- The 75% Rule and What It Means in Practice
- Turning 75% Into Question Counts
- Exam Format, Timing and Test-Day Mechanics
- Where the Points Come From: Ten Competency Areas
- Worked Scenarios in the ITS Style
- Results, Retakes and Fees
- A Domain-Ordered Plan for Reaching 75%
- After You Pass: Term, Maintenance and Rollover
- Frequently Asked Questions
- ETA's Information Technology Security (ITS) exam has 100 questions, a two-hour limit and a 75% passing score.
- ETA publishes no domain percentage weights, so study all ten competency areas rather than gambling on a few.
- The exam fee is USD 105; remote proctoring through ExamRoom.AI adds USD 16.
- Trapeza shows results immediately; one free retake is available after a 30-day wait, within one year.
The 75% Rule and What It Means in Practice
The ETA International Information Technology Security (ITS) certification is a written knowledge examination with a stated passing score of 75%. That figure comes from the ITS listing in ETA's Certification Booklet and the exact credential page on etai.org. There is no hands-on component, so your result depends entirely on how well you answer 100 written questions in two hours.
Two clarifications save candidates a lot of confusion before they start studying:
- This is ETA's ITS, not Certiport's. Certiport sells a separate family of "Information Technology Specialist" exams. Their scoring, format and fees are different, so do not carry numbers over from those pages.
- A passing score is not a pass rate. "75% to pass" tells you the bar. It does not tell you what share of candidates clear it. No issuer-wide ITS pass rate has been verified, and this article will not invent one. For a fuller discussion of what the data does and does not show, see our ITS pass rate analysis.
Turning 75% Into Question Counts
With 100 questions on the exam, the arithmetic is straightforward: you need 75 correct answers to meet a 75% threshold, which means you can miss up to 25. Treat this as a planning model, not a guarantee of how every form is scored. ETA's published materials state the percentage and the question count; they do not publish a scaled-score conversion, so avoid assuming any scoring adjustments beyond what the issuer documents.
| Item | Published value | What it means for you |
|---|---|---|
| Question count | 100 | Each question is roughly 1% of the total if scored equally |
| Time limit | 2 hours | About 72 seconds per question on average |
| Passing score | 75% | Aim to answer 75 of 100 correctly; target higher in practice |
| Hands-on assessment | None | Entirely written knowledge testing |
| Domain weights | Not published | No safe way to skip a competency area |
Since ETA does not publish weights, it would be misleading to say any domain is worth a fixed percentage. The competency document lists ten major areas, and ETA states that exam questions derive from the respective competencies. The safest reading is that every area can appear, so your preparation should leave no area untouched.
Exam Format, Timing and Test-Day Mechanics
The 100-question, two-hour structure leaves reasonable pacing room if you know the material, but it punishes hesitation on vocabulary-heavy items. Keep exam facts separate from preparation-product facts: the question count and time limit belong to the real exam, while flashcard counts, practice-exam counts and "contact hours" belong to study products.
How testing is arranged
You arrange testing with an ETA Certification Administrator. Delivery options include Trapeza online testing or paper and pencil. Remotely proctored testing is available through ExamRoom.AI after you register with ETA. For the remote option:
- Remote testing adds USD 16 for this two-hour exam.
- Initial scheduling can take up to 72 hours, so do not book a remote slot the night before you need it.
- You need a working webcam, microphone, a recent computer and at least 3 Mbps internet.
- Photo ID is required.
- Scratch paper and non-programmable or scientific calculators are permitted; used scratch paper must be surrendered.
- Phones are prohibited, and you may not leave the room once testing starts.
The "no leaving the room" rule matters for a two-hour exam. Plan ahead for comfort and timing before you begin, because there is no break option mid-session.
For scheduling windows and deadlines, see our ITS exam dates guide, and for prerequisites see ITS requirements.
Where the Points Come From: Ten Competency Areas
Because ETA draws questions from its published competency requirements (the 2024 edition, an eight-page document), the ten major areas are your real blueprint. Below is what each demands, using ETA's own area names. For a deeper walk-through, see the complete ITS domains guide.
Domain 1: Network Hardware Security Fundamentals
Understand how network devices are secured and how hardware placement shapes a defensible network.
- Know the security role of common network devices and where each sits in a topology
- Be able to reason about segmentation and device hardening choices
Domain 2: Physical Security
Expect scenario questions that blend technology with facility controls.
- Surveillance and access-control decisions, including which control fits which risk
- RFID and NFC: what they enable and where they are exposed
Domain 3: Network Software Security
Focus on how software-level controls protect traffic and services.
- Security protocols, including legacy ones the competency document still references
- Cloud shared responsibility: who secures what under each service model
Domain 4: Wireless Security
Wireless questions tend to test which standard or protocol is appropriate and why older ones fall short.
