100+ Free ISO/IEC 27002 Manager Practice Questions

The exam contains 60 multiple-choice questions to be completed in 2 hours, with a passing score of 70%. It is open-book: you may use a hard copy of the ISO/IEC 27002 standard, your training course materials, personal notes, and a printed dictionary. Questions include stand-alone items and scenario-based sets. The exam is taken online via the PECB Exams application or paper-based at authorised partner venues. Note that official PECB multiple-choice questions present three answer options.

No. This is an independent English-language MCQ study adaptation, not an official PECB simulation. The official exam presents 60 questions with three answer options each in an open-book, proctored setting, while this bank uses 100 four-option questions for practice. It is designed to build the knowledge the official competency domains assess, but passing it does not guarantee passing the official exam, and it is not affiliated with or endorsed by PECB.

ISO/IEC 27001 is the requirements standard: it specifies what an ISMS must do (clauses 4-10) and is the standard an organization is certified against. ISO/IEC 27002 is the guidance standard: it explains how to implement information security controls, including the 93 controls referenced in Annex A of ISO/IEC 27001. The PECB ISO/IEC 27002 Manager exam focuses on implementing and managing those controls, while expecting you to understand the ISMS context in which they operate.

The 2022 edition contains 93 controls organized into four themes: 37 organizational controls (clause 5), 8 people controls (clause 6), 14 physical controls (clause 7), and 34 technological controls (clause 8). Each control also carries attributes for control type (preventive, detective, corrective), security properties (confidentiality, integrity, availability), cybersecurity concepts aligned to the NIST functions (identify, protect, detect, respond, recover), operational capabilities, and security domains, allowing organizations to filter controls by different perspectives.

After passing the exam, the full Manager credential requires two years of professional experience (including one year in information security management), 200 hours of information security management activities such as drafting an ISMS implementation plan or selecting and implementing controls, and signing the PECB Code of Ethics. A Provisional Manager credential is available with no experience requirement, so passing the exam alone still yields a credential. Certifications are valid for three years, maintained with CPD hours and an annual maintenance fee.

You can retake the exam with no limit on the number of attempts, but you must wait 15 days after a failed first attempt. If you took the training course with a PECB partner, your fee includes one free retake within 12 months from the date the coupon code was received. Candidates who fail receive a list of the domains where they performed poorly to guide further study, and PECB recommends attending a training course if you fail the retake.