PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide exam-day guide
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide · Prepare for the day ahead.
Your checklist
Confirm exam format and logistics with the provider
Before final study week, verify with the provider (PECB or your accredited training partner) whether the exam is delivered online-proctored or at a test center, its duration, number of questions, passing score, and whether it is open-book. These details can vary by exam version and delivery channel, so confirm with the provider rather than relying on secondhand accounts.
Valid government-issued photo ID
Bring the original ID document whose name exactly matches your exam registration. For online proctoring, check with the provider which ID types are accepted and whether a secondary ID is required; for a test center, bring the physical document, not a photocopy or photo on your phone.
Exam appointment confirmation and candidate number
Have your booking confirmation, candidate/registration number, and any access link or test-center address saved offline (screenshot or printout) in case email or the portal is unavailable on the day.
Working webcam, microphone, and stable internet (online-proctored only)
Run the provider's system check on the same machine and network you will use on exam day. A wired or stable connection, a charged laptop, and a backup plan (phone hotspot, alternative room) reduce last-minute failures. Confirm with the provider whether a system test is mandatory.
Compliant workspace for remote proctoring
A quiet, private room with a cleared desk, good lighting, and a closed door. Remove notes, phones, smart watches, and second screens unless the provider explicitly permits specific reference material. Confirm with the provider what is allowed on the desk.
Know the permitted reference materials
Some PECB exams allow the standard or training materials during the exam; others do not. Confirm with the provider whether your exam is open-book and, if so, which documents are permitted and in what form (printed, PDF, or none). Do not assume.
Review ISO/IEC 27035 structure and key terms, not trivia
Be able to place the standard's parts (27035-1 principles and process, 27035-2 planning and preparation guidance, 27035-3 incident response operations/ICT readiness) and recall the core incident-management phases and vocabulary (event vs. incident, incident response team, lessons learned). Focus on concepts and definitions rather than memorizing clause numbers.
Prepare a one-page concept sheet (if permitted)
Summarize the incident-management process flow, roles (incident response team, management, stakeholders), and the plan–detect–assess–respond–learn cycle in your own words. If the exam is closed-book, use it only for final review before the exam and leave it outside the testing area.
Plan timing and breaks
Note the total exam time and question count from the provider, then decide a per-question pace. Confirm with the provider whether breaks are allowed during a proctored exam and how they affect your clock; for many remote-proctored exams, unscheduled breaks are not permitted.
Set up a backup power and connectivity plan
Charge devices, keep a charger connected, and know the provider's procedure if the connection drops mid-exam. Confirm with the provider how an interruption is handled and whether the attempt is protected.
Rest and logistics the night before
Confirm start time in your local time zone, set two alarms, and prepare clothes, ID, and workspace so the morning requires no decisions. Avoid last-minute cramming of new material.
Know the reschedule and technical-support contacts
Save the provider's candidate support contact and your booking reference. Confirm with the provider the deadline and conditions for rescheduling or reporting a technical issue, since these policies are set by the provider and can change.
Plan the day
Consolidate rather than expand. Re-read your own summary of the ISO/IEC 27035 incident-management process and definitions, and self-test with practice questions on concepts: distinguishing events from incidents, the purpose of each phase, roles and responsibilities, and the intent of planning and preparation activities. Review why each answer is right or wrong. Stop introducing new sources after the first of these three days.
Verify logistics: confirm delivery mode, start time in your time zone, ID requirements, permitted materials, and any system or proctoring checks with the provider. Book or run the system test if one is offered, and confirm your test-center address and travel time if applicable.
Light review only: skim your concept sheet and the phase names, then stop. Prepare the workspace or bag (ID, confirmation, charger, water), check the webcam and microphone, and confirm the room can be made private. Set alarms and aim for a full night's sleep; fatigue costs more marks than one extra hour of reading.
Eat, hydrate, and log in or arrive early per the provider's instructions (often 15–30 minutes before the start for check-in). Close other applications, silence notifications, and keep your phone out of reach unless the proctor instructs otherwise. Have your ID ready for verification and read the proctor or candidate instructions carefully before starting.
Read the instructions and note the question count and time limit. Do a quick scan of the first few questions to gauge difficulty, then settle into a steady pace. If the exam allows flagged review, answer every question in one pass and flag uncertain ones rather than stalling.
Work at your planned pace and watch the clock at set checkpoints (for example, one-third and two-thirds of the time). For scenario-style questions, identify which incident-management phase or role the question targets before choosing. Eliminate clearly wrong options, prefer the answer consistent with the standard's process and terminology, and be wary of absolutes that overstate what the standard requires.
Return to flagged questions, confirm no question is left blank, and check that your answers registered before submitting. If a technical problem occurs, note the time and contact the proctor or provider support immediately rather than waiting until after the exam.
Follow the provider's stated process for results and, if you did not pass, for retake eligibility and any waiting period. Confirm these rules with the provider, as they are set by the certification body and are not part of the standard itself.
Rules to check
Bring the original government-issued photo ID matching your registration name; without acceptable ID, the provider or proctor may refuse entry, and the outcome is governed by the provider's policy. Confirm accepted ID types with the provider in advance.
For remote-proctored exams, follow the proctor's instructions on room scans, desk clearance, and permitted items. Do not have phones, smart watches, notes, or additional screens within reach unless the provider explicitly allows them; an apparent violation can lead to invalidation of your attempt.
Do not communicate with anyone other than the proctor during the exam, and do not copy, photograph, or share exam content. Exam content is confidential, and sharing it may breach the provider's candidate agreement.
Confirm with the provider whether breaks are permitted and how they affect the timer. Unless told otherwise, assume unscheduled breaks are not allowed in a proctored exam and plan hydration and restroom visits before check-in.
If the exam is open-book, use only the materials the provider permits and do not rely on searching the internet or consulting others. If it is closed-book, keep all references outside the testing area. The permitted-materials rule is set by the provider, so verify it in advance.
Answer every question: unless the provider states there is a penalty for incorrect answers, an unanswered question scores the same as a wrong one. Confirm the scoring model with the provider rather than assuming.
Report technical problems immediately to the proctor or provider support and record the time; do not attempt to fix a proctoring issue by restarting or leaving the session without instruction. How an interrupted attempt is handled is determined by the provider.
Treat results and retake rules as provider policy: passing scores, result timelines, and retake conditions are set by the certification body. Confirm them with the provider and do not rely on forum claims.