Public revision guide

ISO 27001:2022 revision guide, practice questions and mock exams

Learn to connect a situation to the ISMS requirement, missing evidence and a defensible decision. This guide supports students and people preparing to participate in audits.

What to study and what the numbers mean

The preparation selects 30 study topics from clauses 4–10, not 30 questions or an official count of every requirement. A separate block adds introductory clauses 1–3: scope, normative references, and terms. They are not presented as optional or excluded requirements.

ISO 27001 vs ISO 27002

ISO 27001 sets requirements for an information security management system (ISMS). ISO 27002 explains information security controls and their application. Control selection must be justified against risks and applicable requirements, not by treating all 93 as mandatory. ISMS certification is assessed against ISO 27001, not by answering these questions.

How to prepare for practice

Start with context, scope and leadership (4–5). Distinguish the scope of the standard from the boundaries of an organization’s ISMS.
Connect planning, support and operation (6–8). For example, 6.1.2 defines the risk assessment process; 8.2 requires assessments to be performed and their results retained.
Review performance evaluation and improvement (9–10). Complete a short practice, explain why other references fit less well, then use a 20-, 40- or 60-question mock exam with correction at the end.

Sample question with an explained answer

Fictional situation and data created by Nexsora. Consult the complete text in an authorized copy of the standard.

A company schedules four internal audits. In two, the people reviewing the work also performed it. Which reference should you check to ensure objectivity and impartiality when organizing the audits?

Reasoned answer

9.2.2, internal audit programme. Scheduling dates is not enough: criteria and scope must be set and auditors selected to support objective and impartial evaluation. The figure of two audits alone does not establish a nonconformity; check responsibilities, safeguards and facts.

What to verify

Request the programme, criteria, scope, auditor assignments and evidence of how impartiality is protected. 9.2.1 explains the purpose of auditing; 9.3 concerns management review, which does not replace an internal audit.

Common distinctions to get right

Do not confuse approval of a risk treatment plan (6.1.3) with evidence that it was implemented (8.3). Identify the activity actually described in the case.
Requirements in clauses 4–10 cannot be excluded when claiming conformity. Justified exclusions of Annex A controls belong in the statement of applicability and are a different matter.

Go to ISO practice questions and mock exams

Select the standard in the practice area. Sign in to save attempts and try the free sample; full modes require current access or an administrator role.

ISO 27002:2022: 93 controls, practice questions and examples

Official source and editorial scope

Official ISO/IEC 27001 information (external site; opens a new tab)

Study baseline: the 2022 editions, excluding the 2024 amendments. ISO 27001 defines ISMS requirements; ISO 27002 provides control guidance. Not every control is mandatory: selection must be justified by risks and applicable requirements. Material is available in Spanish, English, Brazilian Portuguese and French. Quechua and Aymara retain Spanish support. Translations and content await independent specialist editorial review; they are not official versions of the standards.

Original, independent Nexsora material. This is not an official exam, does not grant ISO certification and is not endorsed by ISO. Explanations do not replace an authorized copy of the standards.

Historical reading of the 2022 edition: it refers to ISO/IEC 27000 as overview and vocabulary. ISO replaced the 2018 edition with ISO/IEC 27000:2026, now focused on concepts and relationships rather than a complete vocabulary. For current implementation, verify applicable editions and current terminology sources; these exercises do not incorporate that change or the 2024 amendment.