- What the ETA ITS Certification Is (and Is Not)
- Exam Format, Fees and Testing Logistics
- Eligibility, Experience and the Stand-Alone Route
- The Ten Competency Areas
- Worked Scenarios for High-Value Topics
- Original Practice Questions
- ITS and CompTIA Security+: Rollover and Resources
- Keeping the Certification Active
- Sequencing Your Preparation
- Frequently Asked Questions
- ETA's ITS exam is a written test of 100 questions in two hours, with a 75% passing score.
- The exam fee is USD 105; remote proctoring through ExamRoom.AI adds USD 16.
- Ten published competency areas drive the questions, but ETA publishes no percentage weights for them.
- Certification lasts four years; maintenance needs 40 CE hours or an employer verification form, plus USD 100 total.
What the ETA ITS Certification Is (and Is Not)
The ITS certification discussed here is Information Technology Security, administered by ETA International. It is a written, knowledge-based credential covering the security of networks, devices, software, physical spaces, and people. It is a different credential from Certiport's Information Technology Specialist exams, which share the same acronym but have a separate issuer, format, and syllabus. If you are still sorting out terminology, our explainers on what ITS certification is and what ITS stands for cover the naming in more depth.
ETA states that exam questions derive directly from its published Competency Requirements (a document copyrighted 2024, eight pages long, available from ETA). That makes the competency list the single authoritative blueprint. Everything else, including study guides, flashcards, and community-posted question sets, is supplementary and varies in quality. Treat those materials as ways to practice, not as definitions of what the exam covers.
Exam Format, Fees and Testing Logistics
The published specifications for ITS are straightforward. There is no hands-on component, so the entire assessment is about what you know and how well you apply it to short scenarios.
| Item | ETA ITS Detail |
|---|---|
| Format | Written knowledge examination, no hands-on assessment |
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Remote proctoring surcharge | USD 16 (ExamRoom.AI) |
| Certification term | Four years |
Note that 75% is a score threshold, not a pass rate. No issuer-wide pass rate has been verified, so be skeptical of any figure presented as one. Our pages on the ITS passing score and what the pass-rate data actually shows go deeper on that distinction, and the full ITS certification cost breakdown lays out every fee in one place.
Where and how you test
You arrange testing through an ETA Certification Administrator. Two in-person modes exist: Trapeza online testing and paper/pencil. Remotely proctored testing through ExamRoom.AI is also available once you have registered with ETA. Initial remote scheduling can take up to 72 hours, so do not plan a same-day exam.
- Remote requirements: a working webcam and microphone, a recent computer, and at least 3 Mbps internet.
- Identification: photo ID is required.
- Permitted items: scratch paper and non-programmable or scientific calculators. Used scratch paper must be surrendered.
- Prohibited: phones, and leaving the room once testing has started.
Trapeza displays your result immediately. If you do not pass, one eligible free retake is available after a 30-day wait, and it must be completed within one year of the first attempt. A remote retake still incurs the proctoring fee. For calendar planning, see our guide to ITS exam dates and scheduling.
Eligibility, Experience and the Stand-Alone Route
ETA's competency document recommends prior computer-systems and networking experience, and prior IT or networking certification, as preparation. ETA's issuer badge page separately lists practicing-technician experience, passing the written exam, and acceptance of the ETA Code of Conduct. These are recommendations and conditions of the credential rather than a rigid prerequisite ladder, so read them carefully before registering.
The Stand-Alone route does not require Associate CET (CETa). If you later want to move to a Journeyman designation, the upgrade requires CETa and at least two years of combined training and experience, with an upgrade fee of USD 55. The older ETA Press listing that quotes USD 100 for the exam and USD 50 for the upgrade is unverified and does not override ETA's current USD 105 and USD 55 figures. For a full checklist, read ITS requirements and eligibility.
The Ten Competency Areas
The ten areas below mirror the headings in ETA's current competency document. A deeper walk-through of each lives in our complete guide to all ten ITS content areas; here is what makes each one distinct.
Domain 1: Network Hardware Security Fundamentals
Expect questions about securing routers, switches, firewalls, and other network infrastructure, plus how devices are placed and segmented.
- Know what each device does at its layer and how misconfiguration creates exposure
- Understand segmentation concepts and where perimeter controls sit
Domain 2: Physical Security
Physical controls protect the assets that logical controls cannot. Surveillance, access control, and identification technologies all appear.
