- What the Pass Rate Data Actually Shows
- Why a 75% Threshold Is Not a Pass Rate
- The Format Behind Every Attempt
- Where Attempts Tend to Go Wrong: The Ten Competencies
- Worked Scenarios Across the Blueprint
- Retake Rules and Their Effect on Your Odds
- Sequencing Your Preparation by Domain
- Judging Prep Sources by Authority
- Frequently Asked Questions
- No issuer-wide ETA ITS pass rate has been verified, so any specific percentage you see online should be treated skeptically.
- The 75% figure is the passing score on 100 questions, not the share of candidates who pass.
- The written exam runs two hours, and Trapeza displays your result immediately after you finish.
- One free retake is available after a 30-day wait, within one year of the first attempt.
What the Pass Rate Data Actually Shows
If you searched for the ITS pass rate hoping for a tidy percentage, here is the honest answer: ETA International has not published an issuer-wide pass rate for its Information Technology Security (ITS) certification, and none has been verified for this article. Any site quoting a precise figure without citing ETA is guessing, recycling another credential's statistics, or inventing a number to capture search traffic.
That absence of data is itself useful information. It tells you how to evaluate the claims you will run into, and it redirects your attention toward the things that are measurable: the exam format, the scoring threshold, the published competencies, and the retake policy. Those are the variables you can actually control. For a broader look at difficulty without leaning on invented statistics, see our guide on how hard the ITS exam is.
Why a 75% Threshold Is Not a Pass Rate
The most common confusion in this topic is mixing up two very different numbers. The ETA ITS exam has a 75% passing score. That means a candidate must answer at least 75 of the 100 questions correctly. It is a cut line applied to each individual candidate.
A pass rate, by contrast, would describe what fraction of all candidates cleared that cut line over some period. ETA has not made that figure public for ITS. When you see "75%" in a forum post about passing, it almost always refers to the threshold. Our dedicated page on the ITS passing score breaks down exactly what you need to clear.
| Concept | What It Measures | Status for ETA ITS |
|---|---|---|
| Passing score | Minimum correct answers per candidate | 75% (75 of 100 questions) |
| Pass rate | Share of all candidates who pass | No issuer-wide figure verified |
| Retake allowance | Second-chance policy after a failed attempt | One eligible free retake after 30 days |
| Result timing | When you learn your outcome | Displayed immediately in Trapeza |
The Format Behind Every Attempt
Because no pass-rate figure exists, the format becomes your best predictor of how an attempt will feel. The ETA ITS is a written knowledge examination with 100 questions and a two-hour limit. There is no hands-on assessment, so everything is tested through knowledge recall and scenario reasoning. That works out to roughly 72 seconds per question, which is comfortable for definition-style items but tighter when a scenario requires you to hold several facts at once.
Cost and Eligibility
The exam fee is USD 105, and remote proctoring adds USD 16 for this two-hour exam. A pass earns a four-year certification term. The competency document recommends prior computer-systems and networking experience and prior IT or networking certification as preparation, but the Stand-Alone route does not require the Associate CET (CETa). For the full eligibility picture, read our breakdown of ITS requirements, and for every line item see the ITS certification cost guide.
Testing Logistics That Affect Performance
Testing is arranged with an ETA Certification Administrator through Trapeza online testing or paper/pencil. Remotely proctored testing is available through ExamRoom.AI after registration with ETA, and initial scheduling can take up to 72 hours. Remote candidates need a working webcam, microphone, a recent computer, and at least 3 Mbps internet.
- Photo ID is required.
- Scratch paper and non-programmable or scientific calculators are permitted; used scratch paper must be surrendered.
- Phones are prohibited.
- Candidates may not leave the room once testing starts, so plan accordingly for a two-hour sitting.
Logistics failures are a quiet source of avoidable stress. Check your webcam, microphone, and connection well before your slot, and review scheduling details and timing so the 72-hour lead time does not surprise you.
Where Attempts Tend to Go Wrong: The Ten Competencies
ETA states that examination questions derive from the respective competencies in its 2024 Competency Requirements document. That document lists ten major areas but publishes no percentage weights, so you cannot assume one domain counts for more than another. Treat all ten as fair game and avoid skipping any. Our complete guide to the ten ITS content areas goes deeper on each one; here is how they cluster in practice.
Domains 1, 3, and 4: Network Hardware, Network Software, and Wireless Security
These three form the infrastructure core. Candidates should be able to reason about how devices, protocols, and wireless configurations create or close attack surface.
