- How the ETA Blueprint Is Organized
- Exam Format and Logistics at a Glance
- Domain 1: Network Hardware Security Fundamentals
- Domain 2: Physical Security
- Domain 3: Network Software Security
- Domain 4: Wireless Security
- Domain 5: Device Security
- Domain 6: Software Exploitations and Vulnerabilities
- Domain 7: Operational Standards, Policies and Risk Assessments
- Domain 8: Disaster Recovery and Computer Forensics
- Domain 9: Cryptography
- Domain 10: Social Engineering
- Sequencing the Ten Domains
- Which Study Sources to Trust
- Frequently Asked Questions
- ETA's Information Technology Security (ITS) competency document lists ten major areas, and exam questions derive directly from them.
- The written exam has 100 questions, a two-hour limit, and a 75% passing score; no hands-on portion exists.
- ETA publishes no percentage weights per domain, so treat all ten areas as testable rather than guessing at emphasis.
- Exam fee is USD 105; remote proctoring adds USD 16, and one free retake follows a 30-day wait.
How the ETA Blueprint Is Organized
The ETA Information Technology Security (ITS) credential is built on a single authoritative document: ETA's Information Technology Security Competency Requirements (copyright 2024), an eight-page PDF published by ETA International. Its ten major numbered areas are the ten domains covered in this guide. ETA states that examination questions derive from the respective competencies, which makes the document an exam blueprint rather than a course outline written by a prep vendor.
Two things about this blueprint shape how you should study. First, ETA does not publish percentage weights for the ten areas. Any site claiming "Domain 4 is 15% of the exam" is inventing a number. The honest approach is to prepare across all ten and to spend extra time where your own background is thinnest. Second, the competency document recommends prior computer-systems and networking experience, and prior IT or networking certification, as preparation. The domains assume you already know what a switch, a router, and an IP address are.
If you are still orienting yourself to the credential itself, start with What Is ITS Certification? and then return here for the domain-by-domain breakdown. When you are ready to test your recall, the ITS practice tests are a natural next step.
Exam Format and Logistics at a Glance
Before diving into the domains, it helps to know what you are preparing for. The table below summarizes the verified exam parameters from ETA's credential page and certification booklet.
| Item | Detail |
|---|---|
| Format | Written knowledge examination; no hands-on assessment |
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Remote proctoring | Adds USD 16 (ExamRoom.AI); initial scheduling can take up to 72 hours |
| Certification term | Four years |
| Retake policy | One eligible free retake after a 30-day wait, within one year of the first exam |
The 75% threshold is a score requirement, not a pass rate. No issuer-wide pass rate for ITS has been verified, so be skeptical of any figure presented as one; our ITS pass rate discussion explains what the data can and cannot tell you. For a closer look at the cut score itself, see ITS Passing Score 2026, and for the full cost picture, see ITS Certification Cost 2026.
Domain 1: Network Hardware Security Fundamentals
The first domain grounds you in the devices that carry traffic and the ways those devices can be hardened or abused. Think of this as the infrastructure layer: routers, switches, firewalls, and the segmentation concepts that keep one compromised host from reaching everything else.
What to Master
Know what each network device does, where it sits in a topology, and which security function it contributes.
- Firewall placement and the difference between filtering approaches
- Segmentation ideas such as screened subnets (DMZs) and VLAN separation
- Intrusion detection versus intrusion prevention, and where each is deployed
- Device hardening basics: disabling unused ports and services, changing defaults
Questions here tend to be recognition-and-application: given a described network, which device or control addresses the stated risk? Practice reading a short scenario and naming the right control rather than memorizing definitions in isolation.
Domain 2: Physical Security
Many candidates underestimate physical security because it feels non-technical. On a security exam, it is a full domain, and the questions are concrete: what control stops tailgating, what does a mantrap do, why does camera placement matter.
What to Master
Physical controls are layered, and the exam expects you to match a control to a threat.
