- What "ITS Training" Actually Covers
- The Exam You Are Training For
- Training Blocks for Each of the Ten Competencies
- Worked Scenarios You Should Be Able to Solve
- Choosing Training Resources by Authority
- Sequencing the Domains Across Your Weeks
- Registration, Remote Proctoring, and Test-Day Rules
- Training Does Not End at Certification
- Frequently Asked Questions
- ETA's ITS exam is 100 written questions in two hours, with a 75% passing score and no hands-on component.
- ETA says exam questions derive from its published competency requirements, so train against that document first.
- The exam fee is USD 105; remote proctoring through ExamRoom.AI adds USD 16.
- Ten domains run from network hardware security through social engineering; ETA publishes no domain weights.
What "ITS Training" Actually Covers
When people search for ITS training, they usually mean one of three things: a structured course, a self-directed study plan, or the continuing education that keeps the credential active. This article treats all three, but it starts with a clarification, because the acronym causes real confusion. Here, ITS means Information Technology Security, the credential administered by ETA International. It is not Certiport's Information Technology Specialist line, which is a separate program with its own exams and objectives. If you want the basics of the credential first, see What Is ITS Certification? and What Does ITS Stand For?.
Good ITS training is built backward from the exam. ETA publishes an eight-page set of Competency Requirements (copyright 2024) and states that examination questions derive from those competencies. That document, not a vendor's course outline, is the real syllabus. Everything else, whether a book, video series, or practice exam, is useful only to the extent that it maps onto those ten areas.
The Exam You Are Training For
Knowing the format shapes how you train. ITS is a written knowledge examination, not a lab or simulation. There is no hands-on assessment, which means your preparation should emphasize recognition, comparison, and applied reasoning over command-line muscle memory.
| Item | ITS Detail |
|---|---|
| Administrator | ETA International |
| Question count | 100 written questions |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Certification term | Four years |
| Hands-on component | None |
Two hours for 100 questions averages out to roughly 72 seconds per question, which is generous for recall items but tight if you let scenario questions drag. Part of your training should be practicing at that pace. For more on the numbers behind the threshold, read ITS Passing Score 2026, and for how the effort compares with other credentials, How Hard Is the ITS Exam?.
Training Blocks for Each of the Ten Competencies
ETA does not publish percentage weights, so do not assume any domain is "light." The ten headings below are the major areas of the competency document. Train each one to the level where you can explain a concept, distinguish it from a near neighbor, and apply it to a short scenario. A full breakdown lives in ITS Exam Domains 2026: Complete Guide to All 10 Content Areas; here is how to think about training each one.
Domain 1: Network Hardware Security Fundamentals
Understand how the physical and logical components of a network can be hardened and where each one fits in a defense-in-depth design.
- Know what each device does and what attacks it is exposed to
- Be able to place security controls at appropriate points in a network layout
- Practice explaining why one control complements rather than replaces another
Domain 2: Physical Security
Physical controls are easy to underestimate because they feel less technical, yet the exam expects precision about how they work together.
- Surveillance and access control: what each layer deters, detects, or delays
- RFID and NFC: read range, cloning and skimming risks, and appropriate use
- Tie physical measures back to the assets they protect
Domain 3: Network Software Security
Focus on the software-based controls and protocols that protect traffic and services, including how they behave when misconfigured.
- Learn each security protocol's purpose, and note where older versions are considered weak
- The competency document includes legacy protocols and older standards editions, so study them in historical context
Domain 4: Wireless Security
Wireless questions reward candidates who can compare standards and recognize attack types.
- Trace the evolution of wireless protection standards and why older ones were retired
- Recognize common wireless attacks and the countermeasures that address each
- Understand Bluetooth exposure alongside Wi-Fi
Domain 5: Device Security
Endpoints, mobile devices, and connected hardware all appear here, so train on the controls that protect them.
- Mobile and endpoint hardening measures
- IoT risks: default credentials, patching gaps, and network segmentation as a mitigation
Domain 6: Software Exploitations and Vulnerabilities
Expect to match an attack description to its name and its best countermeasure.
- Distinguish malware categories by behavior, not just by name
- Know how injection, overflow, and similar exploit classes work conceptually
- Pair each vulnerability class with the practice that reduces it
Domain 7: Operational Standards, Policies and Risk Assessments
This is where quantitative questions tend to appear, so practice the arithmetic until it is automatic.
