ITS Study Guide 2026: How to Pass on Your First Attempt

Which ITS This Guide Covers

"ITS" appears on several credentials, so settle this first. This guide covers Information Technology Security (ITS), the written certification administered by ETA International. It is not Certiport's Information Technology Specialist line, and nothing here applies to those exams. If you are still orienting yourself, start with What Is ITS Certification? and then return.

ETA positions ITS as a knowledge credential for technicians who work with networks, devices, and the policies around them. The competency document recommends prior computer-systems and networking experience, and prior IT or networking certification, as preparation. That recommendation matters for planning: if networking fundamentals are shaky, fix them before you start memorizing security terminology. The full eligibility picture is in ITS Requirements 2026.

The Exam Format and Logistics

Know the container before you study the contents. According to ETA's certification booklet and credential page, the ITS exam is:

At 75%, you need roughly 75 of 100 correct, so you can miss about 25 questions and still pass. Two hours for 100 questions gives you about 72 seconds per item on average, which is comfortable for recall questions but tight if you spend minutes on each calculation or scenario. Details on the threshold are in ITS Passing Score 2026, and the full fee picture is in ITS Certification Cost 2026.

How testing is arranged

You arrange testing through an ETA Certification Administrator. Options include Trapeza online testing or paper and pencil. Remote proctoring is available through ExamRoom.AI after you register with ETA. Remote testing adds USD 16 for this two-hour exam, and initial scheduling can take up to 72 hours, so do not book it the night before you want to sit. Remote candidates need a working webcam, a microphone, a recent computer, and at least 3 Mbps internet.

Photo ID is required. Scratch paper and non-programmable or scientific calculators are permitted, but used scratch paper must be surrendered. Phones are prohibited, and you may not leave the room after the exam starts. Because the exam includes risk math, practice with a basic calculator beforehand. Scheduling specifics are covered in ITS Exam Dates 2026.

Reading the Ten-Domain Blueprint

ETA states that examination questions derive from its published Information Technology Security Competency Requirements (2024 edition, an eight-page document on etai.org). This is your authoritative blueprint. Two cautions follow from that:

• No percentage weights are published. Anyone listing "Domain 4 is 15% of the exam" is guessing. Treat all ten domains as testable and spread your effort accordingly.
• The document includes legacy material. It references older security protocols and earlier standards editions. Expect to explain what these are, why they were replaced, and where they still appear, not just recite current best practice.

The ten domains, in the issuer's order:

1. Network Hardware Security Fundamentals
2. Physical Security
3. Network Software Security
4. Wireless Security
5. Device Security
6. Software Exploitations and Vulnerabilities
7. Operational Standards, Policies and Risk Assessments
8. Disaster Recovery and Computer Forensics
9. Cryptography
10. Social Engineering

For a broader tour of each area, read ITS Exam Domains 2026. This guide concentrates on how to prepare for them.

Domain-by-Domain Priorities

Worked Scenarios You Should Be Able to Solve

The competency document supports scenario-style thinking, so practice with problems rather than flashcards alone. The examples below are original illustrations, not leaked or recalled exam items.

Scenario 1: Risk math with ALE, SLE, and ARO

A small clinic estimates that a ransomware incident would cost USD 40,000 in lost operations and cleanup each time it occurs (the SLE). Based on industry reports it reviewed, management believes this could happen about once every four years, so the ARO is 0.25. The ALE is SLE × ARO = USD 40,000 × 0.25 = USD 10,000 per year.

Now the decision question: a backup and endpoint-protection package costs USD 6,000 per year and is expected to cut the ARO to 0.05. New ALE = 40,000 × 0.05 = USD 2,000. The annual reduction is USD 8,000, which exceeds the USD 6,000 cost, so the control is justified on these numbers. Practice stating the formula before you plug in values; the exam rewards knowing what each term means.

Scenario 2: Cloud shared responsibility

A company moves a database to an infrastructure-as-a-service virtual machine. A breach occurs because the database administrator account used a weak password. Who is responsible? The provider secures the underlying facilities, hardware, and hypervisor; the customer is responsible for the guest operating system, the database configuration, and account credentials. The weak password is the customer's responsibility. The key habit: as you move toward software-as-a-service, the provider takes on more of the stack, but identity and data governance stay with the customer in every model.