- Legacy wireless security protocols appear in the competency document, so learn them in historical context
- Be able to explain why a weaker option was superseded
Domain 5: Device Security
Covers securing endpoints and connected devices.
- IoT device risks and Bluetooth exposure
- Basic hardening and configuration principles for endpoints
Domain 6: Software Exploitations and Vulnerabilities
Recognize attack types and match them to defenses.
- Identify an exploit category from a short description
- Know the typical mitigation for each category
Domain 7: Operational Standards, Policies and Risk Assessments
The quantitative heart of the exam.
- Single loss expectancy (SLE), annualized rate of occurrence (ARO) and annualized loss expectancy (ALE)
- How policies and standards guide operational decisions
Domain 8: Disaster Recovery and Computer Forensics
Pairs continuity planning with evidence handling.
- Recovery site types and how they trade cost against recovery speed
- Forensic principles, including preserving evidence integrity
Domain 9: Cryptography
Concepts over mathematics: know what each tool is for.
- Public key infrastructure (PKI): certificates, trust and the roles of the parties
- Symmetric versus asymmetric use cases, hashing and digital signatures
Domain 10: Social Engineering
Human-factor attacks and the controls that blunt them.
- Recognizing phishing-style, pretexting and tailgating patterns
- Matching training and procedural controls to each pattern
Worked Scenarios in the ITS Style
The scenarios below are original practice items written to mirror the competency areas. They are not drawn from the live exam. Working through them is a good way to find out whether you are on track for 75%.
Scenario 1: Risk math (Domain 7)
A server holding customer records has an estimated single loss expectancy of $40,000 per incident. Past data suggests an incident is expected about once every four years. What is the annualized loss expectancy?
Walkthrough: A once-every-four-years event has an ARO of 0.25. ALE = SLE × ARO = $40,000 × 0.25 = $10,000 per year. If a control costing $6,000 per year eliminated this risk entirely, it would be justified on cost alone; if it cost $15,000 per year, it would not.
Scenario 2: Cloud shared responsibility (Domain 3)
An organization moves a database to a cloud infrastructure-as-a-service platform. A breach later traces to an unpatched guest operating system. Who is responsible for that patching?
Walkthrough: Under an infrastructure-as-a-service model, the provider secures the underlying facility and hypervisor layer, but the customer manages the guest operating system, applications and data. The patching gap is the customer's responsibility. The key habit is to ask "which layer failed?" and then assign it by service model.
Scenario 3: Physical access control (Domain 2)
A data closet is protected by a keypad, but staff routinely prop the door open for deliveries and shared codes are written on sticky notes. Which weakness is most serious, and what control best addresses it?
Walkthrough: The shared, exposed codes defeat individual accountability, and a propped door defeats the barrier entirely. A badge-based reader that logs each entry per person, combined with door-held-open alarms and camera coverage, restores both prevention and audit. Expect questions that ask you to pick the control that fixes the actual failure, not merely a stronger-sounding one.
Scenario 4: RFID, NFC and Bluetooth exposure (Domains 2 and 5)
An access badge uses a short-range contactless protocol and a smart lock also pairs over Bluetooth. A tester copies a badge's signal from a few feet away in a crowded corridor. What category of risk does this show?
Walkthrough: This illustrates proximity-based capture or relay of a wireless credential, which is why range, encryption of the credential exchange and pairing authentication all matter. The defensive answer usually involves stronger credential protection, limiting pairing exposure and layering a second factor for sensitive doors.
Scenario 5: Recovery sites (Domain 8)
A business can tolerate only a few hours of downtime for its order system but has a modest budget. Which recovery site approach fits best?
Walkthrough: The tradeoff runs along a spectrum: a hot site is ready fastest and costs the most, a warm site is partly equipped and slower, and a cold site is cheapest and slowest. A tolerance of a few hours points toward a hot or well-prepared warm arrangement; a cold site would almost certainly miss the target. Always anchor your answer to the stated downtime tolerance.
Scenario 6: PKI trust (Domain 9)
A user's browser warns that a website's certificate was not issued by a trusted authority. What does the warning indicate about the chain of trust?
Walkthrough: In PKI, trust flows from a certificate authority your system already trusts down to the site's certificate. If the issuing authority is unknown or the chain is broken, the browser cannot verify the site's identity, so the warning is correct to appear. The exam favors understanding this relationship over memorizing cipher details.
Scenario 7: Social engineering (Domain 10)
An employee receives a call from someone claiming to be from IT who urgently needs a password "to prevent an account lockout." What attack pattern is this, and what is the best control?
Walkthrough: This is pretexting combined with urgency, a classic social-engineering pressure tactic. The strongest control is procedural: IT never asks for passwords, and staff verify requests through a known channel before acting. Technical controls help, but training and clear policy are the point of this competency area.
Key Takeaway
Get the quantitative and "which layer failed" questions reliably right first. ALE/SLE/ARO math, shared-responsibility assignments and recovery-site selection are the kind of items you can lock in with practice, which gives you a buffer against vocabulary questions you might miss.
