ISO 27001 Lead Auditor Free Practice Questions.

During the on-site phase of a Stage 2 certification audit, the team collects access-control logs showing five attempts to disable MFA in the preceding month. According to ISO 19011:2018, this information is best described as:

1. A. Audit evidence that has not yet been evaluated against criteria
2. B. An audit finding that should be raised at the closing meeting
3. C. A nonconformity under ISO/IEC 17021-1
4. D. An audit conclusion supporting the certification decision

ISO/IEC 27001:2022 Clause 6.1.3 d) addresses the Statement of Applicability (SoA). Which option most accurately reflects the standard's wording?

1. A. The organisation may produce a SoA when an external party requires it
2. B. The organisation should produce a SoA aligned with Annex A
3. C. The organisation must produce a SoA only after the risk treatment plan is approved
4. D. The organisation shall produce a SoA that justifies inclusions and exclusions of Annex A controls

An audit team leader is assigned to a client where she worked three years ago in a junior risk role. According to ISO/IEC 17021-1:2015, the most appropriate response is to:

1. A. Disclose the prior engagement to the certification body and reassign if impartiality cannot be safeguarded
2. B. Proceed because three years exceeds the cooling-off period for junior staff
3. C. Proceed but limit the audit to ISMS Clauses 4 to 7 and assign Annex A to a different auditor
4. D. Decline because demonstrated sector competence creates an independence conflict

After interviews and document review, the auditor concludes that the organisation's risk treatment plan does not address two risks rated 'high' in the assessment. Under ISO 19011:2018 and ISO/IEC 27001:2022, this is most precisely described as:

1. A. An audit finding that may or may not be a nonconformity, pending evaluation
2. B. A nonconformity against Clause 6.1.3 of ISO/IEC 27001:2022
3. C. Audit evidence requiring further investigation
4. D. An opportunity for improvement to be noted in the report

ISO/IEC 27001:2022 Clause 9.2 addresses internal audit. Which statement is correct?

1. A. Internal audits may be replaced by external surveillance audits where a certified ISMS is in scope
2. B. The organisation shall conduct internal audits at planned intervals against its own ISMS requirements and the standard
3. C. Internal audits must follow ISO 19011:2018 exactly, including the audit programme structure
4. D. The organisation should conduct internal audits at least annually as a recommended practice

An audit team is being assembled for a Stage 2 audit of a fintech ISMS. The most senior auditor available holds an information-security qualification and has twelve years of financial-services security experience, but she conducted internal ISMS audits for the same fintech's parent company three years ago. According to ISO 19011:2018 and ISO/IEC 17021-1:2015, the most accurate framing of her status is:

1. A. Both competence and independence are established by the twelve years of financial-services experience
2. B. Her competence is in question because financial-services audits require additional sector-specific qualifications regardless of experience
3. C. Her independence is not in question because three years exceeds the impartiality cooling-off window for internal-audit work, so the only remaining concern is competence
4. D. Her competence is established by qualification and experience; her independence with respect to this specific client is a separate question for the certification body to evaluate

After the audit team completes evaluation of all findings, they prepare a single statement summarising whether the management system fulfils the audit criteria. Per ISO 19011:2018, this statement is the:

1. A. Audit finding
2. B. Audit conclusion
3. C. Audit observation
4. D. Audit report

ISO/IEC 27001:2022 Clause 7.5 covers documented information. Which statement is correct?

1. A. Documented information must follow ISO 30301:2019 records-management requirements
2. B. The ISMS should include all Annex A control documentation regardless of applicability
3. C. The ISMS shall include documented information required by the standard and that determined by the organisation as necessary
4. D. Documented information may be omitted where the organisation can demonstrate equivalent oral practices

An auditor evaluator is reviewing a new lead-auditor candidate who has completed Lead Auditor training, holds an ISO/IEC 27001 implementer certification, and has audited three ISMSes as a team member. Under ISO 19011:2018 Clause 7, the candidate's status is best described as:

1. A. Competence is conditional on completing one further audit as team leader before lead-auditor sign-off
2. B. Competence is demonstrated for lead auditor; impartiality of any specific assignment is a separate evaluation
3. C. Both competence and independence are demonstrated together by the training certificate
4. D. Independence is the deciding factor; training and experience are secondary to absence of conflict

During an interview, a system administrator states that backups are tested monthly. The auditor records the statement. To convert this into objective audit evidence under ISO 19011:2018, the auditor most appropriately:

1. A. Notes the statement and raises a nonconformity if records cannot later be located
2. B. Records the verbal statement and treats it as evidence sufficient for the finding
3. C. Requests records of recent backup-test results that the administrator can produce on the spot
4. D. Asks two other staff the same question and accepts a majority answer