- The Honest Difficulty Verdict
- What You Are Actually Facing: Format and Mechanics
- Where Candidates Struggle: The Ten Domains Ranked by Friction
- Worked Scenarios: Risk Math, Cloud, and Recovery
- The Legacy-Content Trap
- How Much Background Do You Need?
- Difficulty Compared With Security+ and the Other "ITS"
- Test-Day Conditions That Add Difficulty
- A Domain-Ordered Preparation Plan
- The Retake Safety Net
- Frequently Asked Questions
- The exam is 100 written questions in two hours, with a 75% passing score and no hands-on component.
- ETA publishes ten competency areas but no percentage weights, so you cannot over-invest in a "heavy" domain.
- No issuer-wide pass rate has been verified; a 75% cut score is a threshold, not a pass rate.
- One eligible free retake is available after a 30-day wait, within one year of the first exam.
The Honest Difficulty Verdict
The ETA Information Technology Security (ITS) exam is a moderately demanding, breadth-driven written test. It is not a lab exam, and it does not ask you to configure a firewall or crack a hash. What makes it challenging is the sheer spread of material: ten competency areas covering everything from network hardware and physical access control to cryptography and social engineering, all examined in one sitting of 100 questions.
Whether it feels hard depends almost entirely on your background. A working technician who already handles switches, wireless access points, and user accounts will find large parts familiar. A newcomer with no networking exposure will find the vocabulary, the acronyms, and the layered nature of the topics steep. ETA's own competency document recommends prior computer-systems and networking experience and prior IT or networking certification as preparation, which is a fair signal of the intended difficulty level.
What You Are Actually Facing: Format and Mechanics
Understanding the container makes the difficulty concrete. According to ETA's certification booklet and credential page, the ITS exam is a written knowledge examination with these characteristics:
| Element | Detail |
|---|---|
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Hands-on assessment | None |
| Exam fee | USD 105 |
| Certification term | Four years |
| Issuer | ETA International |
Two hours for 100 questions averages out to roughly 72 seconds each. That is comfortable for recall-style items but tighter for scenario questions that require reading a paragraph and calculating an answer. Passing at 75% means you can miss up to 25 questions; the margin is real but not generous, especially given ten domains that all feed the question pool.
ETA states that examination questions derive from its published competencies. That is genuinely helpful: the blueprint is public, so you are never guessing at scope. The difficulty lies in covering all of it, not in discovering what is covered. For the full registration and fee picture, see our ITS certification cost breakdown and our guide to the ITS passing score.
Where Candidates Struggle: The Ten Domains Ranked by Friction
Because ETA publishes no percentage weights for the ten domains, there is no official basis for calling one "most heavily tested." What we can offer is an editorial view of where candidates typically encounter friction, based on the nature of the content. Treat this as a study-planning aid, not an exam weighting. Our complete guide to all ten ITS content areas goes deeper on each.
Domain 9: Cryptography
Often the steepest for non-specialists because it mixes concepts, terminology, and process.
- Symmetric versus asymmetric encryption and when each is used
- Hashing and integrity versus encryption and confidentiality
- Public key infrastructure: certificate authorities, certificates, trust chains, and revocation
- Why a certificate proves identity binding rather than "safety"
Domain 7: Operational Standards, Policies and Risk Assessments
Hard because it is part vocabulary and part arithmetic. Expect quantitative risk concepts such as single loss expectancy (SLE), annualized rate of occurrence (ARO), and annualized loss expectancy (ALE), along with policy and standards language that rewards careful reading.
Domain 4: Wireless Security
Friction comes from the number of overlapping standards and the presence of legacy protocols alongside current ones. Candidates must understand why older wireless security methods are weak, not just recite their names.
Domain 5: Device Security
Spans endpoint hardening and the wider ecosystem of connected devices. Short-range technologies such as RFID, NFC, and Bluetooth, plus IoT devices, create scenario questions about what an attacker can realistically do and which control stops them.
Domain 8: Disaster Recovery and Computer Forensics
Two disciplines in one domain. Recovery questions reward knowing site types and recovery objectives; forensics questions reward understanding evidence handling and order of volatility reasoning.
The remaining domains are rarely a source of failure for working technicians. Domain 1 (Network Hardware Security Fundamentals), Domain 2 (Physical Security), Domain 3 (Network Software Security), Domain 6 (Software Exploitations and Vulnerabilities), and Domain 10 (Social Engineering) are conceptually accessible, though each has depth that punishes superficial study. Physical Security in particular surprises candidates who assumed an IT exam would be purely digital: expect surveillance, access control, and entry-point questions.
