PECB is one of the leading issuers of ISO/IEC 27001 Lead Auditor certifications globally. Most candidates approaching the exam have done the official PECB-accredited training course and are now staring down a specific question: what exactly does the PECB exam look like, and what does it test?
This guide is the candidate’s-eye view of the current (2026) PECB ISO/IEC 27001 Lead Auditor exam, verified against the PECB Candidate Handbook v1.5. If you are sitting with CQI/IRCA, Exemplar Global, TRECCERT or BSI, much of this still applies - the underlying standards are identical - but the exam mechanics differ. The trap patterns we cover are the ones PECB exams reuse.
The exam at a glance
questions
minutes
mark
proctored
- 80 multiple-choice questions with three options each (one correct, two distractors). A mix of stand-alone questions and scenario-based sets - each scenario is a short company case, followed by five linked questions that all draw on that scenario.
- 3 hours (180 minutes) - works out to a brisk ~2.25 minutes per question, with the scenario sets adding a few minutes of reading on top.
- Open-book. PECB explicitly allows three reference items: a hard copy of ISO/IEC 27001, your training course materials, and any personal notes taken during the training course (via the PECB Exams app or printed).
- 70% to pass. Below that is a fail. Some PECB-accredited courses bundle a re-sit attempt - check with your training partner.
- Remote-proctored (online) or paper-based in-person via your PECB-accredited training partner. Online uses the PECB Exams application with continuous webcam supervision.
The 80-question multiple-choice format is recall-light, recognition-heavy. Half the exam (~40 questions) tests evaluation - “given this scenario, which answer is correct?” - not “what does Clause 6.1.3 say?” Pure memorisation does not get you across the line. You need clause-application judgement under time pressure.
The seven competency domains, weighted
PECB distributes the 80 questions across seven competency domains, with explicit weights published in the candidate handbook. The domains are not equally weighted. Calibrating prep against the actual weights leaves marks on the table.
PECB 27001 LA verified domain weighting (Candidate Handbook v1.5)
- Fundamentals of an ISMS (13 questions / 16.25%) - what an ISMS is, why 27001 exists, the PDCA cycle, the High-Level Structure.
- ISMS and ISO/IEC 27001 requirements (8 questions / 10%) - the 27001:2022 main-body clauses 4-10 in operational detail.
- Fundamental audit concepts and principles (14 questions / 17.5%) - ISO 19011 vocabulary, the seven audit principles, audit evidence types.
- Preparing an ISO/IEC 27001 audit (12 questions / 15%) - audit plan, criteria, feasibility, audit team selection.
- Conducting an ISO/IEC 27001 audit (18 questions / 22.5%) - opening meeting, evidence gathering, interview technique, findings. Biggest single chunk of marks.
- Closing an ISO/IEC 27001 audit (7 questions / 8.75%) - report drafting, distribution, follow-up.
- Managing an ISO/IEC 27001 audit programme (8 questions / 10%) - the programme-manager view, multi-audit coordination.
Domain 5 (Conducting) alone is worth more than 1 in every 5 questions. Front-load it.
Half the exam tests comprehension/application/analysis; the other half tests evaluation. The evaluation half is where scenario-based questions cluster.
Three things PECB tests harder than other providers
PECB-specific
Scenario sets - five questions, one mistake
Each scenario-based set is a single short case followed by five linked questions. If you misread the scenario, you can lose all five. The scenarios are paragraphs long and embed details that the questions interrogate one at a time (the policy was published but not communicated, the auditor noted X but did not record Y, etc.). Read the scenario twice before touching the questions.
PECB-specific
ISO/IEC 17021-1 alongside 27001
Most providers test ISO/IEC 27001 and ISO 19011. PECB also tests ISO/IEC 17021-1:2015 - the requirements for bodies providing audit and certification of management systems. Candidates often miss this. The questions that draw on 17021-1 tend to live in Domains 3, 4 and 7.
If your course materials are light on 17021-1, supplement with the standard itself. Tab the impartiality requirements (clause 5), the competence requirements (clause 7), and the certification-process requirements (clause 9).
PECB-specific
Vocabulary distractors that look identical
PECB distractor pairs are written to look almost identical to the correct answer, differing by a single keyword - “audit evidence” vs “audit finding”, “shall” vs “should”, “observation” vs “nonconformity”, “first-party” vs “second-party”. You can know the standard cold and still pick the wrong option if you skim. The MCQ format rewards careful reading more than recall depth.
Bank a clean mental copy of ISO 19011:2018 Clause 3 (Terms and definitions) before exam day. Knowing the exact PECB vocabulary closes those distractor pairs in one pass.
Specifically, drill the four Annex A control families:
- 5.X Organisational controls - policies, roles, supplier management, ISMS in practice.
