- What "ITS" Means on This Site
- Who Issues the Credential
- The Exam at a Glance
- The Ten Competency Areas
- Worked Scenarios From the Blueprint
- Registration, Testing and Exam-Day Rules
- Stand-Alone, Journeyman and Security+ Rollover
- Keeping the Credential Current
- Preparing Against the Right Blueprint
- Who Hires and Who Benefits
- Frequently Asked Questions
- ITS here means ETA International's Information Technology Security credential, not Certiport's Information Technology Specialist exams.
- The written exam has 100 questions, a two-hour limit, a 75% passing score and a USD 105 fee.
- Ten published competency areas drive the questions, and ETA publishes no percentage weights for them.
- Certification lasts four years; maintenance needs 40 continuing-education hours or an employer verification form, plus USD 100 over the cycle.
What "ITS" Means on This Site
The acronym ITS is shared by several unrelated credentials and products, which is why searches for it return a confusing mix of results. On this site, ITS means Information Technology Security, a certification administered by ETA International. It is a knowledge-based credential covering how networks, devices, software, people and facilities are protected. If you are looking for the broader definition questions, the companion articles on what ITS stands for and the meaning of ITS cover the naming side in more depth.
Who Issues the Credential
ETA International is a certification body best known for electronics and technician credentials. Its ITS credential sits in the information technology portion of its catalog and targets practicing technicians who need documented security knowledge. The questions are built from a published document, the Information Technology Security (ITS) Competency Requirements (copyright 2024, eight pages), which ETA states is the source of examination questions. That makes the competency document the single most authoritative study reference you can get. For a fuller walkthrough of the credential itself, see our ITS certification overview and what ITS certification involves.
The Exam at a Glance
The format is deliberately simple: a written knowledge examination with no hands-on component. You are tested on what you know, not on configuring live equipment.
| Item | ETA Information Technology Security (ITS) |
|---|---|
| Format | Written knowledge exam, no hands-on assessment |
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Certification term | Four years |
| Remote proctoring surcharge | USD 16 for this two-hour exam |
| Free retake | One eligible retake after a 30-day wait, within one year of the first exam |
Two clarifications save candidates confusion. First, 75% is a score threshold, not a pass rate; no issuer-wide pass rate has been verified, so be skeptical of any site quoting one. We discuss what is and is not known in the pass rate article, and the scoring mechanics in the passing score guide. Second, the 100-question count describes the real exam only. Practice products and courses advertise their own question, flashcard and contact-hour counts, and those numbers say nothing about the exam itself. For total costs, including maintenance, see the full pricing breakdown.
The Ten Competency Areas
The ETA competency document organizes the exam into ten major numbered areas. ETA does not publish percentage weights for them, so any site claiming "Domain 4 is 15% of the exam" is inventing numbers. Treat all ten as fair game and study in proportion to your own weaknesses. A deeper treatment lives in the complete domains guide; here is what each area demands.
Domain 1: Network Hardware Security Fundamentals
Securing the devices that move and filter traffic.
- Routers, switches, firewalls and the hardening practices around them
- Segmentation and how hardware placement shapes an attack surface
- The relationship between network design and security controls
Domain 2: Physical Security
Protecting the facility, because logical controls fail when someone can walk up to the rack.
- Surveillance and access control methods
- RFID and NFC credentials and their weaknesses
- Environmental and perimeter considerations
Domain 3: Network Software Security
The protocols and software layers that protect data in transit and at rest.
- Secure versus insecure protocols and what replaced what
- Authentication and access management concepts
- Cloud service models and who is responsible for which controls
Domain 4: Wireless Security
Wireless is where legacy and modern standards collide most visibly.
- Wireless encryption and authentication standards, including older ones you must still recognize
- Common wireless attacks and countermeasures
- Rogue access points and monitoring
Domain 5: Device Security
Endpoints, mobile devices and the growing category of connected hardware.
- Endpoint hardening and mobile device protection
- IoT and Bluetooth risks
- Peripheral and removable-media threats
Domain 6: Software Exploitations and Vulnerabilities
How attackers abuse flaws, and how defenders reduce exposure.
- Malware categories and attack techniques
- Vulnerability types and patching
- Application-layer weaknesses
Domain 7: Operational Standards, Policies and Risk Assessments
The management side: documenting, measuring and governing risk.
