PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide common mistakes
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide · Understand the traps and how to avoid them.
Treating an "event" and an "incident" as interchangeable, so the candidate marks a routine logged anomaly as an incident and then selects containment actions for it.
Everyday IT language uses "incident" loosely for any ticket or outage; ISO/IEC 27035 draws a deliberate line where an event is a state change of a service or asset and only becomes an information security incident once it is assessed as having actual or potential negative impact on information security.
What to do instead
Before answering, apply the two-part test aloud: (1) is this an observable occurrence, and (2) has it been assessed as compromising confidentiality, integrity or availability? If only (1), it is an event; if (2), it is an incident. Memorise that assessment is what converts one into the other.
Describing the incident management process as starting at detection, omitting the policy, governance and planning stage that precedes it.
Candidates study from operational runbooks where the story begins when an alert fires, so the preparatory phase (policy, roles, awareness, tooling, communication channels) is mentally invisible.
What to do instead
Anchor the full lifecycle in order: plan and prepare (policy, roles, resources, training, detection capability), then detection and reporting, assessment and decision, responses including containment/eradication/recovery, post-incident review, and lessons-learned improvement. Always ask where in that chain the question sits.
Selecting "containment" as the first action after detection, skipping the assessment and decision step.
It feels decisive and is what action films and outage playbooks encourage, and candidates conflate speed with maturity.
What to do instead
State the sequence explicitly: detect and report, then assess and decide (is it an incident, what severity, who is notified), then respond. Containment is a response activity chosen after the decision, and an unassessed containment can destroy evidence or tip off an attacker.
Confusing the incident response team (the operational group handling the incident) with the wider governance and decision-making bodies, and assigning executive sign-off duties to the wrong entity.
Org charts vary by employer and candidates project their own company structure onto the standard, which uses role categories rather than fixed job titles.
What to do instead
Learn the role categories and what each is accountable for: the incident response team performs handling, the incident manager coordinates, management/decision-makers authorise significant actions and external communication, and other parties (legal, HR, communications, external providers) are invoked as needed. Answer by function, not by job title.
Treating evidence handling as a forensic-specialist concern and therefore not preserving logs, volatile data or chain of custody during response.
The exam question may not mention forensics, so candidates default to "fix it fast" and forget that an incident may become a disciplinary or legal matter.
What to do instead
Whenever a scenario involves suspected insider activity, potential litigation, or law enforcement, flag evidence preservation (integrity, chain of custody, authorised collection) as a required parallel activity during response, not an afterthought.
Skipping or superficially answering post-incident activity, e.g. closing the incident once service is restored with no lessons-learned review.
Restoration feels like the finish line and post-mortems are the part candidates have least often experienced in practice.
What to do instead
Treat "lessons learned" as a mandatory lifecycle step: review what happened, identify root cause and control gaps, record findings, assign owners and feed improvements back into the prepare phase. In scenario questions, prefer the option that closes the loop over the one that simply restores service.
Misreporting communication and escalation responsibilities, e.g. notifying all staff or external media immediately after an unconfirmed alert.
Candidates equate transparency with good practice and underestimate the need for verified facts, authorised channels and legal/privacy constraints.
What to do instead
Route communications through the designated channels and authorised spokespeople, after assessment and with management approval where required. Where a question offers "inform everyone immediately" versus "notify per the communication plan", the plan-based answer is correct.
Confusing incident management with business continuity or disaster recovery, and answering questions about service restoration with BC/DR terms such as RTO and BIA.
The domains overlap in real organisations and both deal with disruption, so the boundaries blur under exam pressure.
What to do instead
Keep the distinction sharp: incident management detects, assesses, responds to and learns from information security incidents, while BC/DR provides the continuity and recovery framework for major disruptions. Use RTO/BIA language only when the question is explicitly about continuity.
Ignoring the improvement and measurement dimension, so the candidate cannot name what makes an incident management capability effective (metrics, testing, awareness, review).
Candidates memorise process steps as a checklist and never connect the prepare phase to ongoing validation.
What to do instead
Attach concrete evidence to the prepare phase: defined metrics (e.g. detection and response times, incident volumes, repeat causes), exercises and tests of the plan, awareness training, and periodic review of the policy and procedures. If asked "how do you know it works", answer with validation and measurement.
Answering with generic best practice rather than the ISO/IEC 27035 structure, e.g. inventing phases or ordering steps by personal preference.
Candidates rely on prior ITIL or vendor incident-management training, whose terminology and phase names differ from the ISO structure, and the exam rewards the standard's framing.
What to do instead
Learn the standard's own vocabulary and phase names and map any familiar framework onto them before choosing. When two options both sound reasonable, pick the one using the standard's terms and lifecycle order.