PECB · ISO27002LM
PECB Certified ISO/IEC 27002 Lead Manager Practice Tests
Validates the ability to implement and manage information security controls based on ISO/IEC 27002:2022. Covers control fundamentals, ISMS initiation, organizational, people, physical and technological controls, and performance measurement and monitoring.
Exam Details
Practice Questions
203
≈ 3 practice exams
Duration
180 minutes
Passing Score
70%
Difficulty
ProfessionalLast Updated
Oct 2026
Topics Covered
Fundamental Concepts and Principles of Information Security ControlsInformation Security Controls Implementation PlanningImplementation of Information Security ControlsPerformance Measurement, Testing and Monitoring of Information Security ControlsContinual Improvement of Information Security Controls
PECB Certified ISO/IEC 27002 Lead Manager Practice Exam Preparation
Use this ISO27002LM practice exam to prepare for PECB Certified ISO/IEC 27002 Lead Manager with realistic questions, detailed explanations, and focused study modes. The practice bank includes 203 questions for PECB ISO27002LM, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Fundamental Concepts and Principles of Information Security Controls, Information Security Controls Implementation Planning, Implementation of Information Security Controls, Performance Measurement, Testing and Monitoring of Information Security Controls, and Continual Improvement of Information Security Controls. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are written for candidates preparing for PECB certification questions and reviewing how the concepts apply in practice. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Sample Questions
5 sample questions with answers and explanations. The full bank has 203 questions, enough for 3 full-length practice exams.
Preview — answers shown1. A candidate is studying the new controls introduced in ISO/IEC 27002:2022. Which of the following is one of the 11 new controls? (Select one!)
AThreat intelligence (5.7).
BAccess control (5.15).
CClock synchronization (8.17).
DInformation backup (8.13).
Explanation
ISO/IEC 27002:2022 introduced 11 new controls, including Threat intelligence (5.7), Information security for use of cloud services (5.23), and Data masking (8.11). Asset management (5.9) is a merged control, while Access control (5.15) and Backup (8.13) are updated or renamed controls from the previous edition, not new additions.
2. The ISMS team proposes a change to the access control procedure to reduce administrative overhead. Before implementation, they must evaluate the potential impact on security. This evaluation is part of which PDCA phase? (Select one!)
ADo
BPlan
CAct
DCheck
Explanation
The 'Plan' phase involves establishing objectives, processes, and resources, as well as assessing risks and opportunities associated with changes. Evaluating the impact of a proposed change before implementation is a planning activity to ensure the change aligns with ISMS objectives and does not introduce unacceptable risks.
3. After implementing controls to treat identified risks, some risk remains. The organization acknowledges that it is impossible to eliminate all risk. This remaining risk is referred to as: (Select one!)
ATransferred risk
BAvoided risk
CInherent risk
DResidual risk
Explanation
Residual risk is the risk that remains after risk treatment measures (controls) have been applied. Inherent risk is the risk before controls, transferred risk is shared with another party, and avoided risk is eliminated by stopping the activity. Residual risk must be accepted by management.
4. Following a ransomware attack, the IT team at TechCorp restores systems from backups and applies patches to close the exploited vulnerability. These actions are primarily classified as which type of control? (Select one!)
ACorrective
BDetective
CDeterrent
DPreventive
Explanation
Corrective controls aim to restore normal operations and mitigate damage after an incident has occurred. Restoring from backups and patching vulnerabilities are classic examples of corrective actions. Preventive controls would have been the patches applied before the attack, while detective controls would have been the alerts that identified the ransomware activity.
5. An organization is updating its Statement of Applicability (SoA) to reflect ISO/IEC 27002:2022. Which annex in ISO/IEC 27002:2022 provides the correspondence between controls in the 2022 edition and the previous editions? (Select one!)
AAnnex A.
BAnnex C.
CAnnex D.
DAnnex B.
Explanation
Annex B of ISO/IEC 27002:2022 provides the correspondence (mapping and reverse mapping) between controls in the 2022 edition and the previous editions (2013). This is essential for organizations updating their SoA and risk treatment plans. Annex A provides guidance on the use of attributes.
More PECB Practice Exams
PECB Certified ISO/IEC 42001 Lead Auditor
ISO42001LA · 120 questions
PECB Certified ISO/IEC 27001 Lead Auditor
ISO27001LA · 213 questions
PECB Certified ISO/IEC 27001 Lead Implementer
ISO27001LI · 300 questions
PECB Certified ISO/IEC 27035 Lead Incident Manager
ISO27035LIM · 195 questions
PECB Certified ISO/IEC 42001 Lead Implementer
ISO42001LI · 121 questions
PECB ISO/IEC 27001:2022 Foundation
ISO/IEC 27001 Foundation · 300 questions
$29.99
One-time access to this exam
203 questions (3 practice exams' worth)
Unlimited timed exam simulations
Lifetime $29.99 or $9.99/month, cancel anytime
Detailed explanations
Free preview stays available