PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide study plan
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of Information Security Incident Management
Define information security incident management and distinguish an event, an incident, and a breach in your own words
Explain the purpose and structure of ISO/IEC 27035 and how its parts relate to one another
Identify the key terms and definitions used across the standard and build a personal glossary of at least 20 terms
Describe where incident management sits within an overall ISMS and how it links to ISO/IEC 27001 clauses
Your checkpoint
A one-page concept map linking event, incident, breach, ISMS context, and the ISO/IEC 27035 parts, plus a 20-term glossary with your own definitions
Fundamental principles and concepts of Information Security Incident Management
Explain the principles of the incident management lifecycle from planning and preparation through detection, response, and post-incident review
Distinguish roles and responsibilities such as incident response team, incident owner, and management sponsor
Describe the value of documented incident management policy and how it supports consistent handling
Compare reactive and proactive approaches to incident management and give an example of each
Your checkpoint
A written summary of at least 400 words explaining the lifecycle stages, the responsible roles at each stage, and one proactive control per stage
Fundamental principles and concepts of Information Security Incident Management
Describe the purpose and typical contents of an incident management policy and supporting procedures
Explain how risk assessment informs incident prioritisation and escalation criteria
Identify the categories of information typically recorded during incident handling and why evidence integrity matters
Explain the concept of lessons learned and how it feeds continual improvement
Your checkpoint
A draft incident management policy outline of 10 to 15 sections with a one-line purpose statement for each section
Fundamental principles and concepts of Information Security Incident Management & Information Security Incident Management
Consolidate domain 1 by answering at least 60 practice questions and reviewing every incorrect answer
Explain the purpose of incident detection and the sources of information that can reveal an incident
Describe the objectives of incident response and the criteria for declaring and escalating an incident
Identify the key elements of incident documentation and communication with stakeholders
Your checkpoint
A scored practice test of at least 60 domain 1 questions with a written review note for each missed item explaining the correct concept
Information Security Incident Management
Walk through the incident management process steps in order and describe the inputs and outputs of each step
Explain how incidents are identified, reported, and triaged, and what makes a report effective
Describe the assessment and decision-making activities that determine the response path
Explain the role of communication plans and escalation paths during an active incident
Your checkpoint
A process flow diagram or numbered table of the full incident management process with inputs, outputs, and responsible roles for each step
Information Security Incident Management
Describe the activities involved in responding to and containing an incident, including coordination with technical teams
Explain how evidence is collected and preserved and why chain of custody matters
Distinguish the roles of internal teams, management, legal, and external parties during response
Describe the criteria for closing an incident and the steps taken before closure
Your checkpoint
A response and closure checklist of at least 15 items covering containment, evidence handling, stakeholder communication, and closure criteria
Information Security Incident Management
Explain the post-incident review process and how findings are documented and acted upon
Describe how incident metrics and reporting support management oversight and improvement
Identify the inputs that feed lessons learned into updated policies, controls, and training
Answer at least 60 domain 2 practice questions and analyse every incorrect answer
Your checkpoint
A post-incident review template with sections for timeline, root cause, impact, lessons learned, and corrective actions, plus a scored 60-question practice test
Fundamental principles and concepts of Information Security Incident Management & Information Security Incident Management
Review your weakest concepts from the previous seven weeks and close each gap with a written explanation
Complete at least two full-length timed practice exams under exam conditions
Explain the relationship between the two domains and how questions may combine them
Verify your readiness by scoring consistently above your target threshold on timed practice
Your checkpoint
A final two-page revision sheet covering every concept you previously missed, plus a log of your timed practice scores with target threshold met
Milestones
Week 2: You can explain the incident management lifecycle stages and the responsible roles at each stage without notes
Week 4: You score at least 70 percent on a 60-question domain 1 practice test and can explain every missed item in writing
Week 6: You can describe the full incident management process from detection to closure in correct order, including inputs, outputs, and roles
Week 8: You score consistently above your target threshold on two full-length timed practice exams and your revision sheet covers every previously missed concept