Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
What activity is done first when preparing for an initial certification audit?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27001:2022 standards and certification guidance:
Before a certification audit can begin, the scope of the ISMS must be clearly defined and agreed with the Certification Body. ISO/IEC 27001 Clause 4.3 requires: ''The scope shall be available as documented information.''
Certification Bodies require this scope statement to plan audit duration, resources, and coverage. Only after the scope is agreed does the Stage 1 audit begin, which reviews documented information and readiness. Stage 2 focuses on implementation and effectiveness. Evidence of corrective actions (C) is checked at Stage 2 if issues were identified earlier. Records provision (D) occurs during Stage 2, not first.
Thus, the first step in preparing for certification is A: Agreeing the scope of the ISMS with the Certification Body auditor.
Which action is an organization required to take to ensure that personnel are competent to perform their assigned tasks within the ISMS?
Clause 7.2 (Competence) requires the organization to:
''determine the necessary competence of person(s) doing work under its control that affects its information security performance;''
''ensure that these persons are competent on the basis of appropriate education, training, or experience;''
''retain appropriate documented information as evidence of competence.''
This makes holding up-to-date records on training, skills, experience, and qualifications (D) the correct answer. Option A is irrelevant to competence. Option B is incorrect since ISO does not require Foundation-level training --- competence is context-based. Option C is related to compliance but does not ensure individual competence.
Thus, the verified correct answer is D.
Which statement describes the Classification of information control in Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A.5.12 (Classification of information) states:
''Information should be classified according to the information security needs of the organization based on confidentiality, integrity and availability.''
This aligns directly with option B. Option A (labelling) is a separate control (Annex A.5.13). Option C (security perimeters) is under physical controls (Annex A.7.1). Option D (access control rules) relates to Annex A.5.15 and A.8.2.
Thus, the verified correct statement for the Classification of information control is B.
Identify the missing word in the following sentence.
The organization shall determine the [ ? ] of interested parties relevant to information security.
Clause 4.2 of ISO/IEC 27001:2022 states:
''The organization shall determine: a) interested parties that are relevant to the information security management system; b) the relevant requirements of these interested parties; c) which of these requirements will be addressed through the ISMS.''
This confirms that the missing word is requirements. Neither number, structure, nor influence are specified in the standard.
Which statement about the conduct of audits is true?
Clause 9.2 (Internal Audit) and Clause 9.3 (Management Review) highlight that audit outputs and management reviews are key inputs for evaluating ISMS performance. Surveillance audits, conducted by Certification Bodies, check ongoing compliance and effectiveness. ISO certification schemes (per ISO/IEC 17021) require surveillance audits to verify whether corrective actions and continuous improvements are being made. A critical focus area is the results of internal audits and management reviews, ensuring that the organization maintains its ISMS between certification cycles.
Option A is incorrect --- third-party audits are performed by independent Certification Bodies, not customers. Option B is incorrect --- certificates are typically valid for three years with annual surveillance. Option D is incorrect --- Stage 1 is primarily a documentation and readiness review, not evidence observation.
Therefore, the verified correct answer is C.
Which statement is a factor that will influence the implementation of the information security management system?
ISO/IEC 27001 makes clear that the ISMS is intended to be tailored to the organization. The standard states: ''This document also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in this document are generic and are intended to be applicable to all organizations regardless of type, size or nature.'' This means implementation is scaled based on each organization's risk, context, and needs, not a fixed one-size-fits-all set of activities or controls. Clause 6.1.3 further reinforces that control selection is flexible and risk-driven: ''Organizations can design controls as required or identify them from any source,'' and ''Annex A contains a list of possible information security controls... The information security controls listed in Annex A are not exhaustive and additional information security controls can be included if needed.'' Together, these extracts verify that the ISMS implementation is influenced by and scaled to the organization's needs and selected controls, not separated from management processes (A, D) nor mandated to include ''all controls'' (B).
Which statement describes the control for the Compliance with policies, rules and standards for information security within Annex A of ISO/IEC 27001?
Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:
Annex A.5.36 (Compliance with policies, rules and standards for information security) requires:
''Compliance with the organization's information security policies, rules and standards for information security should be regularly reviewed.''
This directly matches option A. Option B refers to contractual compliance, which is part of supplier management controls (Annex A.5.19). Option C relates to Annex A.5.7 (Contact with authorities). Option D refers to asset return controls (Annex A.5.9).
Thus, the correct answer is A.
Exam domains verified against: Official APMG-International ISO-IEC-27001-Foundation exam guide, last checked October 2026.
Framework design creates reusable structural blueprints that support security development and ensure consistency across applications. Understanding how to develop, customize and deploy security frameworks is essential for building effective information security programs within organizations.
Data security involves safeguarding digital assets such as stored or transmitted data from unauthorized use, corruption or cyberattacks to maintain privacy and accuracy. Candidates must understand data classification, protection mechanisms and secure handling procedures throughout the information lifecycle.
Security breaches are incidents where security controls are compromised or about to be compromised, leading to unauthorized access or potential harm to data and systems. Candidates learn incident response procedures, breach containment, forensics and the reporting requirements defined in ISO/IEC 27001.
Cybersecurity focuses on protecting computer systems, networks and data from unauthorized access, damage, theft or disruption to preserve data integrity and availability. The exam covers how cybersecurity principles integrate into an overall ISMS and organizational governance.
Self-confidence reflects the trust an individual has in their skills, capabilities and worth, embodying a sense of assurance and personal strength. The Foundation exam validates foundational competency and builds confidence for professionals advancing into Practitioner and Auditor roles.
A continuous improvement process (CI or CIP) represents a consistent, structured effort aimed at refining products, services, and processes to boost performance, efficiency, and quality over time.
Compliance describes an organization's dedication to recognizing and following relevant laws, regulations and policies to maintain operations within lawful and ethical boundaries. Candidates must understand how the ISMS supports regulatory compliance and provides evidence of adherence to legal and contractual obligations.
Information management covers the full process of handling information within an organization, including its acquisition, storage, distribution, use and eventual disposal or archiving. The ISO/IEC 27001 ISMS establishes controls across the entire information lifecycle to minimize risk and maintain compliance.
Sample question from this domain above: Q3
Risk management refers to the methodical approach of recognizing, assessing and mitigating risks to minimize their potential impact on achieving organizational objectives. The Foundation exam covers risk assessment, risk treatment and the risk management process that forms the core of ISO/IEC 27001.
Sample question from this domain above: Q4
Common questions about the exam itself