- Surveillance: camera types, placement, coverage, and recording retention considerations
- Access control: badges, biometrics, locks, mantraps, and visitor management
- RFID and NFC: how proximity credentials work and how they can be cloned or skimmed
- Environmental and perimeter protections
Worked scenario: badge cloning
A facility uses proximity badges for its server room. An auditor demonstrates that a handheld reader can capture a badge ID from a few inches away and replay it. The weakness is not the door; it is that the credential carries a static identifier with no mutual authentication. Appropriate responses include moving to credentials with stronger cryptographic challenge-response, adding a second factor such as a PIN at the reader, and shielding badge holders in sleeves when not in use. Notice that the best answer addresses the credential technology (RFID/NFC), not just the lock hardware.
Domain 3: Network Software Security
Where Domain 1 covers devices, this domain covers the protocols and software that run on them. It is the area most likely to include the legacy material ETA's document is known for, so plan to learn older protocols in context.
What to Master
Understand which protocols are secure, which are not, and what replaced the weak ones.
- Secure versus insecure application protocols and their replacements
- Authentication and authorization models, including centralized services
- Access control concepts: least privilege, separation of duties, role-based approaches
- Remote access and tunneling security
Domain 4: Wireless Security
Wireless security is a classic exam favorite because the history is a clean story of weakness and replacement. Expect questions on encryption generations, authentication methods, and common wireless attacks.
What to Master
- The progression of wireless encryption standards and why earlier ones failed
- Personal versus enterprise authentication modes
- Rogue access points and evil-twin attacks
- Practical hardening: SSID handling, signal management, and client isolation
- Bluetooth risks and pairing weaknesses
Bluetooth sits at the boundary between wireless and device security. Candidates should be able to distinguish discoverable from connectable states and recognize that convenience features, such as automatic pairing, widen the attack surface.
Domain 5: Device Security
This domain moves from the network to the endpoint: laptops, phones, servers, and the growing set of embedded devices. The exam expects you to know how a device is protected from the moment it is configured to the moment it is retired.
What to Master
- Endpoint protection: anti-malware, host firewalls, patching, and configuration baselines
- Mobile device management concepts and loss or theft responses
- IoT security: default credentials, firmware updates, and network isolation
- Secure disposal and data sanitization
- Cloud shared responsibility, covering which duties belong to the provider and which to the customer
Worked scenario: cloud shared responsibility
A company moves a database to an infrastructure-as-a-service platform and assumes the provider now handles all security. Months later, a misconfigured storage permission exposes records. Under the shared responsibility model, the provider secures the underlying facilities and virtualization layer, while the customer remains responsible for configuring access, protecting data, and managing identities within their environment. The exposure was a customer-side configuration failure. The takeaway for exam purposes: as you move from infrastructure to platform to software services, the provider takes on more of the stack, but data and access decisions stay with the customer.
Worked scenario: an IoT camera on the main network
A small office plugs a network camera into the same segment as its file server. The camera ships with a default password and receives no firmware updates. An attacker who compromises the camera gains a foothold on the internal network. The fix combines several controls from across domains: change default credentials, update firmware where available, and place IoT devices on an isolated segment with restricted access to sensitive systems.
Domain 6: Software Exploitations and Vulnerabilities
This domain is the attacker's-eye view. You are asked to recognize categories of attack and match them to their mitigations, so it rewards a habit of pairing every threat with a defense.
What to Master
- Malware families and how they spread, hide, and persist
- Injection, overflow, and cross-site attack categories
- Denial-of-service concepts and distributed variants
- Man-in-the-middle and session-hijacking techniques
- Vulnerability scanning versus penetration testing, and what each produces
A useful drill is to build a two-column table from memory: attack on the left, primary mitigation on the right. Gaps in the right column show you exactly where to review. For a broader sense of how demanding this material is for newer candidates, see How Hard Is the ITS Exam?