- Security policies and operational standards
- Risk assessment, including quantitative formulas such as SLE, ARO and ALE
- Roles, responsibilities and compliance concepts
Domain 8: Disaster Recovery and Computer Forensics
Surviving incidents and preserving evidence afterward.
- Recovery site types and their cost-versus-speed tradeoffs
- Backup strategies and continuity planning
- Evidence handling and forensic process
Domain 9: Cryptography
The mathematics-light but concept-heavy foundation of confidentiality and integrity.
- Symmetric versus asymmetric encryption and hashing
- Public key infrastructure, certificates and trust chains
- Digital signatures and key management
Domain 10: Social Engineering
The human attack surface.
- Phishing, pretexting, tailgating and related techniques
- Why awareness training and procedure matter
- How social engineering combines with physical and technical attacks
Worked Scenarios From the Blueprint
The competency areas reward applied reasoning more than rote recall. These original scenarios show the style of thinking to practice. They are illustrations, not actual exam items.
Cloud shared responsibility
A company moves its customer database to a provider's infrastructure-as-a-service platform, and a breach later exposes records because a storage bucket was left publicly accessible. Who is responsible? The provider secures the underlying facilities and hypervisor, but configuring access to the customer's own storage falls to the customer. The model shifts as you move toward platform and software services, with the provider taking on more layers. Knowing where the line sits for each service model is the core skill.
Physical surveillance and access control
An office uses badge readers on every door but no cameras, and an audit finds shared badges. The badge log proves a credential was used, not who used it. Cameras provide detective evidence that ties a person to an event, while the badge system provides preventive control. A good answer layers both and adds procedures against badge sharing.
RFID and NFC
Proximity cards are convenient because they transmit without contact, and that same property is their weakness: an attacker with a reader can attempt to capture or clone signals at close range. Mitigations include shielded card holders, stronger credential technologies and pairing the card with a second factor at sensitive doors.
IoT and Bluetooth
A facility installs connected sensors with default credentials and leaves Bluetooth discoverable on staff devices. The risks are unpatched firmware, unchanged defaults, and unwanted pairing. Controls include changing default credentials, isolating connected devices on their own network segment, disabling discoverability and keeping firmware current.
ALE, SLE and ARO
These three terms form one small formula you should be able to run quickly. The single loss expectancy (SLE) is the cost of one incident. The annualized rate of occurrence (ARO) is how many times per year you expect it. Multiply them and you get the annualized loss expectancy (ALE). If a single incident would cost 20,000 and you expect it twice a year, the ALE is 40,000, which tells you the most it makes sense to spend annually on a control for that risk. The arithmetic is trivial; the exam difficulty is remembering which term means what under pressure.
Recovery sites
A hot site is fully equipped and can take over within a very short window but costs the most. A warm site has equipment and connectivity but needs data restored. A cold site offers space and basics only, so it is the cheapest and slowest. Match the choice to how long the business can tolerate downtime and how much it can spend.
PKI
When a browser trusts a website certificate, it is following a chain: the site's certificate was signed by an intermediate authority, which was signed by a root authority the device already trusts. If any link is expired, revoked or untrusted, the chain breaks. Understand the roles of the certificate authority, the registration process, certificate revocation and the difference between the public key anyone can see and the private key that must stay secret.
Social engineering
Someone in a delivery uniform follows an employee through a secured door. That is tailgating, and no firewall stops it. The countermeasures are procedural: challenge unfamiliar people, require badges to be visible, train staff to treat polite resistance as normal, and install mantraps where risk justifies it.
Key Takeaway
Notice how many scenarios cross domain lines. A social engineering attack defeats a physical control, which exposes a device, which leads to a forensic investigation. Study the ten areas separately, then practice linking them.
Registration, Testing and Exam-Day Rules
You arrange testing with an ETA Certification Administrator. Two delivery methods are used: Trapeza online testing or paper and pencil at an administrator's site. Remotely proctored testing is also available through ExamRoom.AI after you register with ETA. The remote option adds USD 16 for this two-hour exam, and initial scheduling can take up to 72 hours, so do not plan a same-day sitting. Scheduling specifics are covered in the exam dates guide.
