- ETA's Information Technology Security exam is a 100-question, two-hour written test with a 75% passing score and no hands-on portion.
- The exam fee is USD 105, remote proctoring adds USD 16, and the certification term runs four years.
- ETA publishes ten competency areas but no percentage weights, so study every domain rather than guessing at emphasis.
- A valid CompTIA Security+ (ce) certificate can roll over to ITS for USD 105; lifetime Security+ certificates are excluded.
The Exam at a Glance
This page condenses what you need to recall about the ETA International Information Technology Security (ITS) certification into a single review pass. It is built from ETA's published competency requirements, the ETA Certification Booklet and the exact credential page. If you are still orienting yourself, start with What Is ITS Certification? or the What Does ITS Stand For? explainer, then return here for the compressed facts.
| Item | Fact |
|---|---|
| Issuer and administrator | ETA International |
| Format | Written knowledge examination, no hands-on assessment |
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Certification term | Four years |
| Domains | Ten competency areas, no published percentage weights |
Because ETA states that examination questions derive from its competencies, the competency document is the authoritative blueprint. Preparation books, flashcards and unofficial question dumps are supporting material only. For eligibility language, see ITS Requirements: the competency document recommends prior computer-systems and networking experience and prior IT or networking certification, and ETA's issuer badge lists practicing-technician experience, a written examination and acceptance of the Code of Conduct.
Fees, Scheduling and Test-Day Rules
Money
- Exam fee: USD 105.
- Remote proctoring add-on: USD 16 for this two-hour exam.
- Maintenance: USD 25 annually, USD 100 over the four-year term.
- Journeyman upgrade: USD 55 (requires Associate CET and at least two years of combined training and experience).
- Security+ rollover: USD 105 with proof of a current, non-lifetime certificate.
One third-party page lists USD 100 for the exam and USD 50 for the upgrade. Its full content and ETA affiliation could not be verified, so use ETA's current USD 105 and USD 55. The full cost picture, including optional study products, is in the ITS certification cost breakdown.
Scheduling and format
You arrange testing through an ETA Certification Administrator, either via Trapeza online testing or paper and pencil. Remotely proctored testing is available through ExamRoom.AI after you register with ETA. Initial remote scheduling can take up to 72 hours, so do not book a same-day attempt. For timing questions, see ITS Exam Dates.
Test-day rules
- Photo ID is required.
- Scratch paper and non-programmable or scientific calculators are permitted; used scratch paper must be surrendered.
- Phones are prohibited.
- You may not leave the room after testing starts.
- Remote candidates need a working webcam, a microphone, a recent computer and at least 3 Mbps internet.
Ten-Domain Cheat Sheet
These ten headings mirror the major numbered areas of ETA's 2024 competency requirements. ETA publishes no percentage weights, and none are inferred here. For a longer treatment of each area, read the ITS exam domains guide.
Domain 1: Network Hardware Security Fundamentals
Know how the devices that move and filter traffic are secured and what each one protects against.
- Firewalls, routers and switches: what each does and how each is hardened.
- Intrusion detection versus intrusion prevention: detect and alert versus detect and block.
- Segmentation concepts such as DMZs and VLANs, and why they limit lateral movement.
Domain 2: Physical Security
Digital controls fail when someone can walk up to the hardware.
- Surveillance and access control layers: fences, locks, badges, mantraps and cameras.
- RFID and NFC: short-range wireless identification, and the risks of cloning and skimming.
- Deterrent, preventive, detective and corrective control categories.
Domain 3: Network Software Security
Secure protocols and software-level defenses on networks.
- Secure versus insecure protocol pairs and which service each protects.
- Authentication, authorization and accounting concepts.
- Hardening practices such as disabling unneeded services and patching.
Domain 4: Wireless Security
The competency document includes legacy protocols and older standards, so expect to explain them in context.
- Wireless encryption and authentication generations, including why older ones are considered weak.
- Rogue access points, evil twins and similar wireless attacks.
- Bluetooth and related short-range risks.
Domain 5: Device Security
Endpoints, mobile devices and connected things.
- Endpoint protection, encryption and mobile device management concepts.
- IoT exposure: default credentials, weak update paths and limited vendor support.
- Removable media and peripheral risks.
Domain 6: Software Exploitations and Vulnerabilities
How software is attacked and how weaknesses are classified.
- Malware families and how they spread and persist.
