PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide

According to PECB, a Foundation certificate shows that you have understood the fundamental methodologies, requirements, and management approach of information security incident management. It is a knowledge-level credential, not an auditing or implementation qualification, and PECB lists no professional experience, audit experience, or project experience as certificate requirements.

PECB states that the exam fully meets the requirements of its Examination and Certificate Programme and lists two competency domains. The number of questions, the time limit, the passing score, and the exact item format are not given on the course page; PECB directs candidates to its List of PECB Exams and Examination Rules and Policies for exam type and language details.

The published agenda is two days. Day 1 introduces fundamental principles and concepts of information security incident management using ISO/IEC 27035. Day 2 covers information security incident management process approaches and includes the certificate exam. PECB states that an attestation of course completion worth 14 CPD credits is issued to participants who attend the training course.

PECB states: "In case of exam failure, you can retake the exam within 12 months for free." Plan your retake inside that 12-month window and use your score feedback to target the domain where you lost the most marks before rescheduling.

No. PECB lists basic knowledge of security incident management as preferred, not required, and the certificate requirements show no professional experience. That said, candidates with no exposure to security operations should read the ISO/IEC 27035 process stages before the course so the lectures and practical exercises land faster.

Domain 1 is fundamental principles and concepts of information security incident management, matching Day 1 of the course. Domain 2 is information security incident management, matching the process approaches taught on Day 2. PECB does not publish a per-domain weighting on the course page, so treat both domains as equally important when you plan study time.

Start with the concepts domain: incident, event, and incident management terminology, the principles behind the standard, and how ISO/IEC 27035 relates to other standards and regulatory frameworks, which PECB lists as a learning objective. Then move to process approaches, where you need to be able to describe the stages of managing an incident in sequence rather than just recognise terms.

Two patterns dominate. First, memorising definitions without being able to place a given activity in the correct process stage. Second, skipping the correlation objective: PECB explicitly expects you to acknowledge how ISO/IEC 27035 relates to other standards and regulatory frameworks, and questions built on that objective punish candidates who studied the standard in isolation.

PECB describes its course practice tests as similar to the Certificate Exam, so use them to check coverage rather than to predict a score. Work through each practice test untimed first, review every wrong answer against the course material, then repeat timed once your accuracy is stable across both domains.

No. This is independent study material written for candidates preparing for the exam. It is not affiliated with, endorsed by, or sponsored by PECB or ISO, and it does not reproduce any official question bank. Always confirm exam type, available languages, fees, and scheduling directly with PECB before you book.