Results, Retakes and Fees
On Trapeza, results display immediately, so you will know whether you cleared 75% when you finish. If you fall short, ETA allows one eligible free retake under these conditions:
- You must wait 30 days after the unsuccessful attempt.
- The retake must be completed within one year of the first exam.
- If you retake remotely, the proctoring fee still applies.
The base exam fee is USD 105. Some third-party pages list different figures (an indexed ETA Press page showed USD 100 for the exam and USD 50 for the upgrade), but its full content and issuer affiliation remain unverified, and those numbers do not override ETA's current USD 105 exam fee and USD 55 upgrade fee. For the full picture of what you will spend, including remote proctoring and maintenance, see our ITS certification cost breakdown.
| Cost item | Amount | Notes |
|---|---|---|
| ITS exam fee | USD 105 | Current ETA price |
| Remote proctoring | USD 16 | Via ExamRoom.AI; applies to remote retakes too |
| Journeyman upgrade | USD 55 | Later option; requires CETa and at least two years of combined training/experience |
| Maintenance | USD 25 per year | USD 100 over the four-year cycle |
A Domain-Ordered Plan for Reaching 75%
Since ETA publishes no weights, your plan should cover all ten areas and put the extra repetition where it pays off fastest. The order below groups related topics and front-loads the quantitative material. It is a sample layout; compress or stretch it to fit your experience. Our ITS study guide expands on resources and pacing.
Foundations: Domains 1 and 3
- Network hardware roles, segmentation and security protocols
- Cloud shared responsibility under each service model
Physical and wireless: Domains 2, 4 and 5
- Surveillance, access control, RFID/NFC
- Wireless protocol history, IoT and Bluetooth risks
Threats and risk: Domains 6 and 7
- Exploit categories and mitigations
- Drill ALE, SLE and ARO until the math is automatic
Recovery, crypto and people: Domains 8, 9 and 10
- Recovery site selection and forensic handling
- PKI chain of trust, then social-engineering patterns
- Finish with a full timed run on our practice tests
Map any outside material back to ETA's 2024 competency objectives. Preparation-search results include unofficial question sets, commercial products and reference pages with very different levels of authority, and none replaces the issuer blueprint. One optional product, eITprep's study guide for ETA ITS, lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary and 45 course contact hours. Those are product features, not exam facts: the 45 hours describe course content, not exam length, and the course does not itself confer certification. The public description also does not state which Security+ edition it follows, so check every topic against ETA's own document.
When you are ready to test yourself under realistic conditions, take a timed attempt on our ITS practice test and score it against the 75-of-100 target.
After You Pass: Term, Maintenance and Rollover
The certification term is four years. ITS follows ETA's general, non-hands-on maintenance program, which offers two routes:
- Continuing education: submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle).
- Employer verification: submit a supervisor-completed Employer Verification Form instead of the hours.
Either route carries USD 25 annually (USD 100 over four years), and annual submission includes ETA membership.
The Security+ rollover alternative
A valid CompTIA Security+ (ce) credential provides an alternative route to the ITS credential for USD 105, with proof of the current certificate. Lifetime Security+ certificates are excluded. This is a credential-conversion path, not evidence that a CompTIA syllabus is the ETA ITS blueprint, so do not substitute one for the other when studying.
The Stand-Alone route does not require Associate CET (CETa). A later Journeyman upgrade does require CETa and at least two years of combined training and experience. To judge whether the credential justifies the effort, read our ROI analysis. Note that ETA's official fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032, so treat them as dated context rather than current pay evidence. Our salary guide discusses how to interpret that data responsibly.
Frequently Asked Questions
The passing score is 75%. The written exam has 100 questions and a two-hour limit, so you should plan to answer at least 75 correctly. ETA publishes the threshold but no scaled-score conversion, so treat 75 of 100 as your working target.
ETA does not publish percentage weights for the ten competency areas, and none should be inferred from how many subtopics each contains. The issuer states that exam questions derive from the competencies, so prepare across all ten rather than skipping any.
You receive results immediately on Trapeza. ETA offers one eligible free retake after a 30-day wait, and it must be completed within one year of the first exam. A remote retake still incurs the USD 16 proctoring fee.
No. The passing score is the minimum result you must achieve, not a pass rate. No issuer-wide ITS pass rate has been verified, so any specific pass-rate claim should be treated with caution.
No. They are separate credentials from different issuers with different formats, fees and scoring. This article covers only ETA's Information Technology Security (ITS), and the 75% score, 100 questions and two-hour limit apply only to that exam.
Passing the ETA ITS comes down to a clear target: 75 correct answers out of 100 across ten competency areas that ETA does not weight for you. Read the issuer's 2024 competency document, practice the calculation and "which layer failed" questions until they are routine, and confirm your readiness under timed conditions before you pay the USD 105 fee.