About 6 hours of daytime study a day, weighted toward domains 4 and 5, which carry 56 of the 80 marks. Evenings stay free for other work.
40 questions, 80 marks, 1 h 45 min, open book. Question types: single choice, multiple choice, drag and drop, and dropdowns (fill-in and put-in-order). To pass you need 40/80 overall and the minimum in every domain. One weak domain fails the exam even if the total is fine.
| Domain | Marks | Qs | Min to pass | Time | Main source |
|---|---|---|---|---|---|
| 1 · Concepts & principles of management systems | 8 | 6 | 3 (38%) | 10 min | 27001 clauses 4–10 |
| 2 · Audit concepts & auditor responsibilities | 8 | 6 | 3 (38%) | 10 min | 19011 cl. 4, 5, 7 |
| 3 · Planning the audit | 8 | 6 | 3 (38%) | 10 min | 19011 6.2–6.3 |
| 4 · Conducting the audit | 36 | 14 | 14 (39%) | 45 min | 19011 6.4 + Annex A |
| 5 · Reporting & closing out | 20 | 8 | 8 (40%) | 30 min | 19011 6.4.10–6.7, NCs |
Practice target: 65% or more exam-weighted, with every domain at 50% or more. That leaves a margin over the per-domain minimums.
Enter the five domain percentages from the CQI report and the page weights them the way the real exam does (8/8/8/36/20). SkillCertPro has no domains, so enter its overall % instead.
No mocks logged yet.
Only paste the questions you got wrong or guessed. Tag each with its domain (1–5) and one line on why your answer was wrong. CQI questions already sit in a domain; for SkillCertPro, pick the domain yourself using the table above. Review days run off these tags.
Focus areas from the Group 2 plan and what to cite when you write checklists and nonconformities:
| Focus area | What the case shows | Cite |
|---|---|---|
| Cloud governance | CSP holds encryption keys and root access; monitoring reports not actioned; no DR until 2022 | A.5.23, A.8.24, A.5.30 |
| Legacy media | Unencrypted pre-2010 backup tapes; faulty tapes disposed insecurely | A.7.10, A.7.14, A.8.13 |
| Test data | Live customer account data used in application testing | A.8.33, A.8.31 |
| Access management | Leavers keep remote access; quarterly reviews missed; contractor access | A.5.18, A.6.5, A.8.2 |
| Incident management | Incidents not registered; dark-web leak not acted on; no Federal Reserve reporting | A.5.24–5.26, A.5.31, 10.2 |
| Physical & environmental | Vault camera not working; tape backup server on a cardboard box in a flood zone; generator untested | A.7.4, A.7.8, A.7.11 |
| Malware & licensing | Antivirus gateway licence lapsed; cracked software; informal password-cracking tool | A.8.7, A.5.32, A.8.19 |
Nonconformity format: requirement (clause/control and what it says) → evidence (what you saw, who, where) → statement (the gap). Then grade it major or minor and say why.
Loading saved progress…