Domain 7: Operational Standards, Policies and Risk Assessments
This is the management-flavored domain, and it is where calculations appear. If you have worked only on the technical side, budget real time here. The vocabulary is precise, and the formulas are testable.
What to Master
- Security policies, standards, procedures, and guidelines, and how they differ
- Risk concepts: threats, vulnerabilities, impact, and likelihood
- Risk responses: mitigate, transfer, accept, and avoid
- Quantitative risk: SLE, ARO, and ALE
- Change management, auditing, and compliance concepts
Worked scenario: ALE, SLE, and ARO
A server holds data worth USD 50,000. A given incident would damage 40% of that value, and analysts expect the incident roughly once every four years. Single Loss Expectancy (SLE) is asset value multiplied by exposure factor: 50,000 × 0.40 = USD 20,000. Annualized Rate of Occurrence (ARO) is 0.25 occurrences per year. Annualized Loss Expectancy (ALE) is SLE multiplied by ARO: 20,000 × 0.25 = USD 5,000 per year. If a control costing USD 3,000 per year cuts the ARO in half, the new ALE is USD 2,500, a USD 2,500 annual reduction against a USD 3,000 cost. That control would not be justified on these numbers alone. Exam questions often hinge on exactly this comparison of control cost against risk reduction.
Key Takeaway
Memorize the three formulas as a chain: SLE = asset value × exposure factor, ALE = SLE × ARO. Then practice the final judgment step, comparing annual control cost with the ALE reduction the control delivers.
Domain 8: Disaster Recovery and Computer Forensics
Two related but distinct subjects share this domain: keeping the business running after a disruption, and preserving evidence after an incident. Candidates sometimes blur them, and the exam rewards keeping them separate.
Disaster Recovery: What to Master
- Backup types and rotation strategies
- Recovery objectives: how much data loss and downtime are tolerable
- Recovery site options: hot, warm, and cold sites
- Business continuity versus disaster recovery planning
Computer Forensics: What to Master
- Order of volatility: capture the most fleeting data first
- Chain of custody and evidence handling
- Forensic imaging so analysis never touches the original
- Incident response phases
Worked scenario: choosing a recovery site
A regional clinic must restore its patient scheduling system within hours of a facility loss, and it can tolerate only minimal data loss. A cold site, which offers space and power but no equipment, would take far too long to bring online. A warm site has some hardware and connectivity but needs data restored and configuration finished. A hot site mirrors the production environment and can take over almost immediately, at the highest cost. Given the clinic's tight recovery window, the hot site is the defensible choice, while a low-priority back-office archive might reasonably sit on a cold site. The principle: tighter recovery objectives justify higher site cost.
Domain 9: Cryptography
Cryptography questions reward conceptual clarity over mathematics. You are not asked to compute ciphers by hand; you are asked to know which tool solves which problem and why.
What to Master
- Symmetric versus asymmetric encryption, including speed and key-distribution trade-offs
- Hashing for integrity, and why hashes are not encryption
- Digital signatures: authenticity, integrity, and non-repudiation
- PKI: certificate authorities, certificate contents, revocation, and the chain of trust
- Key management and the risks of weak or reused keys
Worked scenario: how PKI establishes trust
A user visits a website over HTTPS. The server presents a certificate containing its public key, signed by a certificate authority. The browser checks that the signature validates against a CA it already trusts, that the certificate has not expired, that the name matches the site, and that it has not been revoked. Only then does it use the public key to help establish a session key for fast symmetric encryption of the traffic. This one flow ties together asymmetric cryptography, hashing inside signatures, and the chain of trust, which is precisely the integration that scenario questions probe.
Domain 10: Social Engineering
The final domain acknowledges that people are part of the attack surface. Technical controls cannot fully compensate for a convinced employee, so the exam covers both the tactics and the defenses.