Scenario 3: Choosing a recovery site

A business can tolerate being offline for several days but has a tight budget. A cold site (space and utilities, with equipment brought in after a disaster) fits. If it needed to resume within hours, a hot site with mirrored systems fits instead, at much higher ongoing cost. A warm site sits between them. Frame these as a tradeoff between recovery time and cost, and you can answer most variations.

Scenario 4: PKI trust

A user's browser warns that a website's certificate is not trusted. What does the browser check? It validates that the certificate chains to a trusted certificate authority, that it has not expired or been revoked, and that the name matches the site. If any check fails, the warning appears. Be able to explain what the CA's signature proves and why a self-signed certificate triggers the warning.

Scenario 5: Social engineering and physical access

Someone in a delivery uniform follows an employee through a badge-controlled door. No technical control failed, but tailgating succeeded. The right answer combines human and physical measures: employee awareness and challenge procedures, plus a mantrap or turnstile where the risk justifies it. This scenario shows why Domains 2 and 10 are best studied together.

Sequencing the Domains Across Your Weeks

Rather than a generic template, order your study by dependency. Network fundamentals underpin wireless and device topics; risk math and policy underpin recovery planning. This example assumes six weeks; compress or stretch it to match your experience, and calibrate the pace with How Hard Is the ITS Exam?

One method note, kept deliberately brief: after each week, revisit earlier domains with a handful of questions rather than rereading. Mixed review is what makes a ten-domain written exam manageable.

Choosing Preparation Resources

Not all study material carries equal authority, and the differences matter here.

• ETA's competency document (highest authority): The official 2024 objectives from etai.org. Print it and check off every line as you learn it.
• Optional commercial courses: eITprep lists a CompTIA Security+ Study Guide for ETA ITS at USD 59.95 for six months, including two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Those are product features and course hours, not exam facts, and the course does not confer certification. The public description does not identify a Security+ edition, so map anything you study to ETA's published objectives rather than assuming alignment.
• Unofficial question dumps and cheat sheets: Public documents on sites like Studocu and third-party listings vary in accuracy and may be outdated. Use them, at most, to see question style, never as a source of truth.
• Practice questions: Use the ITS practice tests to rehearse the timing and scenario style, and keep the ETA objectives open to verify any answer you are unsure about.

If you are weighing whether the investment pays off, Is the ITS Certification Worth It? and the ITS Salary Guide discuss the evidence honestly; ETA's own fact sheet labels its wage data as 2016, so treat any pay figure with care. For roles that value the credential, see ITS Jobs.

The Security+ rollover alternative

If you already hold a valid CompTIA Security+ (ce) credential, ETA offers a rollover route to ITS for USD 105 with proof of your current certificate. Lifetime Security+ certificates are excluded. Note that this is a route to the credential, not evidence that Security+ content equals the ETA blueprint. If you hold neither credential and are choosing between them, remember they are separate programs from separate issuers with different formats and fees.

Exam Day, Retakes, and Staying Certified

Exam day

Results display immediately through Trapeza. Bring valid photo ID, plan your calculator in advance, and remember you cannot leave the room once testing begins. For remote candidates, test your webcam, microphone, and connection beforehand and keep your space clear.

If you do not pass

ETA provides one eligible free retake after a 30-day wait, and it must be completed within one year of the first exam. A remote retake still incurs the proctoring fee. Use the 30 days well: sort your missed topics by domain and rebuild those first rather than restarting from the beginning.

Keeping the credential current

ITS runs on a four-year certification term under ETA's general, non-hands-on maintenance program. You have two paths:

• Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 across the four-year cycle), or
• Submit a supervisor-completed Employer Verification Form.

Either way, the fee is USD 25 annually (USD 100 over four years), and annual submission includes ETA membership. The Stand-Alone route does not require the Associate CET (CETa). Separately, a later Journeyman upgrade requires CETa and at least two years of combined training and experience, with a USD 55 upgrade fee. One caution: an ETA Press page indexed online lists USD 100 and USD 50 figures, but its issuer affiliation is unverified and it does not supersede ETA's current USD 105 and USD 55 prices.

Frequently Asked Questions