- Distinguish deterrent, preventive, and detective physical controls
- Understand RFID and NFC basics, including why proximity credentials can be cloned or skimmed
Domain 3: Network Software Security
This area deals with the protocols and services running across the network and how to harden them.
- Learn secure versus insecure protocol pairings
- Be ready to explain legacy security protocols in historical context, since the competency document includes older standards
Domain 4: Wireless Security
Wireless questions cover encryption standards, authentication, and common attacks on Wi-Fi networks.
- Know how wireless security standards evolved and why older ones are considered weak
- Understand rogue access points and evil-twin style attacks
Domain 5: Device Security
Endpoints, mobile devices, and connected hardware are in scope, including IoT and Bluetooth exposure.
- Connect device hardening to patching, configuration, and least functionality
- Recognize risks created by short-range wireless pairing
Domain 6: Software Exploitations and Vulnerabilities
Here you identify attack types and vulnerability classes in applications and systems, and match mitigations to them.
- Learn to recognize an attack from a short description
- Pair each class of weakness with its most direct control
Domain 7: Operational Standards, Policies and Risk Assessments
This area is where quantitative risk language lives: ALE, SLE, and ARO, plus policy and standards concepts.
- Be able to compute with the risk formulas, not just define them
- Understand how cloud shared responsibility changes who owns which control
Domain 8: Disaster Recovery and Computer Forensics
Recovery planning and evidence handling both appear, including recovery site types and order of volatility ideas.
- Compare hot, warm, and cold recovery sites by cost and recovery speed
- Understand preservation of evidence and chain of custody
Domain 9: Cryptography
Expect symmetric versus asymmetric concepts, hashing, digital signatures, and public key infrastructure.
- Know what each primitive provides: confidentiality, integrity, authentication, or non-repudiation
- Walk through how certificates and certificate authorities establish trust
Domain 10: Social Engineering
People are part of the attack surface. Know the common manipulation techniques and the training and process controls that counter them.
- Differentiate phishing variants, pretexting, tailgating, and similar tactics
- Link each tactic to a realistic defense
Worked Scenarios for High-Value Topics
Cloud shared responsibility
A company runs a virtual server in an infrastructure-as-a-service environment. A breach occurs because the server's operating system was never patched. Who is responsible? In the shared responsibility model, the provider secures the underlying facilities and hypervisor, while the customer manages the guest operating system, patching, and data. The unpatched OS is the customer's responsibility. As you move toward software-as-a-service, more responsibility shifts to the provider.
Quantitative risk: SLE, ARO and ALE
A server is valued at USD 40,000 and a single flood would destroy 50% of its value. The flood is expected once every four years.
- SLE (single loss expectancy) = asset value x exposure factor = 40,000 x 0.50 = USD 20,000.
- ARO (annualized rate of occurrence) = 1 / 4 = 0.25.
- ALE (annualized loss expectancy) = SLE x ARO = 20,000 x 0.25 = USD 5,000.
A control costing USD 8,000 per year to prevent this loss would not be cost-justified on these numbers alone.
Recovery sites
A hospital billing office can tolerate being offline for a day but not a week, and the budget is limited. A warm site fits: it has hardware and connectivity staged but needs data restored and configuration finished. A hot site recovers faster but costs more; a cold site is cheapest but takes the longest.
Physical surveillance and access control
A data room's badge reader logs a valid entry, yet camera footage shows two people entered. This is tailgating (piggybacking). A mantrap or turnstile that admits one person per authentication is the direct countermeasure, and security awareness training reinforces it.
PKI
A browser trusts a website because the site's certificate was signed by a certificate authority the browser already trusts. If the certificate is revoked, the browser should learn this through a revocation list or an online status check. Know who issues, who verifies, and what happens when trust is withdrawn.
Social engineering
An employee receives a call from someone claiming to be IT support and asking for a password to "fix an urgent issue." This is pretexting combined with urgency. The correct response is to refuse, verify the caller through a known channel, and report it.
Original Practice Questions
These original items are written in the spirit of the competency objectives. They are not drawn from the live exam. For a larger bank, use the ITS practice tests.
- (Domain 7) An asset worth USD 100,000 has an exposure factor of 30% for a specific threat that occurs twice per year. What is the ALE?
Answer: SLE = 30,000; ALE = 30,000 x 2 = USD 60,000. - (Domain 8) Which recovery site offers the fastest failover at the highest cost?
Answer: A hot site. - (Domain 9) Which cryptographic property does a digital signature primarily provide?