Worked Scenarios: Risk Math, Cloud, and Recovery
The questions that cost the most points are usually scenario-based. Here are original worked examples in the style candidates should practice.
Scenario 1: Calculating annualized loss expectancy
A server's total asset value is USD 50,000. A flood would destroy 40% of its value. Flooding of this kind is expected about once every four years. What is the ALE?
- SLE = asset value x exposure factor = 50,000 x 0.40 = USD 20,000
- ARO = one event every four years = 0.25 per year
- ALE = SLE x ARO = 20,000 x 0.25 = USD 5,000 per year
The trap is forgetting that ARO is a rate per year. A countermeasure costing USD 8,000 per year to prevent this loss would not be cost-justified on these numbers alone.
Scenario 2: Cloud shared responsibility
A company moves its customer database to an infrastructure-as-a-service virtual machine. A breach occurs because the guest operating system was never patched. Who is responsible? In the IaaS model, the provider secures the underlying facility, hardware, and virtualization layer, while the customer remains responsible for the guest operating system, applications, and data. The unpatched OS is the customer's responsibility. The exam tests whether you can place a failure on the correct side of the line as the service model changes.
Scenario 3: Choosing a recovery site
A business needs to resume operations within hours, and a duplicate environment with current data is already running elsewhere. That points to a hot site. A warm site has equipment but needs data restored and configuration work; a cold site provides space and utilities only. The question is nearly always about matching recovery time requirements to the cost and readiness of the site type.
Scenario 4: Physical access control
A visitor follows an employee through a badge-controlled door without presenting credentials. This is tailgating (also called piggybacking), and it spans two domains: it is a physical security failure and a social engineering technique. A mantrap or turnstile, which admits one person per authentication, addresses it directly. Expect the exam to blur the lines between domains this way.
The Legacy-Content Trap
One genuinely distinctive source of difficulty: ETA's competency document includes legacy security protocols and older standards editions. Many modern study resources skip anything deprecated, but a candidate preparing from a current-technology-only mindset can be blindsided by questions on protocols the industry has moved past.
The right approach is to learn legacy items in context. Do not just memorize that an older wireless or authentication method exists; understand what weakness led to its replacement. That "why it was superseded" framing converts a memorization burden into a reasoning skill, and it is exactly the kind of understanding a written exam can probe.
Key Takeaway
Use ETA's published 2024 competency objectives as your checklist, and treat every third-party resource as a supplement. If a study guide omits a legacy protocol that appears in the competency document, the document wins. See our ITS study guide for how to map resources to the blueprint.
How Much Background Do You Need?
Eligibility and recommendation are different things, and confusing them inflates perceived difficulty. ETA's competency document recommends prior computer-systems and networking experience and prior IT or networking certification. ETA's issuer badge page separately lists practicing-technician experience, a written examination, and acceptance of the Code of Conduct. The Stand-Alone route does not require Associate CET (CETa). Details on qualifying are in our ITS requirements guide.
In practical terms, the exam gets easier in proportion to hands-on exposure:
- Help-desk or field technicians usually know authentication, user accounts, and basic wireless already; the gap is typically cryptography, risk math, and forensics.
- Network technicians know hardware and protocols; the gap is policy, social engineering, and recovery planning.
- Career changers face the full surface area and should budget the longest preparation time.
If you are weighing whether the effort pays off professionally, read our ITS ROI analysis. Note that ETA's fact-sheet wage figures are labeled 2016 and its employment projections cover 2022-2032, so neither should be read as current salary evidence or a certification-specific pay premium.
Difficulty Compared With Security+ and the Other "ITS"
Two comparisons come up constantly, and a third source of confusion needs clearing up.
ETA ITS versus CompTIA Security+
These are different credentials from different issuers. ETA offers a rollover route: a valid CompTIA Security+ (ce) credential can be converted to ETA ITS for USD 105 with proof of the current certificate, though lifetime Security+ certificates are excluded. That rollover is an alternative way to obtain the credential, and it does not make any CompTIA syllabus the ETA ITS blueprint. Candidates who hold Security+ will find substantial topical overlap, but you should still check your knowledge against ETA's ten published competency areas if you plan to sit the ETA exam directly. For a related look at how the credentials fit together, see our ITS certification overview.
