ISO 27001 Foundation
ISO/IEC 27001 Certification
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ISO/IEC 27001 Certification is an APMG International certification listed in the Cyber Security category of its certification portfolio, which APMG describes as enabling professionals to safeguard data and manage evolving threats. It suits practitioners who build, run, audit or support an information security management system (ISMS) - security and risk officers, IT and service managers, compliance and audit staff, consultants, and team members whose work touches information security governance. Foundation-level study covers the structure and purpose of an ISMS and the ISO/IEC 27001 standard, the context of the organization, leadership and planning, support and operation, performance evaluation, and improvement, including how organizations prepare for certification. Candidates typically prepare through an accredited training organization or by self-study, since APMG states it is not itself a training provider and directs candidates to accredited organizations listed on its website for prices, languages and dates, or to self-study for an exam directly through APMG. Exams are booked online with APMG or arranged by a training organization, and successful candidates receive a digital badge through the candidate portal. This page offers original practice questions mapped to those four study areas; it is independent material and is not affiliated with, endorsed by or sponsored by APMG or ISO.
What you'll study
About ISO 27001 Foundation preparation
Who publishes the ISO/IEC 27001 Certification exam?
APMG International lists the ISO/IEC 27001 Certification among its Cyber Security certifications. APMG states it is not a training provider: candidates take courses through accredited training organizations listed on its website or self-study for the exam directly through APMG.
What format is the exam?
The source material available does not state the question format, item count or duration for this specific certification. APMG's general process is to book an online exam timeslot with APMG or through a training organization, so confirm the exact structure with your provider before booking.
How much does the exam cost and how long is it?
The source does not publish a fee, duration or passing score for this certification. APMG directs candidates to contact accredited training organizations for prices, languages and dates, so pricing and scheduling details should be obtained directly from a provider or from APMG when booking.
What score do I need to pass, and can I retake?
Passing marks and retake terms are not stated in the source material, so treat any specific figure you see elsewhere with caution. APMG does advertise a Retake Ready option that gives candidates a second opportunity at reduced cost; check whether it applies to this exam when you book.
How long is the certification valid?
The source does not state a validity period or renewal requirement for the ISO/IEC 27001 Certification. Ask your accredited training organization or APMG directly about badge validity and any recertification or continuing-education obligations before you plan your study timeline.
What does the exam cover?
Foundation study follows the standard's logic: ISMS fundamentals and the structure of ISO/IEC 27001; context of the organization, leadership and planning; support, operation and performance evaluation; and improvement with certification readiness. Expect questions on terminology, clause intent, roles, risk treatment and audit and management review concepts.
How hard is it, and how should I study?
It is an entry-level certification, so difficulty comes mainly from unfamiliar vocabulary and the plan-do-check-act structure rather than deep mathematics. Read the standard's clauses in order, then practise explaining each clause in your own words; candidates who memorize definitions without understanding how clauses connect tend to struggle.
What are the most common failure modes?
Typical mistakes are confusing risk assessment with risk treatment, mixing corrective action with preventive action, treating the Annex A controls as a checklist rather than a risk-driven selection, and muddling management review with internal audit. Also watch for questions about evidence and documented information, where precise wording decides the answer.
Do I need to take a training course first?
Not necessarily, since APMG allows self-study for an exam booked directly through APMG. A course helps if you are new to management systems, because instructors explain how clauses interlock. Whichever route you choose, confirm the exam booking process and any prerequisites with APMG or an accredited provider.
What do I receive after passing?
APMG states that if you are successful, your digital badge becomes available through your candidate portal. You can claim the badge after the exam result is confirmed, and it can be shared with employers as evidence of the certification.