These ten questions are weighted towards the domains that carry the marks on the CQI and IRCA ISO 27001 Lead Auditor exam, seven of the ten sitting in Domains 4 and 5. Each has a full explanation of why the right answer is right and every wrong answer wrong.

Every question below was written for this page by 3FOLD TRAINING's tutors. None is a real CQI and IRCA examination question, and none is taken from 3FOLD TRAINING's own graded mock exams. Real exam questions cannot lawfully be published, and any site offering them is offering you something it should not have.

How is this set put together?

The examination is 40 questions worth 80 marks across five domains, and the marks are not spread evenly. Ten questions cannot cover a paper, so the split below follows the mark weighting as closely as ten allow:

A second condition sits alongside the 40-mark overall pass, and it catches people. Each domain carries its own minimum in absolute marks, not percentages: 3, 3, 3, 14 and 8. Miss one and the paper fails whatever the total.

Seven of the ten sit in Domains 4 and 5, which is deliberate and is the most useful thing this page can tell you: those two carry 56 of the 80 marks, and neither can be made up elsewhere. For the full picture, how the exam is structured covers format, timing and the sitting process.

What are these questions, and what are they not?

None of them predicts what you will be asked. They test the same understanding, in the two formats that carry most of the paper, so working through them shows you where you are weak while there is still time to act on it.

They follow the real paper's construction rules. Domains 1 to 3 may tie a short situation to a single question, so the first three stand alone. Domains 4 and 5 use scenarios only, so questions 4 to 10 are built on two scenarios, each standing on its own.

Every question below carries its mark value. On the real paper the values are 1 and 2 in Domains 1 to 3 and 2 and 3 in Domains 4 and 5; this set uses 2 and 3. Score in marks, because that is how the minima are measured. Where a question asks for more than one answer, select exactly the number asked for: partial marks apply throughout, and nothing CQI publishes says a wrong selection is deducted from a right one.

A word on the dumps you passed on the way here: much of that material was written for a different scheme, so its marks, domains and pass rule are wrong. It teaches the wrong paper.

How should you use this set?

Work the whole set before you look at a single answer, and write down why you chose each one. Then read the explanations twice: once for the questions you got wrong, once for the ones you got right for a reason the explanation does not give. That second group is what turns into a wrong answer under time pressure.

Do not time yourself on ten questions; timing means something only across a whole paper. And remember the exam is open book. A question you could have answered by opening the standard is a navigation problem, not a knowledge gap, and the fix is to practise finding things rather than memorising them.

One habit is worth building from the start, because the real exam enforces it: once you have clicked Next you cannot navigate backwards to change your answer. There is no final sweep, so decide and move on, and practise that here where it costs nothing. See CQI and IRCA on online exams.

The questions

Fill in the form below to unlock your ISO 27001 Lead Auditor Sample Exam Questions and Answers.

We'll email your full results — with a detailed explanation for every question — as soon as you finish.

Full Name

Email Address

Phone

Question 1. (2 marks) Which of these must an organisation be able to show as documented information under ISO/IEC 27001:2022?

A. A register of every information asset the organisation holds

B. The results of the information security risk assessment

C. Minutes of every meeting at which security was discussed

D. A business continuity plan for each critical system

None

Question 2. (2 marks) What is the significance of the CQI and IRCA Code of Conduct for a certified auditor?

A. It is guidance that certification bodies may adopt at their discretion when contracting auditors

B. It applies only while an auditor is actually conducting a certification audit on a client site

C. It replaces the seven auditing principles for any auditor certified under the CQI and IRCA scheme

D. It sets obligations the auditor is bound by, and a breach can affect their certification

None

Question 3. (2 marks) At Stage 1 you notice that the risk assessment names controls that you doubt are operating. What should you do?

A. Request operational records now, so that the doubt is resolved before the Stage 2 audit begins

B. Raise a nonconformity, on the basis that the doubt arises from the documents the auditee itself provided

C. Record it as an area of concern and target it in the Stage 2 plan

D. Ask the auditee to demonstrate the controls in question during the remainder of the Stage 1 visit

None

Scenario: Ashmere Legal Services Ashmere is a 75-partner law firm holding client case files, litigation evidence and privileged correspondence. It is at Stage 2 of first-time certification. Backups run nightly to a storage appliance in the same building. A restore was attempted after a file-server failure in March. It ran for eleven hours, recovered only part of the archive, and no record of the failure or of any follow-up exists. No copy of the backup is held off-site or on separate infrastructure. The backup policy requires client files to be retained for seven years; the appliance is configured to retain ninety days. Questions 4 to 7 are based on this scenario. Each one stands on its own. Question 4. (3 marks) Nothing at Ashmere records what happened after the March restore. Against which requirement is that best raised?