ETA ITS versus Certiport's Information Technology Specialist
Certiport offers its own "Information Technology Specialist" credentials, which are a separate family. Everything in this article refers to ETA's Information Technology Security (ITS) credential, administered by ETA International. If a study resource mentions Certiport exam codes or a different question count, it is not describing this exam.
| Factor | ETA ITS | Route notes |
|---|---|---|
| Format | 100 written questions, two hours | No hands-on assessment |
| Passing score | 75% | Threshold, not a pass rate |
| Direct exam fee | USD 105 | Remote proctoring adds USD 16 |
| Security+ rollover | USD 105 | Requires valid Security+ (ce); lifetime excluded |
| Term | Four years | Maintenance required |
Test-Day Conditions That Add Difficulty
Logistics can quietly raise or lower the difficulty. Testing is arranged with an ETA Certification Administrator through Trapeza online testing or paper and pencil, and remotely proctored testing is available through ExamRoom.AI after you register with ETA. Remote testing adds USD 16 for this two-hour exam, and initial scheduling can take up to 72 hours, so do not leave booking to the last minute. Our ITS exam dates and scheduling guide covers timing in more detail.
For remote sessions you need a working webcam, microphone, a recent computer, and at least 3 Mbps internet. Photo ID is required. Scratch paper and non-programmable or scientific calculators are permitted, which matters for the ALE and related risk arithmetic; used scratch paper must be surrendered, phones are prohibited, and you may not leave the room once testing starts. A two-hour exam with no breaks is a stamina factor, so plan accordingly.
Results display immediately on Trapeza, so you will know the outcome as soon as you finish.
A Domain-Ordered Preparation Plan
Rather than a generic schedule, sequence your study by dependency: later domains reuse earlier vocabulary. This ordering assumes a candidate with moderate networking exposure and roughly six weeks; stretch or compress as your background demands.
Foundations: Domains 1 and 2
- Network hardware security fundamentals
- Physical security: surveillance, access control, tailgating countermeasures
- Build a glossary now; every later week reuses it
Software and Wireless: Domains 3 and 4
- Network software security
- Wireless standards, including why legacy methods were replaced
Devices and Exploits: Domains 5 and 6
- Device security, RFID, NFC, Bluetooth, IoT
- Software exploitations and vulnerabilities
Governance: Domains 7 and 8
- Policies, standards, and risk assessment arithmetic (SLE, ARO, ALE)
- Recovery site types and forensics fundamentals
Cryptography and People: Domains 9 and 10
- Symmetric, asymmetric, hashing, PKI
- Social engineering techniques and defenses
Integration
- Timed 100-question practice sets under two-hour conditions
- Revisit your weakest two domains, not your strongest
Because ETA publishes no domain weights, give every domain a floor of coverage rather than skipping any. For a one-page recap to use in the final days, our ITS cheat sheet condenses the must-know facts.
About optional preparation products
Third-party products exist, and they vary in authority. For example, eITprep lists a CompTIA Security+ Study Guide for ETA ITS at USD 59.95 for six months, with two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Keep two distinctions straight: the 100 flashcards and the exam's 100 questions are unrelated counts, and 45 course contact hours describes course content, not exam timing, which is two hours. The public course description does not identify a Security+ exam edition, so map anything you use back to ETA's 2024 competency objectives. Unofficial question dumps and commercial listings carry even less authority than the issuer's blueprint. For structured practice, see our ITS exam prep practice tests and ITS training overview.
The Retake Safety Net
A large part of what makes an exam feel hard is the cost of failing. ETA softens that. After an unsuccessful attempt, one eligible free retake is available following a 30-day wait, and it must be completed within one year of the first exam. A remote retake still incurs the proctoring fee. Use the 30 days deliberately: your score report and your memory of which topics felt shaky are the best diagnostic you will get.
Key Takeaway
Treat the first attempt as a serious try, not a trial run, but know the free retake exists. Immediately after any sitting, write down every topic that felt uncertain while the questions are fresh, then rebuild those domains first.
Frequently Asked Questions
It is demanding for anyone without networking exposure because it covers ten broad competency areas in 100 questions. ETA recommends prior computer-systems and networking experience and prior IT or networking certification. Beginners should allow longer preparation and prioritize cryptography, risk calculations, and wireless standards.
No issuer-wide ITS pass rate has been verified. The 75% figure is the passing score you must achieve, not the share of candidates who pass. Treat any specific pass-rate claim without an ETA citation with caution.
No. It is a written knowledge examination with 100 questions and a two-hour limit, with no hands-on assessment. The difficulty comes from breadth and scenario reasoning rather than practical configuration tasks.
ETA's competency document lists ten domains but publishes no percentage weights, so no domain can be officially called heaviest. Because questions derive from all the competencies, study every area rather than betting on a few.
One eligible free retake is available after a 30-day wait and must be completed within one year of the first exam. A remote retake still incurs the proctoring fee. Results display immediately, so you will know right away and can start planning. See our overview of what the ITS certification involves for the broader picture.