Answer: Authentication and integrity, with non-repudiation, using the signer's private key. - (Domain 4) A device broadcasts the same network name as the corporate Wi-Fi to lure users into connecting. What is this attack?
Answer: An evil twin (rogue access point). - (Domain 2) What is the best control against tailgating at a secured door?
Answer: A mantrap or turnstile that enforces one person per authentication, supported by awareness training. - (Domain 10) A caller creates urgency and requests credentials. What technique is this?
Answer: Pretexting (a form of social engineering). - (Domain 7) In an IaaS deployment, who patches the guest operating system?
Answer: The customer. - (Domain 5) Why are default credentials on IoT devices a concern?
Answer: They are publicly known, so attackers can gain access easily if the defaults are not changed.
ITS and CompTIA Security+: Rollover and Resources
A valid CompTIA Security+ (ce) credential provides an alternative route to ITS through ETA's rollover program. The fee is USD 105, with proof of your current certificate required. Lifetime Security+ certificates are excluded. This is a credential-conversion route, not a statement that Security+ objectives equal the ETA ITS blueprint. If you sit the written exam, your study should map to ETA's 2024 competency document.
| Path | How it works | Cost |
|---|---|---|
| Written ITS exam | Take the 100-question, two-hour exam; 75% to pass | USD 105 (plus USD 16 if remote) |
| Security+ (ce) rollover | Provide proof of a current, non-lifetime Security+ certificate | USD 105 |
One optional resource is eITprep's CompTIA Security+ Study Guide for ETA ITS, listed at USD 59.95 for six months with two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Keep two things separate: those 45 hours are course time, not the exam duration, and the course does not itself confer certification. Its public description does not name a Security+ exam edition, so cross-check topics against ETA's competency list. Unofficial question dumps and commercial third-party products also exist; they vary in authority and should never replace the issuer blueprint.
If you are weighing whether the credential suits your goals, see whether the ITS certification is worth it. On pay, ETA's own fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032, so they are dated and should not be read as current salary evidence or a certification-specific premium. Our ITS salary analysis and overview of ITS jobs treat this carefully.
Keeping the Certification Active
ITS follows ETA's general, non-hands-on maintenance program over a four-year cycle. You have two ways to meet it:
- Continuing education: submit the Certification Maintenance Form with 10 relevant CE hours each year, 40 across the four years.
- Employer verification: instead of CE hours, submit a supervisor-completed Employer Verification Form.
Either way, the fee is USD 25 annually, or USD 100 across the four-year cycle, and annual submission includes ETA membership. Plan to log training as you complete it rather than reconstructing it later.
Sequencing Your Preparation
Because ETA gives no domain weights, spread your time across all ten areas and front-load the ones where you have the least background. This single schedule ties order to content; our ITS study guide and one-page ITS cheat sheet expand on the method.
Foundations: Domains 1 and 3
- Network hardware and software protocols, since later topics build on them
- Make a table of legacy versus current protocols
Perimeter and Devices: Domains 2, 4 and 5
- Physical controls, RFID/NFC, wireless standards, IoT and Bluetooth
Attacks and Math: Domains 6 and 7
- Practice SLE, ARO and ALE until the arithmetic is automatic
- Rehearse the cloud shared responsibility split
Recovery, Crypto, People: Domains 8, 9 and 10
- Recovery site comparisons, PKI walk-throughs, social engineering tactics
- Finish with timed full-length practice under two-hour conditions
Key Takeaway
Do timed practice at roughly 100 questions in two hours, which is about 72 seconds per question. If you consistently run over on scenario items, drill the Domain 7 calculations and Domain 9 trust chains first, since those reward fluency. Repeated checks on the practice test site will show which domains need another pass, and the guide on how hard the ITS exam is helps calibrate expectations.
Frequently Asked Questions
The written exam has 100 questions with a two-hour limit. The passing score is 75%, and there is no hands-on component.
The exam fee is USD 105. Remote proctoring through ExamRoom.AI adds USD 16. Later upgrade to Journeyman costs USD 55 for eligible candidates.
Results display immediately in Trapeza. One eligible free retake is available after a 30-day wait and must be completed within one year of the first attempt. A remote retake still carries the proctoring fee.
Yes, a valid Security+ (ce) credential can roll over for USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded.
Submit the Certification Maintenance Form with 10 relevant CE hours annually (40 over four years), or a supervisor-completed Employer Verification Form, plus USD 25 per year (USD 100 over the cycle).