TCK-ISO27001 Practice Test

TCK-ISO27001 practice test: what's covered

• ISMS
• Annex A controls
• risk management
• audit
• certification

Free TCK-ISO27001 sample questions

1. A client asks your implementation team to confirm when ISO/IEC 27001:2022 was published and the deadline by which existing certificates had to transition from the 2013 edition. Which response is accurate?

   • A. Published in October 2022, with all 2013 certificates required to transition by 31 October 2025
   • B. Published in October 2013, with no transition deadline ever set for accredited certificates
   • C. Published in October 2022, replacing the standard immediately with no transition period at all
   • D. Published in October 2020, with certificates allowed to remain on the 2013 edition indefinitely
   Show answer

   Correct: A. ISO/IEC 27001:2022 was published on 25 October 2022, and accredited bodies set 31 October 2025 as the final transition deadline, after which 2013 certificates became invalid. The 2013 option is incorrect because that was the previous edition, not the current one. The no-transition-period option is wrong because accreditation rules always grant a defined window. The 2020 option is simply a fabricated date with no basis.

2. During a kickoff workshop you must explain to stakeholders the principal structural differences introduced in ISO/IEC 27001:2022 compared with the 2013 edition. Which statements correctly describe those changes? (Choose THREE)

   • A. Annex A controls were reduced from 114 to 93 and regrouped into four thematic categories
   • B. Eleven entirely new Annex A controls were added, including threat intelligence and secure coding
   • C. Annex A controls are now organised under organizational, people, physical and technological themes
   • D. The mandatory management-system clauses 4 to 10 were entirely removed from the 2022 edition
   • E. Certification against the 2022 edition no longer requires a Statement of Applicability document
   Show answer

   Correct: A and B and C. The 2022 edition reduced Annex A from 114 to 93 controls, added 11 new controls such as threat intelligence and secure coding, and regrouped controls under four themes. The clause-removal option is incorrect because clauses 4 to 10 remain mandatory and largely unchanged. The SoA option is wrong because the Statement of Applicability is still a mandatory documented requirement of Clause 6.1.3.

3. A new implementer claims the four Annex A 2022 themes contain equal numbers of controls. Reviewing the standard, which distribution of the 93 controls across the themes is correct?

   • A. Organizational 37, People 8, Physical 14, Technological 34, totalling 93 controls
   • B. Organizational 14, People 37, Physical 34, Technological 8, totalling 93 controls
   • C. Organizational 25, People 25, Physical 25, Technological 18, totalling 93 controls
   • D. Organizational 8, People 14, Physical 37, Technological 34, totalling 93 controls
   Show answer

   Correct: A. Annex A 2022 distributes its 93 controls as Organizational 37, People 8, Physical 14 and Technological 34. The second option scrambles those values onto the wrong themes. The equal-split option is incorrect because the themes are deliberately unequal, with the smallest being People. The fourth option also misassigns the counts, placing the largest figures on physical security rather than organizational controls.

4. Your organization wants to integrate its ISMS with an existing ISO 9001 quality system. Explaining why this is feasible, which feature of ISO/IEC 27001:2022 supports such integration?

   • A. It uses the harmonized Annex SL high-level structure shared by other management-system standards
   • B. It mandates that the ISMS scope must always equal the quality-system scope exactly
   • C. It removes all documented-information requirements so both systems share zero records
   • D. It forbids organizations from operating more than one certified management system concurrently
   Show answer

   Correct: A. ISO/IEC 27001:2022 follows the Annex SL harmonized structure used by ISO 9001, ISO 14001 and others, which enables an integrated management system with shared clauses for context, leadership and improvement. The equal-scope option is incorrect because scopes may legitimately differ. The zero-records option is wrong because documented information is still required. The forbidding option contradicts the standard, which actively encourages integration.

5. A consultant is drafting the ISMS scope statement under Clause 4.3 for a fintech company. Which inputs must be considered when determining the boundaries and applicability of the ISMS? (Choose THREE)

   • A. The external and internal issues identified under Clause 4.1 context analysis
   • B. The requirements of interested parties determined under Clause 4.2
   • C. The interfaces and dependencies with activities performed by other organizations
   • D. The personal share portfolios held privately by individual board members
   • E. The marketing campaign calendar published by the sales department this quarter
   Show answer

   Correct: A and B and C. Clause 4.3 explicitly requires the scope to consider 4.1 issues, 4.2 interested-party requirements, and the interfaces and dependencies with other organizations. The board members' private portfolios are irrelevant because they fall outside the organization's information assets. The marketing calendar is incorrect because it is an operational artifact, not a determinant of ISMS boundaries.

Last updated: 2026-10-19

TCK-ISO27001 practice test FAQ