- Common exploitation categories such as injection and overflow-style flaws.
- Vulnerability scanning versus penetration testing.
Domain 7: Operational Standards, Policies and Risk Assessments
The governance domain, and the home of the risk formulas.
- Policy, standard, procedure and guideline distinctions.
- Qualitative versus quantitative risk assessment, including SLE, ARO and ALE.
- Risk responses: mitigate, transfer, accept and avoid.
Domain 8: Disaster Recovery and Computer Forensics
Resilience before an incident, evidence handling after one.
- Hot, warm and cold recovery sites and their cost-versus-speed trade-offs.
- Backup types and what restoring each requires.
- Forensic basics: preserving evidence, documenting custody and working from copies.
Domain 9: Cryptography
Concepts matter more than mathematics here.
- Symmetric versus asymmetric encryption and where each is used.
- Hashing for integrity, digital signatures for authenticity and non-repudiation.
- PKI: certificate authorities, certificates, public and private keys, and revocation.
Domain 10: Social Engineering
Attacks that target people instead of systems.
- Phishing variants, pretexting, tailgating and baiting.
- Why awareness training and verification procedures are the primary countermeasures.
- Matching a described scenario to the correct attack name.
Worked Scenarios: Risk Math, Recovery Sites and Cloud Responsibility
Scenario 1: Annualized loss expectancy
The three terms are linked by a single multiplication.
- SLE (single loss expectancy) is the expected cost of one occurrence.
- ARO (annualized rate of occurrence) is how many times per year you expect it.
- ALE (annualized loss expectancy) equals SLE multiplied by ARO.
Worked example: a server failure would cost USD 20,000 each time and is expected once every four years, so ARO is 0.25. ALE is 20,000 multiplied by 0.25, which is USD 5,000 per year. If a safeguard costs USD 2,000 per year and eliminates the risk, it is justified; if it costs USD 8,000 per year, accepting or transferring the risk is the rational answer. These numbers are invented for practice and are not exam data.
Scenario 2: Choosing a recovery site
A business must resume operations within minutes and can afford duplicate infrastructure, which points to a hot site. A business that can tolerate several days and wants the lowest standing cost points to a cold site, which offers space and power but little equipment. A warm site sits between them, with some hardware ready and data restored from backups. Read the stated recovery time first; the cost constraint then tells you whether to settle for a slower option.
Scenario 3: Cloud shared responsibility
A company moves a database to an infrastructure-as-a-service platform. The provider secures the physical data centers, hardware and virtualization layer. The customer remains responsible for the guest operating system patching, database configuration, identity management and data classification. The trap answer blames the provider for a misconfigured storage permission; that configuration belongs to the customer. As you move toward software-as-a-service, more responsibility shifts to the provider, but the customer always retains accountability for its own data and user access.
Scenario 4: Physical access and RFID
An office uses badge readers, and an attacker walks closely behind an employee through a door. That is tailgating, a social engineering technique that defeats a card reader. A mantrap or turnstile reduces it, and awareness training addresses the human side. If the attacker instead captures the badge signal and replays it, the issue is RFID cloning, which better encryption or multifactor authentication helps counter.
Scenario 5: PKI in one sentence
A certificate authority vouches for the binding between a public key and an identity by signing a certificate. A client verifies the signature chain up to a trusted root, then uses the public key to encrypt data or verify a signature that only the private-key holder could have produced. If a private key is compromised, the certificate is revoked and listed through a revocation mechanism.
Key Takeaway
For scenario questions, identify the layer or actor first: which party is responsible, which control category applies, which asset is at risk. Most wrong answers are right facts attached to the wrong layer.
Look-Alike Concepts That Cause Wrong Answers
| Pair | How to tell them apart |
|---|---|
| IDS vs IPS | IDS alerts on suspicious traffic; IPS can also block it inline. |
| Vulnerability scan vs penetration test | A scan identifies weaknesses; a test attempts to exploit them to prove impact. |
| Symmetric vs asymmetric | Symmetric uses one shared key and is faster; asymmetric uses a public and private key pair. |
| Hash vs encryption | A hash is one-way and checks integrity; encryption is reversible with a key. |
| Hot vs warm vs cold site | Ready now, partly ready, or empty shell; cost falls as recovery time rises. |
| Policy vs procedure | A policy states what and why; a procedure states the step-by-step how. |
| Phishing vs pretexting | Phishing baits with deceptive messages; pretexting invents a believable story to extract information. |
| Mitigate vs transfer risk | Mitigation reduces likelihood or impact; transfer shifts the financial burden, such as through insurance. |
Retakes, Renewal and Rollover
If you do not pass
Trapeza displays results immediately. After an unsuccessful attempt, one eligible free retake is available. You must wait 30 days, and the retake must be completed within one year of the first exam. A remote retake still incurs the proctoring fee.
