Training, exams and certification
Training, exams and certification
Forty questions, closed book, seventy per cent to pass. Two domains with exactly the same weight: the concepts of information security risk management, and the approaches and processes that put them to work.
Reviewed by GoToCertify’s accredited trainers
The PECB ISO/IEC 27005 Foundation exam checks that you know the vocabulary, the concepts and the process of information security risk management as ISO/IEC 27005 describes them, in support of an ISO/IEC 27001 information security management system.
| Questions | 40, multiple choice with three options each |
|---|---|
| Duration | 1 hour |
| Pass mark | 70% — 28 of 40 |
| Materials | Closed book — no reference material allowed |
| Delivery | Online in the PECB Exams app with a remote invigilator, or on paper at a PECB partner’s site |
| Retakes | One free retake within 12 months for candidates trained by a PECB partner (included in our Exam Bundle) |
| Non-native language | 10 additional minutes for Foundation exams taken on paper, on request |
| Typical course | Two days, with the exam at the end of the second |
| Credential | PECB Certificate Holder in ISO/IEC 27005 Foundation — no professional experience required |
Weights from PECB’s candidate handbook for this exam:
| Fundamental concepts of information security risk management | 20 questions · 50% | |
| Information security risk management approaches and processes | 20 questions · 50% |
The first half is definitions and principles: risk, risk source, event, consequence, likelihood, risk owner, residual risk, and how ISO/IEC 27005 relates to ISO/IEC 27001 and ISO 31000. The second half is the process: context and criteria, risk identification, analysis and evaluation, treatment, acceptance, communication and monitoring.
Twenty-eight correct answers means you can drop at most six questions in each half, or twelve in one half and none in the other. In practice neither half can be treated as optional.
Learn the terms exactly. A closed-book paper with three options per question is decided by precise definitions: two of the options are often both plausible, and only one matches the wording of the standard.
Know the two identification approaches. ISO/IEC 27005:2022 describes event-based and asset-based risk identification; expect to be asked which one fits a situation.
Keep the four treatment options apart. Modification, retention, avoidance and sharing: a scenario is often enough to tell them apart if you know what each one changes.
Forty multiple-choice questions, with three options each.
70 per cent, which is 28 of 40.
No. The Foundation exam is closed book.
No. The Foundation credential has no experience requirement.
No. Both can be taken directly; Foundation is useful if the subject is new to you.
Sources. Every figure on this page comes from PECB’s published certification scheme for ISO/IEC 27005:2022, candidate handbooks, brochures and certification pages, checked in October 2026.
The PECB Exam Bundle is on sale here: exam voucher, Learning Resource Kit and a retake, €370 excl. VAT. Not sure yet? Try 10 free practice questions first.
See the Exam Bundle
BITIL.COM is an Authorized Reseller and Silver Partner of PECB.
