ISO/IEC 27034 Foundation exam-day guide
ISO/IEC 27034 Foundation · Prepare for the day ahead.
Your checklist
Confirm exam format and logistics with the provider
Before finalizing your plan, confirm with the provider: delivery mode (online proctored vs. test-centre), exam duration, number of questions, passing score, permitted reference materials, and whether the exam is open or closed book. Do not rely on second-hand forum claims; policies for ISO/IEC 27034 Foundation certificates vary by certification body and can change.
Valid government-issued photo ID
Bring the exact ID type the provider specifies (typically a passport or national ID card). For online proctoring, the name on the ID must match your registration name exactly. Check the provider's accepted-ID list in advance and confirm whether a secondary ID is required.
Exam appointment confirmation and candidate number
Have your booking confirmation, candidate/registration number, and the provider's support phone number accessible. For test-centre delivery, arrive earlier than the stated check-in time; for online delivery, keep the confirmation email open in case the proctor asks for your session code.
Stable internet connection and a working webcam/microphone (online delivery)
If you are taking the exam online, run the provider's system check on the same device and network you will use on exam day, ideally 24-48 hours before. Have a backup plan (mobile hotspot, phone) in case the primary connection fails. Test-centre candidates can skip this item.
Quiet, private, well-lit room (online delivery)
Proctored online exams usually require a closed room with no other people, a clear desk, and adequate lighting so the proctor can see you and your ID. Remove notes, phones, and second screens from the desk unless the provider explicitly permits them.
Know the standard's structure cold
Be able to sketch ISO/IEC 27034's multi-part structure from memory: the overview and concepts (Part 1), the organization-centric framework and normative requirements (Part 2), application security management process and verification (Part 3), and application security controls/ASCs (Parts 4-7). Exam questions often test which part contains which concept.
Master the core vocabulary
Be able to define and distinguish: Application Security Control (ASC), Application Security Control Library, Organizational Normative Framework (ONF), Application Normative Framework (ANF), Targeted Level of Trust (TLT), Application Security Management Process (ASMP), and application security risk. Expect definitional and 'which concept applies' questions.
Review the ONF-to-ANF-to-ASC chain
Practice explaining how the organizational framework (ONF) feeds an application-specific framework (ANF), which selects and tailors ASCs to reach a Targeted Level of Trust. Be ready to identify where each artifact lives and who owns it.
Bring permitted items only
Unless the provider confirms otherwise, bring nothing beyond ID and confirmation: no notes, no smartwatch, no phone on the desk. If the provider allows a calculator, water, or scrap paper, confirm the exact rules in writing beforehand.
Plan your timing strategy
Before the exam, decide a per-question time budget based on the confirmed question count and duration. Flag uncertain questions and return to them; do not leave blanks if there is no penalty for guessing (confirm the scoring rule with the provider).
Plan the day
Do a full timed mock exam under realistic conditions. Review every wrong answer and trace it back to the relevant ISO/IEC 27034 part and concept. Reread your one-page summary of the ONF/ANF/ASC chain and the key definitions.
Confirm logistics with the provider: delivery mode, start time, time zone, ID requirements, permitted materials, and reschedule/cancellation policy. If online, run the system test on your final device and network.
Stop learning new material. Focus on weak areas identified in the mock exam: distinguish similar terms (ONF vs. ANF, ASC vs. ASC Library) and the purpose of each part of the standard. Write your own short definitions from memory and check them.
Light review only: your summary sheet, the standard's structure, and the process flow. Prepare your ID, confirmation, and any permitted items in one place. Check the exam start time in your local time zone and set two alarms.
Protect sleep. Avoid cramming new content late at night; a rested candidate performs better on definitional and scenario questions. Confirm your backup internet plan if taking the exam online.
Eat a normal meal, hydrate, and arrive at the test centre early or log in to the proctoring platform ahead of the start time. Have ID and confirmation ready, close other applications, and silence devices.
Read each question fully, note keywords like 'organizational', 'application-specific', 'targeted level of trust', and 'control library'. Answer confident questions first, flag uncertain ones, and return to them. Watch the clock against your per-question budget.
If a question seems ambiguous, choose the answer most consistent with the standard's defined terms rather than everyday usage. If technical issues occur, pause and contact the proctor or provider support immediately; do not attempt to fix the platform yourself.
Note which topics felt weak while they are fresh. If results are not immediate, confirm with the provider when and how they will be released and what the retake policy is.
Rules to check
Bring the exact ID the provider requires and ensure your registration name matches it. If you are unsure which documents are accepted, confirm with the provider before exam day; arriving without valid ID may result in refusal to sit the exam.
Follow all proctor instructions. For online delivery, this typically includes a room scan, showing your ID to camera, and keeping your face and hands visible. Failure to comply can lead to session termination.
Do not use unauthorized materials, notes, communication devices, or another person's assistance. Treat the exam as closed book unless the provider has explicitly confirmed otherwise in writing.
Breaks are usually not permitted during a timed certification exam, and the clock generally keeps running. Confirm the provider's break policy in advance if you have a medical or accessibility need; accommodations are typically arranged before exam day.
Scoring and the passing threshold are set by the certification body. Confirm the passing score, whether unanswered questions count as wrong, and whether guessing is penalized with the provider rather than assuming.
If you experience a technical failure, stop and contact the proctor or provider support. Do not restart the exam or continue on a different device unless instructed; undocumented interruptions may complicate result validation.
Report any suspected exam-content leak or irregularity to the provider. Sharing or reproducing exam questions after the test violates typical candidate agreements and can invalidate your result.
Keep your confirmation and result correspondence. If results are delayed or disputed, the provider's records and your candidate number are what support resolution.