- 6.X People controls - background checks, awareness, employment lifecycle.
- 7.X Physical controls - secure areas, equipment.
- 8.X Technological controls - cryptography, access control, secure development.
Knowing which family a given scenario lives in is faster than searching through 93 numbered controls under time pressure.
Open-book strategy
Most candidates hear “open book” and relax. They should not. Three hours for 80 questions is not enough to look up everything you do not remember.
The rule
Open-book means you can verify, not learn.
PECB explicitly allows three reference items: a hard copy of ISO/IEC 27001, your training course materials, and any personal notes taken during the training course (via the PECB Exams app or printed). Pre-tab the main-body clauses you know come up - 4.3 scope, 6.1.3 risk treatment + SoA, 7.5 documented information, 9.2 internal audit, 9.3 management review, 10.2 nonconformity. Pre-tab Annex A by control family (5.X, 6.X, 7.X, 8.X).
Look up to verify, not to learn. If you genuinely do not know an answer, flag and move on, then come back. The candidates who fail PECB Lead Auditor are usually the ones who looked up everything and ran out of time on the last ten questions.
Time management on the PECB format
180 minutes for 80 questions = 2.25 minutes per question on average. Scenario sets eat a few extra minutes for the scenario read; stand-alone items move faster.
(answer obvious ones)
(flagged + look-ups)
(verify scenario sets)
(do not skip)
The buffer matters: many candidates lose marks on the last block of scenario questions because they ran the clock against themselves and rushed the read.
The single most important PECB-specific tip
For scenario sets, read the scenario in full before looking at any of the five questions. Mark the details that look like findings or nonconformities as you read. Then attack the five questions in order. Misreading the scenario costs you five marks at once - the single biggest avoidable mistake on the PECB exam.
What about ISO 27002?
ISO/IEC 27002:2022 is the implementation guidance for the Annex A controls. PECB exam questions occasionally reference 27002 directly for the “why” behind a specific control’s implementation. Most candidates underdo it because their course materials focus on 27001.
You do not need to memorise 27002. You need to know where to look. Pre-tab 27002 by Annex A family (Organisational, People, Physical, Technological) so when a scenario asks about a specific control’s implementation, your finger lands on the right page in seconds.
The 2-to-4-week plan, PECB-specific
If you are 2 weeks out from the PECB exam:
- Days 1-4: Go through your PECB course material end-to-end - the slides, handouts, exercises from the five-day course. Most candidates need ~4 focused days for this. Skim ISO 17021-1 once if you have not, and mark the clauses you feel least sure on as you go. Front-load Domain 5 (Conducting the audit) reading - it is the heaviest-weighted domain.
- Days 5-8: Active retrieval only. Drop the re-reading. Scenario-based MCQ practice in Mindset Prep, drilling the vocabulary-distractor traps and the scenario-set rhythm. (10 free per exam are on this site.)
- Days 9-11: One full 80-question timed mock under exam conditions. Score yourself honestly against the 70% mark. Note which domains you lost most marks in.
- Days 12-13: Targeted re-read of the course-material sections + clauses you got wrong, plus a glossary review of ISO 19011 Clause 3. Drill the trap patterns Mindset Prep surfaced in the mock.
- Day 14: Light review, light exercise, early sleep. Do not study the night before.
If you are 4 weeks out, double the active-retrieval phase and add a second full mock.
On exam day
- Government-issued photo ID required. Have it on the desk.
- Camera on the entire time (online sittings). The proctor monitors continuously.
- Workspace must be clear other than your pre-tabbed printed standard, course material, and personal notes (or these uploaded via the PECB Exams app). Check your booking confirmation for the specifics of your sitting.
- Bathroom breaks are permitted but the clock keeps running.
- Submission is electronic into the PECB Exams application. Online MCQ candidates receive instant results.
Online MCQ results arrive immediately. Paper-based sittings take two to four weeks for results. You receive pass/fail plus, if you fail, a domain-level breakdown that helps you understand where you lost marks for the re-sit.
After you pass
PECB certification renewal requires CPD (continuous professional development) credits. Mindset Cyber’s ISO 27001 courses include CPD credits that count towards renewal. Your initial certification is valid for three years; staying current requires periodic re-attestation.
The credential opens doors. Walking into an audit role with a clean PECB Lead Auditor in the signature line is a strong market signal in Australia, the EU, the UAE, and most of Asia. Keep the credential current.
Where to start
Try the 10 free ISO 27001 Lead Auditor practice questions. Each is a PECB-style multiple-choice item tagged with the trap pattern it tests and the exact 27001 or 19011 clause it draws from. If three or more catch you out, the full Mindset Prep bank gives you 400+ SME-verified questions across all seven PECB domains, with the scenario sets drilled at the same rhythm the real exam uses. The 3-day free trial gets you in.