- Risk formulas: SLE, ARO, and ALE and how they relate
- Policy purpose versus procedure versus standard
- Cloud shared responsibility and how duties shift across service models
Domain 8: Disaster Recovery and Computer Forensics
Combine continuity planning with evidence-handling discipline.
- Recovery site types and the trade-off between cost and speed of recovery
- Backup strategies and the reasoning behind each
- Forensic principles: preserving evidence, documenting handling, and order of volatility
Domain 9: Cryptography
You do not need to derive algorithms, but you must reason clearly about what each cryptographic tool provides.
- Symmetric versus asymmetric encryption and where each is used
- Hashing, digital signatures, and the guarantees each supplies
- PKI: certificate authorities, certificates, and the chain of trust
Domain 10: Social Engineering
Human-factor questions are scenario-heavy, so practice classifying the technique and naming the defense.
- Phishing and its variants, pretexting, tailgating, and similar tactics
- Awareness training and procedural controls as the main countermeasures
Worked Scenarios You Should Be Able to Solve
Working through scenarios is the most efficient way to convert reading into exam readiness. Try these before checking the reasoning.
Scenario 1: Cloud shared responsibility
A company moves a database to an infrastructure-as-a-service virtual machine and assumes the provider will patch the operating system. Who is responsible? In the IaaS model, the provider secures the underlying facility, hardware, and virtualization layer, while the customer remains responsible for the guest operating system, applications, and data. The assumption is wrong. As you move toward platform and software service models, more responsibility shifts to the provider, but data and access governance generally stay with the customer.
Scenario 2: Annualized loss expectancy
An asset would lose 40,000 dollars of value in a single incident (the SLE), and the incident is expected about once every four years (an ARO of 0.25). ALE equals SLE multiplied by ARO, so the ALE is 10,000 dollars per year. If a safeguard costs 15,000 dollars per year, it exceeds the expected annual loss and is hard to justify on purely financial grounds. Practice reversing the formula too, since questions may give you ALE and ask for a missing input.
Scenario 3: Recovery site selection
A business needs to resume operations within minutes of an outage and can fund duplicate infrastructure. A hot site, with equipment and current data ready to run, fits that requirement. A cold site offers space and utilities only and takes far longer to bring online, while a warm site sits between them. The exam tests whether you can match recovery time requirements to cost.
Scenario 4: Physical access and RFID
An office uses proximity badges. A visitor holds a concealed reader near an employee in an elevator and later replays the captured signal to open a door. This is a skimming and cloning risk. Mitigations include shielded badge holders, stronger credential technologies, multifactor access at sensitive doors, and surveillance covering entry points. Notice how one scenario spans Domain 2 and the device-level controls in Domain 5.
Scenario 5: PKI trust
A browser warns that a site's certificate is signed by an unknown authority. The chain of trust runs from the site certificate up through intermediates to a root the client trusts. If the chain cannot be validated, the client has no basis to believe the site is who it claims to be. Know what a certificate binds together, who vouches for it, and what revocation is for.
Scenario 6: Social engineering
An employee receives a call from someone claiming to be IT support, urgently requesting a password to "prevent account lockout." The attacker is using pretexting combined with urgency. The correct defenses are a verification procedure, a policy that support never asks for passwords, and recurring awareness training.
Key Takeaway
The exam rewards candidates who can move between a concept and a situation. For every term you learn, write one sentence describing a realistic scenario where it applies and one describing the control that addresses it.
Choosing Training Resources by Authority
Not all preparation material is equal, and treating it as such is the most common training mistake. Rank what you use by how closely it connects to the issuer.
- ETA's published Competency Requirements. This is the authoritative blueprint. Print it and treat each line as a study item.
- ETA's certification booklet and credential page. These govern format, fees, and rules.
- Third-party courses. eITprep offers a CompTIA Security+ Study Guide for ETA ITS, listed at USD 59.95 for six months, with two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Those are product features and course hours, not exam facts, and the course does not itself confer certification. The public description does not identify a Security+ edition, so map anything you study there to ETA's 2024 competencies rather than assuming it matches.
- Unofficial question banks. Public cheat sheets and community question dumps vary in accuracy and may be outdated. Use them to find gaps, never as a primary source.
For a structured plan built on these priorities, see ITS Study Guide 2026: How to Pass on Your First Attempt, and keep the one-page reference in ITS Cheat Sheet 2026 nearby for late-stage review. You can also test yourself with realistic questions on our ITS practice test site.