Keeping the credential active
ITS follows ETA's general, non-hands-on maintenance program over the four-year term. You may satisfy it in either of two ways:
- Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually, 40 over the four-year cycle; or
- Submit a supervisor-completed Employer Verification Form.
Either route includes USD 25 annually, USD 100 over four years, and annual submission includes ETA membership.
Security+ rollover versus the ITS exam
A valid CompTIA Security+ (ce) credential can be rolled over to ITS for USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded. The rollover is an alternative credential route; it does not make a CompTIA syllabus the ETA ITS blueprint. If you sit the ETA exam, study ETA's competencies. If you already hold a qualifying Security+, compare the rollover fee against the exam path in Is the ITS Certification Worth It?
Stand-Alone versus Journeyman
The Stand-Alone route does not require Associate CET. A later Journeyman upgrade requires CETa and at least two years of combined training and experience, at USD 55.
Sequencing Your Review by Domain
Because ETA gives no weights, divide your time roughly evenly and order domains by dependency. Foundational network and physical concepts make later topics easier, and the numeric risk material benefits from repetition near the end. The ITS study guide expands on resources and pacing.
Foundations: Domains 1, 2 and 3
- Device roles, secure versus insecure protocols, physical control layers.
- Build a one-page table of RFID, NFC and access control terms.
Radio and endpoints: Domains 4 and 5
- Wireless protocol generations and why legacy ones are weak.
- IoT and Bluetooth risk lists tied to device types.
Threats and governance: Domains 6 and 7
- Drill SLE, ARO and ALE until the multiplication is automatic.
- Sort policy, standard, procedure and guideline examples.
Recovery, crypto, people: Domains 8, 9 and 10
- Match recovery-time requirements to site types.
- Walk through PKI end to end, then take a timed practice set on the ITS practice test site.
Keep your timed practice to the real format: 100 questions in two hours leaves roughly 72 seconds per question. Review every miss by domain rather than by question number, and check how hard candidates find each area in How Hard Is the ITS Exam?
Source Caveats and Study Resources
Not all preparation content carries equal authority. ETA's competency document and booklet define the exam. Other items are helpful but secondary:
- eITprep's CompTIA Security+ Study Guide for ETA ITS lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary and 45 course contact hours. Those are product features, not exam facts; the 45 contact hours are course time, unrelated to the two-hour exam, and the 100 flashcards are unrelated to the 100 exam questions. The course description does not identify a Security+ edition, so map anything you study back to ETA's 2024 competencies.
- Unofficial question banks circulate on document-sharing sites and commercial listings. Treat them as unverified and never as a substitute for the competency list.
- Salary and job data: ETA's official fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032, so do not read them as current pay or a certification-specific premium. For career context, see the ITS salary guide and ITS jobs.
FAQ
The written exam has 100 questions with a two-hour time limit and a 75% passing score. There is no hands-on component. Practice-product counts, such as flashcard totals, are separate from the exam's question count.
The exam fee is USD 105. Remote proctoring adds USD 16. Maintenance is USD 25 annually or USD 100 over four years, and the Journeyman upgrade is USD 55. See the cost breakdown for the full picture.
If you hold a valid CompTIA Security+ (ce) credential, you can use the rollover route for USD 105 with proof of your current certificate. Lifetime Security+ certificates are excluded. The rollover is an alternative route, not a statement that Security+ content equals the ETA blueprint.
You get one eligible free retake after a 30-day wait, and it must be completed within one year of the first exam. If you retake remotely, the proctoring fee still applies.
No. They are separate credentials from different organizations with different content and exam details. This cheat sheet covers only ETA's Information Technology Security certification, and its facts should not be applied to the other program.
Use this sheet as a final review layer, then confirm your readiness with timed practice at the ITS Exam Prep practice tests, and revisit the ITS certification overview if any fact here raises a question about scope or eligibility.