ISO 27400 Foundation study guide
ISO 27400 Foundation · Work through your exam, one topic at a time.
The PECB ISO/IEC 27400 Foundation certification is an entry-level credential for people who need a working grasp of Internet of Things (IoT) security and privacy as framed by ISO/IEC 27400. PECB describes the associated training course as building fundamental knowledge of IoT concepts, principles and life cycles, the stakeholders of IoT systems, and the security and privacy controls related to IoT. The credential awarded after passing the exam is "Certificate Holder in ISO/IEC 27400 Foundation". It suits managers and consultants who want to know more about IoT security, professionals getting acquainted with ISO/IEC 27400 guidance for an IoT security and privacy program, individuals engaged in or responsible for IoT security activities, and people pursuing a career in IoT security. Topics on this exam: Fundamental concepts and principles of IoT security and privacy and Risk sources and privacy and security controls for IoT systems. The ISO 27400 Foundation study guide has 2 sections and about 654 words.
01Fundamental Concepts and Principles of IoT Security and Privacy
Domain 1 tests the vocabulary and principles in ISO/IEC 27400:2022: what an IoT system is, why IoT security differs from conventional IT, and which security and privacy principles must shape design and operation. Expect definitional questions and short scenarios asking which principle is applied or violated. An IoT system spans devices, network connectivity, services/cloud, and users/stakeholders; security and privacy responsibilities are shared. IoT devices often interact with the physical world, run unattended, remain in service for years, are physically accessible, and have constrained compute, memory, power, and user interface.
348 words, about 2 min02Risk Sources and Privacy and Security Controls for IoT Systems
Domain 2 tests whether you can identify risk sources across the IoT ecosystem and select controls that match them. Questions often present a deployment and ask for the most relevant control or the risk source being overlooked. Device-level: weak or default credentials, insecure interfaces, constrained cryptography, physical tampering, poor update support. Network: eavesdropping, man-in-the-middle attacks, weak protocols, exposed local interfaces.
306 words, about 2 min