PECB

PECB builds certification around ISO standards, and it separates two kinds of credential. Personnel certifications such as the ISO/IEC 27001 Lead Implementer and Lead Auditor are accredited under ISO/IEC 17024 (PECB names IAS, UKAS and COFRAC as accrediting bodies). Foundation-level programs are certificate programs accredited by ANAB under ANSI/ASTM E2659, which is why a Foundation holder is a 'Certificate Holder' rather than 'Certified'. That wording matters when you put it on a CV.

The ISO/IEC 27001:2022 Foundation exam is 40 multiple-choice questions with three options each, closed book, with a 70 percent pass mark. According to the 2026 candidate handbook it is split evenly between two domains: fundamental principles and concepts of an information security management system (20 questions), and the ISMS requirements themselves (20 questions). The first half measures comprehension, application and analysis; the second half measures evaluation, so expect short scenarios that ask what the standard actually requires rather than pure definitions. The handbook lists a PECB training course as a prerequisite and no work experience.

Our ISO/IEC 27001:2022 Foundation bank has 300 questions, 150 per domain, with 30 free to try. Each question has four options instead of the real exam's three, so a clean run here leaves you margin. The questions cover the ISO/IEC 27000 family and how 27001, 27002 and 27003 differ, the clause 4 to 10 structure and the PDCA cycle, confidentiality, integrity and availability, threat versus vulnerability versus risk, policy types, risk assessment and treatment, the Statement of Applicability, competence and documented information, monitoring versus measurement, internal audits, nonconformity and corrective action, management review, and the Annex A controls.

The standard changed recently, and older study material has not caught up. ISO/IEC 27001:2022 replaced the 2013 edition and moved Annex A from 114 controls in 14 domains to 93 controls in four themes: organizational, people, physical and technological. Amendment 1:2024 added climate change to the context and interested-party clauses, and ISO/IEC 27000:2026 replaced the withdrawn 2018 edition. Every question here uses the current names and numbers, and wrong options that lean on the 2013 wording are there on purpose.