- Know the security role of each network device, not just its function.
- Expect legacy wireless security protocols to appear; the competency document includes them, so understand what each was and why it was superseded.
- Be ready to distinguish software-layer controls from hardware-layer controls.
Domain 2: Physical Security
Often underestimated by candidates from pure networking backgrounds. Surveillance, access control, and technologies such as RFID and NFC all live here.
- Understand layered physical controls and how they complement logical controls.
- Know where proximity technologies are convenient and where they are weak.
Domains 5 and 6: Device Security and Software Exploitations and Vulnerabilities
Endpoint hardening, IoT and Bluetooth exposure, and the classes of software flaw attackers exploit.
- Match each vulnerability class to its realistic mitigation.
- Recognize how IoT and Bluetooth devices widen an organization's footprint.
Domains 7 and 8: Operational Standards, Policies and Risk Assessments, and Disaster Recovery and Computer Forensics
The quantitative and procedural heart of the exam. Risk formulas such as ALE, SLE, and ARO, plus recovery site types, reward careful practice.
- Memorize the relationships among SLE, ARO, and ALE and practice applying them to short word problems.
- Distinguish recovery site types by readiness and cost trade-offs.
Domains 9 and 10: Cryptography and Social Engineering
Cryptography covers concepts like PKI, while social engineering tests recognition of manipulation techniques and the human-factor defenses against them.
- Understand how certificates and trust chains work in a PKI.
- Be able to classify an attack scenario by its social-engineering technique.
Worked Scenarios Across the Blueprint
Because the exam is knowledge-based and derives from the competencies, scenario fluency matters more than raw memorization. Try these original examples and check your reasoning.
Scenario 1: Cloud Shared Responsibility
A company runs a virtual machine in a public cloud's infrastructure-as-a-service model. A misconfigured guest operating system is breached. Who bears responsibility for patching that guest OS? Under the shared responsibility model, the customer is responsible for the guest OS in an IaaS arrangement, while the provider secures the underlying physical infrastructure and hypervisor layer. The skill being tested is locating the boundary, not memorizing a slogan.
Scenario 2: Quantitative Risk
An asset is worth USD 50,000, and a given threat would destroy 40% of its value in a single event. The event is expected twice per year. The SLE is 40% of 50,000, which is USD 20,000. The ARO is 2. The ALE is SLE multiplied by ARO, which is USD 40,000 per year. If a control costs USD 15,000 per year and eliminates the risk, the math favors the control. Practice a handful of these until the multiplication is automatic.
Scenario 3: Recovery Sites
An organization needs near-immediate failover and can afford duplicate infrastructure running in parallel. That points to a hot site. A business that tolerates several days of downtime and wants the lowest cost fits a cold site. A warm site sits between them. The exam rewards matching requirement to site type.
Scenario 4: Physical Access and Proximity Technology
A facility uses badge readers based on RFID. An attacker stands near an employee with a concealed reader and captures the credential. Which domain does this touch, and what mitigations apply? It sits in physical security, and sensible responses include shielded badge holders, layered authentication such as adding a second factor, and surveillance at entry points.
Scenario 5: PKI and Trust
A browser warns that a website's certificate was not issued by a trusted authority. In a PKI, trust flows from certificate authorities up to a root. If the chain cannot be validated to a trusted root, the certificate is not trusted. Be able to explain what a certificate binds together and why revocation matters.
Scenario 6: Social Engineering
An employee receives a call from someone claiming to be IT support and urgently requesting a password to "prevent account lockout." The caller relies on urgency and authority. Recognizing the pretext and knowing that legitimate support does not ask for passwords is the human-factor control the competencies expect.
Key Takeaway
Convert every competency heading into at least one scenario you can solve out loud. If you can explain why a recovery site, a certificate chain, or a risk calculation is right or wrong, you are studying at the depth the exam rewards.
Retake Rules and Their Effect on Your Odds
Since a published pass rate does not exist, the retake policy is the most concrete safety net you can plan around. After an unsuccessful attempt, one eligible free retake is available following a 30-day wait, and it must be completed within one year of the first exam. If you retake remotely, the proctoring fee still applies.
Practically, this means a first attempt need not be all-or-nothing, but you should still treat it seriously: the free retake is a single opportunity, and the 30-day gap is a fixed pause you cannot shorten. Because Trapeza displays results immediately, you will know the outcome as soon as you finish, which lets you start targeted review the same day instead of waiting.