What to Master
- Phishing and its variants, including targeted and voice-based forms
- Pretexting, baiting, tailgating, and shoulder surfing
- The psychological levers attackers pull: authority, urgency, and familiarity
- Defenses: awareness training, verification procedures, and reporting channels
Worked scenario: the urgent call from "IT"
An employee receives a call from someone claiming to be IT support, insisting that their account will be locked within minutes unless they read back a verification code that just arrived on their phone. Urgency and assumed authority are the levers. The code is a one-time credential, and no legitimate support process asks for it. The right response is to refuse, end the call, and report it through a known channel, not a number supplied by the caller. Social engineering ties back to Domain 2 as well, since tailgating is the physical cousin of this same manipulation.
Sequencing the Ten Domains
Because ETA publishes no weights, a sensible schedule starts with what you know least and keeps related domains adjacent. Here is one ITS-specific ordering, with the reasoning built in.
Infrastructure Foundations
- Domains 1 and 3: devices first, then the protocols that run on them
- Build the legacy-to-modern protocol replacement list
The Wireless and Endpoint Edge
- Domains 4 and 5, since Bluetooth and IoT straddle both
- Work the cloud shared responsibility and IoT scenarios
Attackers and the Physical World
- Domains 6 and 2, pairing every attack with a mitigation
- Review RFID/NFC and surveillance controls
Governance, Recovery, Crypto, People
- Domains 7, 8, 9, and 10, drilling ALE/SLE/ARO, recovery sites, and PKI until fluent
- Finish with timed practice sets
Adjust the pace to your background. A working network technician may compress Week 1, while someone from a help-desk role may need extra time on Domain 7's calculations. For a fuller plan, see the ITS Study Guide 2026, and keep the ITS Cheat Sheet handy for last-week review.
Which Study Sources to Trust
Search results for this credential mix sources of very different authority. ETA's own competency document is the blueprint; everything else is interpretation. Commercial courses, crowd-sourced question sets, and reference pages can be useful, but none of them replaces the issuer's list of competencies.
One example is eITprep's CompTIA Security+ Study Guide for ETA ITS, which lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Those are product features and course hours, not exam facts, and they should not be confused with the exam's own 100 questions and two-hour limit. The public description does not identify a Security+ exam edition, so map anything you study to ETA's published 2024 competencies rather than assuming the syllabi line up.
If cost and eligibility are on your mind, ITS Requirements 2026 covers prerequisites and routes, and ITS Exam Dates 2026 explains scheduling. Once certified, the credential runs four years under ETA's maintenance program, which requires either 10 relevant continuing-education hours annually (40 over the cycle) or a supervisor-completed Employer Verification Form, plus USD 25 annually. To gauge the career side, read Is the ITS Certification Worth It?
Frequently Asked Questions
The ETA Information Technology Security competency document lists ten major areas, and exam questions derive from them. They run from Network Hardware Security Fundamentals through Social Engineering. ETA does not publish percentage weights for the domains.
No. According to ETA's certification booklet, ITS is a written knowledge examination with 100 questions, a two-hour limit, and a 75% passing score. There is no hands-on assessment component.
ETA has not published weights, so no one can state a domain's share of the exam with authority. Prepare across all ten, and invest extra time in the areas where your own experience is weakest, such as the risk calculations in Domain 7.
The competency document retains legacy security protocols and older standards editions. Study them in context: understand what each did, why it was replaced, and what its modern successor is, since questions can approach the topic from either direction.
ETA offers a rollover route for a valid CompTIA Security+ (ce) credential, with proof of the current certificate and a USD 105 fee. Lifetime Security+ certificates are excluded. The rollover is an alternative way to obtain ITS, not evidence that the two syllabi are identical.
With the ten domains mapped, the most effective next move is to test yourself against realistic scenarios. Work through the ITS practice questions, note which domains slow you down, and return to the matching sections above. Pair that with the ITS Study Guide to turn the blueprint into a dated plan.