Free ISO 37001 Lead Implementer Exam Questions and Answers

Last updated: September 7, 2026

Provider

PECB

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   What is a good security method to prevent unauthorized users from "tailgating"?

   • A. Electronic key systems
   • B. Man trap
   • C. Pick-resistant locks
   • D. Electronic combination locks
   Reveal Answer

2. Question #2

   Kyle is performing the final testing of an application he developed for the accounting department. His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command. What is he testing at this point? include #include int main(int argc, char *argv[]) { char buffer[10]; if (argc < 2) { fprintf(stderr, "USAGE: %s string\n", argv[0]); return 1; } strcpy(buffer, argv[1]); return 0; }

   • A. Buffer overflow
   • B. Format string bug
   • C. Kernal injection
   • D. SQL injection
   Reveal Answer

3. Question #3

   Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet?

   • A. Poison the switch's MAC address table by flooding it with ACK bits
   • B. Enable tunneling feature on the switch
   • C. Trick the switch into thinking it already has a session with Terri's computer
   • D. Crash the switch with a DoS attack since switches cannot send ACK bits
   Reveal Answer

4. Question #4

   What is a difference between host-based intrusion detection systems (HIDS) and network-based intrusion detection systems (NIDS)?

   • A. NIDS are usually a more expensive solution to implement compared to HIDS.
   • B. Attempts to install Trojans or backdoors cannot be monitored by a HIDS whereas NIDS can monitor and stop such intrusion events.
   • C. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual
   • D. HIDS requires less administration and training compared to NIDS.
   Reveal Answer

5. Question #5

   A penetration test consists of three phases: pre-attack phase, attack phase, and post-attack phase. Active reconnaissance which includes activities such as network mapping, web profiling, and perimeter mapping is a part which phase(s)?

   • A. Post-attack phase
   • B. Pre-attack phase and attack phase
   • C. Attack phase
   • D. Pre-attack phase
   Reveal Answer

6. Question #6

   What does ICMP Type 3/Code 13 mean?

   • A. Host Unreachable
   • B. Port Unreachable
   • C. Protocol Unreachable
   • D. Administratively Blocked
   Reveal Answer

7. Question #7

   Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

   • A. %systemroot%\LSA
   • B. %systemroot% epair
   • C. %systemroot%\system32\drivers\etc
   • D. %systemroot%\system32\LSA
   Reveal Answer

8. Question #8

   Firewall and DMZ architectures are characterized according to its design. Which one of the following architectures is used when routers have better high- bandwidth data stream handling capacity?

   • A. Weak Screened Subnet Architecture
   • B. "Inside Versus Outside" Architecture
   • C. "Three-Homed Firewall" DMZ Architecture
   • D. Strong Screened-Subnet Architecture
   Reveal Answer

9. Question #9

   Identify the type of firewall represented in the diagram below:

   • A. Stateful multilayer inspection firewall
   • B. Application level gateway
   • C. Packet filter
   • D. Circuit level gateway
   Reveal Answer

10. Question #10

    Hackers today have an ever-increasing list of weaknesses in the web application structure at their disposal, which they can exploit to accomplish a wide variety of malicious tasks. New flaws in web application security measures are constantly being researched, both by hackers and by security professionals. Most of these flaws affect all dynamic web applications whilst others are dependent on specific application technologies. In both cases, one may observe how the evolution and refinement of web technologies also brings about new exploits which compromise sensitive databases, provide access to theoretically secure networks, and pose a threat to the daily operation of online businesses. What is the biggest threat to Web 2.0 technologies?

    • A. SQL Injection Attacks
    • B. Service Level Configuration Attacks
    • C. Inside Attacks
    • D. URL Tampering Attacks
    Reveal Answer