ISO 27000 Foundation Certification Practice Test

What the ISO 27000 Foundation Certification is and how it works

According to EXIN, “Choose between video or live proctoring. With live proctoring, a proctor monitors you in real-time while you take the exam. With video proctoring, a video recording of you taking your exam will be made and judged objectively, after you have taken it.”^[3]

The exam is awarded by EXIN. It tests whether you understand the basic ideas of information security and how a management system for it is built and run. It has 40 multiple-choice questions and a time limit of 1 hour. It is closed book, so you cannot refer to notes or the standards during the sitting.

You take it online through EXIN Anywhere, with either live proctoring or video proctoring. With live proctoring a proctor watches you in real time. With video proctoring your session is recorded and judged afterwards. Some candidates sit the exam through an accredited partner instead. You can take the online exam at any time within 21 days of booking, so choose a date when your preparation is finished.

You get a temporary result immediately after an EXIN Anywhere exam. The final result is expected within about 2 weeks.

If you do not pass, you book another exam. EXIN allows a retake on the same day if a slot is available.

This page does not state the pass mark, the fee or any entry requirements, because they are not in the facts we have checked. They can differ by exam provider or partner, so confirm them on the official EXIN exam page before you book.

ISO 27000 Foundation Certification Exam at a Glance

ISO 27000 Foundation Certification content outline and where to practise each area

The content areas below are copied from the official ISO 27000 Foundation Certification content outline published by EXIN. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through ISO 27000 Foundation Certification questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: What is the consequence if an organization's ISMS scope is too broad?

1. Certification is automatically granted for all areas
2. Implementation becomes resource-intensive and may be ineffective across the entire scope
3. The risk register can be simplified
4. External audits become shorter

Answer: B. Implementation becomes resource-intensive and may be ineffective across the entire scope

Explanation:

Option B is correct. When the scope covers more than the organization can realistically manage, effort and budget are spread thinly, so controls tend to be applied on paper only and do not reduce risk across the whole scope.

Option A is wrong because certification is never granted automatically; it depends on meeting requirements. Option C is wrong because a wider scope usually means more assets and risks to record, not fewer. Option D is wrong because a larger scope generally gives auditors more to examine, so audits do not get shorter.

Rule to remember: choose a scope the organization can actually run and maintain, not the largest one possible.

Example 2

Question: A company decides to stop offering a high-risk online service to remove the associated information security risk. Which risk treatment is this?

1. Risk modification
2. Risk acceptance
3. Risk avoidance
4. Risk transfer

Answer: C. Risk avoidance

Explanation:

Option C, risk avoidance, is correct. The company removes the risk at its source by ceasing the activity that creates it, so no exposure remains from that service.

Risk modification (A) keeps the activity and applies controls to lower the likelihood or impact. Risk acceptance (B) keeps the activity and tolerates the remaining risk knowingly. Risk transfer (D) keeps the activity but shifts part of the consequence to another party, for example through insurance or a contract.

Rule to remember: ask what happens to the activity. If it stops, that is avoidance. If it continues, the treatment is modification, acceptance or transfer.

Example 3

Question: Which standard in the ISO 27000 family provides the overview, fundamental principles, and vocabulary for Information Security Management Systems (ISMS)?

1. ISO/IEC 27001
2. ISO/IEC 27005
3. ISO/IEC 27000
4. ISO/IEC 27002

Answer: C. ISO/IEC 27000

Explanation:

Option C, ISO/IEC 27000, is correct. It is the overview standard for the family: it introduces the fundamental principles of an ISMS and defines the terms the other standards rely on.

ISO/IEC 27001 (A) sets out the requirements for an ISMS, so it says what to do rather than defining the vocabulary. ISO/IEC 27005 (B) deals with information security risk management. ISO/IEC 27002 (D) gives guidance on security controls.

Rule to remember: link each standard in the family to a single role. The base standard gives overview and vocabulary, and the others cover requirements, controls and risk.

How to use these practice tests

Start with the official EXIN exam page and its outline, so you know the four content areas and the exam rules. Then take the main practice test cold to see where you stand, and write down the topics you missed.

Work through the sets by topic. Begin with ISMS fundamentals and vocabulary and the family of standards, because most later questions depend on those terms. Next do the PDCA cycle, scope of the ISMS and risk assessment and treatment. Finish with control themes and performance evaluation and improvement.

After every set, read the explanation for each answer you got wrong and put the rule in your own words. Do not memorise answers, since our questions are written by us and are not real exam questions. Before test day, repeat the mixed MCQ set against a timer, with no notes, to match the closed-book conditions.

Sources & last verified

1. EXIN — number of questions, time limit (official source). “Number of Questions: 40 (Multiple Choice)” Verified Oct 24, 2026 · source checked Oct 24, 2026.
2. EXIN — retake policy (official source). “If you did not pass your exam, you can book another exam to do your retake. You are allowed to retake the exam the same…” Verified Oct 21, 2026.
3. EXIN — delivery, testing window (official source). “Choose between video or live proctoring. With live proctoring, a proctor monitors you in real-time while you take the exam. With video proctoring, a video…” Verified Oct 24, 2026 · source checked Oct 24, 2026.
4. EXIN — score release (official source). “If you have taken your exam through EXIN Anywhere, your temporary result will be provided immediately. We aim to provide your final result within two…” Verified Oct 21, 2026.
5. EXIN — other (official source). “information and security” Verified Oct 28, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.