Final step · 20 questions · pass mark 80%

Final exam and certificate

The ISO/IEC 27090 final exam draws 20 questions at random from a pool covering all ten lessons: the scope and structure of the standard, the twelve AI security threats, their detection and mitigation, the life cycle and roles, and implementation. A score of 80 percent or higher, after every lesson quiz has been passed, issues a certificate of completion with a verification code.

Lessons passed

0 / 10

Best exam score

Not taken

Certificate

Locked

Lessons still to pass

You can attempt the exam now, but the certificate is issued only once every lesson quiz has been passed with 4 of 5.

  1. 1. What is ISO/IEC 27090:2026?
  2. 2. Why AI systems need their own security guidance
  3. 3. The AI life cycle and who is responsible
  4. 4. Where ISO/IEC 27090 fits: standards, frameworks and regulation
  5. 5. The threat catalogue: how ISO/IEC 27090 classifies threats
  6. 6. Data and model threats: poisoning, evasion and model theft
  7. 7. Information exposure threats: inference, inversion and sensitive output
  8. 8. Prompt injection and output attacks
  9. 9. Mitigations and how controls interact (Clause 7)
  10. 10. Implementing ISO/IEC 27090 in your organization
  11. Final exam and certificate

The exam

Answer all 20 questions, then check. Explanations appear for every question. A retake draws a fresh set from the pool.

Preparing your question set.

Your certificate

Preview below. The watermark clears once all lessons are passed and the exam is passed.

CERTIFICATE OF COMPLETIONThis certificate is presented toYour Namefor completing the ten-lesson course and passing the final examinationISO/IEC 27090 Explained: Securing AI Systemscovering the scope of ISO/IEC 27090:2026, the twelve AI security threats, their detectionand mitigation, the AI life cycle, and implementation within ISO/IEC 27001.EXAMINATION SCORE 0%202618 October 2026DATE OF ISSUEShahzad AsgharCOURSE AUTHORISO27090-XXXX-XXXXXshahzadasghar.com/learn/iso-27090Self-directed learning record issued by the course author. Not an accredited qualification. Not issued by or affiliated with ISO or IEC.PREVIEW

About the exam and certificate

How does the final exam work?
Twenty questions are drawn at random from a pool covering all ten lessons. You need 80 percent, sixteen correct answers, to pass. Every answer is explained after you submit, and you can retake the exam as often as you like with a fresh draw of questions.
Do I have to complete the lessons first?
Yes. The certificate is issued only when every lesson quiz has been passed and the exam score is at or above the pass mark. You can preview the exam questions at any time; the certificate stays watermarked until both conditions are met.
What does the certificate contain?
Your name, the course title, the date of issue, your exam score, a certificate number and a QR code. The QR code opens a verification view on this site that decodes the certificate details from the code itself.
Is the certificate accredited?
No. It is a record of self-directed learning issued by the course author, Shahzad Asghar. It is not an accredited qualification and it is not issued by or affiliated with ISO or IEC. It is suitable for a learning record, a LinkedIn post or internal professional development evidence.
Where is my progress stored?
In your browser only. Nothing is sent to a server. Use the same browser and device to continue, and download your certificate once issued, because clearing site data removes the record.

Shahzad Asghar

Senior IT Strategy and Portfolio Officer at UNRWA, with more than twenty years building and securing data and AI systems across UN agencies. He holds the CISM and CISSP security certifications and writes on AI governance, AI security and assurance, and digital transformation. Connect on LinkedIn.

This course is an independent educational resource by Shahzad Asghar. It is not affiliated with, endorsed by or published by ISO or IEC. ISO/IEC 27090:2026 is copyrighted and is sold through the ISO Store and national standards bodies; this course summarises it and does not reproduce its text. Last reviewed: .