRCA on online exams.

Two of the six carry two marks on the real paper and four carry one, so do not treat them as equally weighted when you review your answers. And remember the exam is open book: a question you could have answered by opening the standard is not really a knowledge gap, it is a navigation one.

The questions

Fill in the form below to unlock your ISO 27001 Lead Auditor Domain 1 Practice Questions: Concepts and Principles.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Question 1. (1 mark) A prospective customer asks why your client's accredited certificate is worth more than the security self-assessment a rival supplier sent them. Which answer is correct?

A. The certificate proves the organisation has suffered no information security incidents during the certified period

B. The certificate is issued by the organisation itself against a recognised standard, once it is satisfied it conforms

C. The certificate was issued by a certification body whose competence is itself recognised by an accreditation body

D. The certificate confirms the organisation applies whichever security controls its industry regulator expects

None

Question 2. (2 marks) An effective ISMS is intended to achieve which of the following? Choose the best three.

A. Transfer the residual information security risk to the organisation's insurers

B. Keep information from being disclosed, altered or made unavailable in ways the organisation has not accepted

C. Meet the legal, regulatory and contractual obligations that apply to the organisation

D. Treat information security risks down to levels the organisation has decided it can accept

E. Demonstrate to customers, through certification, that information is managed securely

Question 3. (1 mark) A laptop holding client contracts has no disk encryption, and staff routinely take laptops to client sites. Which reading of that situation uses the course's terms correctly throughout?

A. Asset: the client contracts. Threat: loss or theft at a client site. Vulnerability: no disk encryption. Risk size: likelihood times impact

B. Asset: the laptop. Threat: no disk encryption. Vulnerability: loss or theft at a client site. Risk size: impact alone, the loss being certain

C. Asset: the client contracts. Threat: no disk encryption. Vulnerability: staff travelling to client sites. Risk size: the number of laptops affected

D. Asset: disk encryption. Threat: the client contracts being disclosed. Vulnerability: loss or theft. Risk size: likelihood times the value of the laptop

None

Question 4. (1 mark) ISO/IEC 27002:2022 attaches five attributes to each control, as an aid to filtering and grouping them. Which of these is one of those five?

A. The control's implementation cost band, so controls can be ranked by expense

B. The control's assigned risk owner, recorded alongside the control itself

C. The control's audit frequency, set when the control is first implemented

D. The control's operational capabilities, such as identity or asset management

None

Question 5. (2 marks) An organisation's stated information security objective is “to continually improve our security posture”. Judged against the requirements for information security objectives, what is the defect?

A. Objectives may not refer to continual improvement, because improvement is dealt with separately under Clause 10 and cannot also be an objective

B. It is not measurable, and there is no indication of what will be done, by whom, when, or how the result will be evaluated

C. Objectives must be set by top management personally rather than by the security function, and this one carries no evidence that they were

D. Objectives must be submitted to the certification body and approved before they take effect for the certified period

None

Question 6. (1 mark) You are auditing an organisation whose Statement of Applicability was last rebuilt under the 2013 edition of Annex A. What should the move to the current edition have required of that document?

A. A complete re-drafting of the document, because the requirements in Clauses 4 to 10 were themselves rewritten

B. Nothing at all, the Statement of Applicability being unaffected by a change to the structure of Annex A

C. The addition of the eleven new controls only, leaving the existing entries unchanged

D. Remapping the controls to the four themes, and accounting for the new and merged controls

None

Time's up

Where do marks actually go in Domain 1?

Two misunderstandings account for most of them, and both travel with you into later domains.

• Treating Annex A as a mandatory checklist. It is a reference set, and what belongs in a given ISMS is decided by risk. This error costs marks here and does far more damage in Domain 4.
• Treating information security as secrecy. Situations are written so that more than one property may be affected, and a reader who is only watching for disclosure will read past the other two.

Domain 1 is the one domain where reading fixes the problem, because it is the one domain that tests understanding rather than judgement. If several went wrong, work through the clause structure and the four Annex A themes until you can sketch them without looking, then come back.

If you found them easy, move on to questions that challenge you in different ways. 36 of the 80 marks come from a domain that requires a different kind of thinking altogether.

Frequently asked questions

Where to go next

Eight marks is eight marks, but a comfortable Domain 1 should not lead you to focus only on the same type of questions. The other sets are where the paper is decided:

• Domain 2 practice questions — audit concepts and auditor responsibilities, 6 questions, 8 marks.
• Domain 3 practice questions — planning the audit, 6 questions, 8 marks.
• Domain 4 practice questions — conducting the audit, 14 scenario questions, 36 marks.
• The sample exam questions and answers — ten questions weighted across all five domains, if you want a spread rather than a domain.

The complete CQI IRCA ISO 27001 Lead Auditor exam guide covers the format, the timing and how the sitting itself works.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.