A. Clause 10.2, nonconformity and corrective action

B. Clause 9.1, monitoring, measurement, analysis and evaluation

C. Clause 7.5.3, control of documented information

D. Clause 6.1.3, information security risk treatment

None

Question 5. (3 marks) Which findings does the Ashmere evidence support? Choose the best three.

A. Recoverability has not been demonstrated

B. Backups are not being taken

C. Retention does not meet the organisation's own stated requirement

D. Backup media are held without encryption

E. There is no segregated or off-site copy of the backup

Question 6. (2 marks) The IT partner says: “We back up every night, and we did do a restore in March.” Which single item of evidence would most directly test whether the requirement is met?

A. The nightly backup job log for the past month, showing each run completing without error

B. The restore-test record showing what was attempted, what was recovered and the outcome

C. The backup policy, its approval record, and the schedule showing when restores are due

D. A screenshot of the storage appliance's current capacity

None

Question 7. (2 marks) You record the restore failure in your evidence notes. What must the note contain?

A. Your assessment of how serious the failure is

B. The proposed corrective action, so the auditee can begin work

C. The name of the person who told you about it, and their job title

D. The source, exactly what you saw, and the requirement it relates to

None

Scenario: Cassia Transit Systems Cassia Transit operates contactless ticketing for a regional transport authority, holding travel history and payment tokens for 1.2 million cardholders. Six weeks before your Stage 2 audit, an exposed interface returned other passengers' journey histories. The incident log records the event, the fix and closure within four hours. There is no record that wider impact was assessed, no lessons-learned entry, and no preserved logs. Cassia Transit's own legal register requires notification to the data-protection authority within 72 hours; that did not happen. Questions 8 to 10 are based on this scenario. Each one stands on its own. Question 8. (3 marks) A team member drafts this nonconformity for Cassia Transit: “The incident was closed in four hours without any impact assessment, because the security team is under-resourced and needs another analyst.” What must be removed?

A. The reference to the four-hour closure, which is a positive finding

B. The requirement, which belongs in a separate field

C. The explanation of the cause and the implied solution

D. Nothing; the draft is acceptable as written

None

Question 9. (3 marks) In response to the nonconformity, Cassia Transit states the root cause as “human error — the engineer forgot to run the impact assessment”. How should you evaluate this?

A. Question it, because it identifies who acted rather than why the process allowed the omission

B. Accept it, since determining the root cause of its own nonconformity is the organisation's job and not the auditor's

C. Reject it outright, on the basis that human error is never a valid root cause in a management system

D. Accept it, provided the engineer concerned has since been retrained and the retraining recorded

None

Question 10. (2 marks) Cassia Transit later submits evidence that it has closed the finding. Which set of questions should you apply before agreeing?

A. Has the auditee responded within the agreed timescale, has senior management signed the response, and has the response been filed with the certification body?

B. Was the immediate problem put right; was the need to remove its cause evaluated and recorded; was any action actually carried out with evidence rather than an assurance; and was it afterwards reviewed for effect?

C. Has the auditee implemented the action the audit team recommended, confirmed it in writing, and had the correction witnessed by a second person?

D. Has the auditee updated its procedures, circulated them to everyone affected, and recorded that each person has read and understood them?

None

Time's up

Which set should you take next?

To work a domain properly, take its full set:

• Domain 1 practice questions — concepts and principles, six.
• Domain 2 practice questions — audit concepts and responsibilities, six.
• Domain 3 practice questions — planning the audit, six questions.
• Domain 4 practice questions — conducting the audit, fourteen scenario questions.
• Domain 5, reporting and closing out, is eight questions and 20 marks; until that set publishes, the five exam domains sets out what it asks.

If several went wrong for the same reason rather than the same topic, that is worth knowing: how the pass mark works explains why one weak domain fails a paper otherwise above 50 per cent.

Frequently asked questions

Where to go next

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 ISMS Lead Auditor (PR373). The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING's Approved Training Partner record, and any provider's certified courses can be looked up in CQI and IRCA's own directory of certified courses and approved training partners. The ISO 27001 Lead Auditor training course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.