Sequencing the Domains Across Your Weeks
Because no weights are published, schedule by dependency rather than by perceived importance. Foundational network knowledge makes later domains easier, and quantitative or terminology-heavy topics benefit from repeated exposure. This is a six-week sketch; stretch it if you are newer to networking, since ETA recommends prior computer-systems and networking experience.
Foundations: Domains 1 and 3
- Network hardware roles and software protocol security
- Build a one-page map of where controls sit in a network
Perimeter and endpoints: Domains 4 and 5
- Wireless standards and attack types
- IoT, Bluetooth, and mobile device controls
Threats: Domains 6 and 10
- Exploit classes and malware behavior
- Social engineering techniques paired with defenses
Physical and policy: Domains 2 and 7
- Surveillance, access control, RFID and NFC
- Drill SLE, ARO, ALE until calculations are quick
Resilience and crypto: Domains 8 and 9
- Recovery sites, backups, forensic handling
- Symmetric, asymmetric, hashing, and PKI
Integration
- Timed 100-question sets at roughly 72 seconds per question
- Revisit the domains where scenario questions trip you up
Registration, Remote Proctoring, and Test-Day Rules
Logistics are part of training, because a preventable problem on exam day wastes everything you have studied. Testing is arranged with an ETA Certification Administrator, through Trapeza online testing or paper and pencil. Remotely proctored testing is available through ExamRoom.AI after you register with ETA.
- Cost: USD 105 for the exam; remote proctoring adds USD 16 for this two-hour exam. Full detail in ITS Certification Cost 2026.
- Scheduling lead time: initial remote scheduling can take up to 72 hours.
- Equipment: a working webcam, microphone, a recent computer, and at least 3 Mbps internet.
- Rules: photo ID is required; scratch paper and non-programmable or scientific calculators are permitted, and used scratch paper must be surrendered. Phones are prohibited, and you may not leave the room after testing starts.
- Results: Trapeza displays results immediately.
- Retake: after an unsuccessful attempt, one eligible free retake is available following a 30-day wait and must be completed within one year of the first exam. A remote retake still incurs the proctoring fee.
Run a full practice session under these conditions, including using only scratch paper and a basic calculator for the risk formulas. Check dates and windows in ITS Exam Dates 2026 and eligibility details in ITS Requirements 2026. The Stand-Alone route does not require Associate CET (CETa), though prior networking experience and certification are recommended preparation.
Training Does Not End at Certification
The credential runs for four years, and ongoing training is how you keep it. ITS follows ETA's general, non-hands-on Maintenance program. You have two paths:
- Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle), or
- Submit a supervisor-completed Employer Verification Form.
Either path carries USD 25 annually, or USD 100 over four years, and annual submission includes ETA membership. If you already hold a valid CompTIA Security+ (ce) credential, an alternative ITS rollover route exists for USD 105 with proof of the current certificate; lifetime Security+ certificates are excluded. That rollover is a separate credential route and does not make a CompTIA syllabus the ETA ITS blueprint. A later Journeyman upgrade requires CETa plus at least two years of combined training and experience, with a USD 55 upgrade fee.
If you are weighing the career side, read Is the ITS Certification Worth It?, ITS Salary Guide 2026, and ITS Jobs. A caution on pay: ETA's official fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032, so neither should be read as current salary evidence or a certification-specific pay premium.
Frequently Asked Questions
The written exam has 100 questions with a two-hour limit. A score of 75% is required to pass, and there is no hands-on assessment.
No. ETA's published Competency Requirements are the authoritative blueprint, and exam questions derive from them. Courses such as eITprep's are optional aids, and you should map any course content back to ETA's 2024 competencies.
No. ETA's competency document lists ten major areas without percentage weights, so prepare all ten rather than guessing which count more.
One eligible free retake is available after a 30-day wait and must be completed within one year of the first exam. A remote retake still incurs the proctoring fee.
Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually, or a supervisor-completed Employer Verification Form, plus USD 25 per year. The certification term is four years.
Effective ITS training is narrow and deliberate: start from ETA's competency document, train all ten domains with scenarios rather than memorization alone, rehearse the exam's pace and rules, and plan for maintenance from day one. When you are ready to test your recall, try the questions on our main practice test, and revisit ITS Certification for the broader picture.