- Use the wait productively: map your weakest competencies and rebuild them before the retake window opens.
- Mind the one-year limit: schedule the retake early enough that it falls inside the window.
- Budget for remote fees: a remote retake adds the proctoring charge again.
After You Pass: Keeping the Credential
A passing result is not the end of the paperwork. The certification term is four years, and ITS follows ETA's general, non-hands-on maintenance program. You submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle), or a supervisor-completed Employer Verification Form, plus USD 25 annually (USD 100 over four years). Annual submission includes ETA membership.
There is also an alternative route: a valid CompTIA Security+ (ce) credential can roll over to ITS for USD 105 with proof of the current certificate, though lifetime Security+ certificates are excluded. This rollover is an alternative credential route and does not mean a CompTIA syllabus is the ETA ITS blueprint. If you are weighing whether the credential justifies the effort, our ROI analysis and earnings guide cover the career side, keeping in mind that ETA's own fact sheet labels its wage figures as 2016 and its projections as 2022-2032, so they are not current salary evidence.
Sequencing Your Preparation by Domain
Generic study methods matter less than ordering the content sensibly. Here is one way to sequence the ten competencies over a few weeks, with the reasoning for each placement. Adjust the pace to your background; a candidate with strong networking experience can compress the early weeks.
Infrastructure Foundations
- Domain 1: Network Hardware Security Fundamentals
- Domain 3: Network Software Security
- Why first: later domains assume you understand how devices and protocols fit together.
Perimeter and Endpoints
- Domain 4: Wireless Security, including legacy protocols in context
- Domain 5: Device Security, including IoT and Bluetooth
- Domain 2: Physical Security, including surveillance, access control, RFID/NFC
Threats and Governance
- Domain 6: Software Exploitations and Vulnerabilities
- Domain 7: Operational Standards, Policies and Risk Assessments
- Drill SLE, ARO, and ALE until the arithmetic is automatic.
Recovery, Crypto, and People
- Domain 8: Disaster Recovery and Computer Forensics
- Domain 9: Cryptography, including PKI
- Domain 10: Social Engineering
- Finish with full-length timed practice across all ten areas.
For a longer, step-by-step plan, see the full ITS study guide, and keep the ITS cheat sheet handy for last-day review. When you are ready to test yourself under realistic conditions, try the ITS practice tests to find which domains still need work.
Judging Prep Sources by Authority
Because pass-rate claims are unverified, the quality of your preparation sources matters even more. Not every resource carries equal authority.
- Highest authority: ETA's own Competency Requirements document (copyright 2024) and the exam details on ETA's credential page. These are the official objectives from which questions derive.
- Optional commercial preparation: eITprep's CompTIA Security+ Study Guide for ETA ITS lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. These are product features, not exam facts, and the 45 contact hours describe course time rather than anything about the two-hour written exam. The course does not itself confer certification, and its public description does not identify a Security+ exam edition, so map anything you learn from it back to ETA's published competencies.
- Lowest authority: unofficial crowd-sourced question sets and third-party commercial listings. These may be useful for practice volume but cannot replace the issuer blueprint, and their accuracy is unverified.
If you are still orienting yourself to the credential, our overview pages on what ITS certification is and the ITS training options are good starting points before you commit to a prep plan.
Frequently Asked Questions
No issuer-wide ITS pass rate has been verified, and ETA has not published one in the sources reviewed. Treat any specific percentage you encounter as unconfirmed unless it cites ETA directly. The 75% figure refers to the passing score, not the share of candidates who pass.
You need 75%, which means at least 75 correct answers on the 100-question written exam. You have two hours, and Trapeza displays your result immediately after you finish.
Yes. One eligible free retake is available after a 30-day wait and must be completed within one year of your first exam. If you retake remotely, the proctoring fee still applies.
ETA's competency document does not publish percentage weights for the ten competency areas, so none should be assumed. ETA states that questions derive from the competencies, which means you should prepare across all ten areas rather than gambling on a few.
No. ETA International's Information Technology Security (ITS) is a separate credential from Certiport's Information Technology Specialist exams. They have different issuers, formats, and objectives, so do not mix their fees or pass-rate claims.
Without a published pass rate, your best strategy is to anchor on what ETA does publish: the 2024 competencies, the 100-question and two-hour format, the 75% threshold, and the retake policy. Build scenario fluency across all ten domains, verify fees on ETA's own pages, and use realistic practice testing to measure readiness rather than relying on anyone's unverified statistics.