- Remote requirements: a working webcam, a microphone, a recent computer and at least 3 Mbps internet.
- Identification: photo ID is required.
- Allowed materials: scratch paper and non-programmable or scientific calculators. Used scratch paper must be surrendered afterward.
- Prohibited: phones, and you may not leave the room once testing starts.
- Results: Trapeza displays results immediately.
If you fail, one eligible free retake is available after a 30-day wait and must be taken within one year of the first exam. A remote retake still incurs the proctoring fee.
Stand-Alone, Journeyman and Security+ Rollover
ITS can be earned as a Stand-Alone credential, and that route does not require Associate CET (CETa). Candidates who later want to pursue the Journeyman upgrade need CETa and at least two years of combined training and experience; the upgrade fee is USD 55. ETA's competency document recommends prior computer-systems and networking experience and prior IT or networking certification as preparation, and ETA's issuer badge lists practicing-technician experience, the written exam and acceptance of the Code of Conduct. For a plain-language eligibility rundown, read the requirements guide.
| Route | What it needs | Cost noted |
|---|---|---|
| Stand-Alone exam | Pass the written exam; CETa not required | USD 105 exam fee |
| Journeyman upgrade (later) | CETa plus at least two years of combined training and experience | USD 55 upgrade fee |
| Security+ (ce) rollover | Proof of a current CompTIA Security+ (ce) certificate; lifetime certificates excluded | USD 105 |
You may also see an ETA Press page listing USD 100 for the exam and USD 50 for the upgrade. Its full content and issuer affiliation could not be verified, so rely on ETA's own current figures of USD 105 and USD 55.
Keeping the Credential Current
The certification term is four years, and ITS follows ETA's general non-hands-on maintenance program. You have two paths:
- Continuing education: submit the Certification Maintenance Form with 10 relevant continuing-education hours annually, 40 over the four-year cycle.
- Employer verification: submit a supervisor-completed Employer Verification Form instead.
Either path carries a fee of USD 25 annually, USD 100 over the four years, and the annual submission includes ETA membership. The maintenance rules mean the true cost of holding the credential extends beyond the exam fee, a point we expand on in the ROI analysis.
Preparing Against the Right Blueprint
Start with ETA's eight-page competency document and treat each of the ten headings as a checklist. Then choose supplements with their authority in mind. Optional commercial resources exist, including eITprep's CompTIA Security+ Study Guide for ETA ITS, listed at USD 59.95 for six months with two custom practice exams, 100 electronic flashcards, a searchable glossary and 45 course contact hours. Those are features of a preparation product, not facts about the exam, and the course does not itself confer certification. The public description does not name a Security+ edition, so map anything you learn from it back to ETA's 2024 competencies. Unofficial question dumps and cheat sheets circulating on document-sharing sites have no guaranteed accuracy and should never replace the blueprint.
If you want a sequencing suggestion, tie your weeks to the domains. Cryptography (Domain 9) and risk formulas (Domain 7) are the most concept-dense, so give them early, separate sessions. Reserve the final stretch for cross-domain scenarios and timed practice that mimics 100 questions in two hours, roughly 72 seconds per question. Our ITS study guide builds this into a full plan, the cheat sheet helps with last-minute review, and the training overview compares learning formats. When you are ready to test yourself, try the ITS practice tests and judge the difficulty for yourself, then compare with our view in the difficulty guide.
Who Hires and Who Benefits
The credential is aimed at practicing technicians in IT and electronics-adjacent roles who handle or support networked equipment and need to demonstrate baseline security literacy: field and service technicians, help-desk and network support staff, and employers who want a documented, vendor-neutral security credential on a technician's record. Opportunities are explored further in the ITS jobs overview.
Frequently Asked Questions
No. They are separate programs from different issuers with different blueprints, fees and testing mechanics. This site covers ETA's Information Technology Security credential only.
The written exam has 100 questions with a two-hour limit. You need a 75% score to pass. There is no hands-on portion.
The exam fee is USD 105, with a USD 16 surcharge for remote proctoring. Maintenance is USD 25 annually, USD 100 over the four-year term. See the pricing breakdown for the full picture.
A valid CompTIA Security+ (ce) credential can be rolled over to ITS for USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded.
One eligible free retake is available after a 30-day wait and must be completed within one year of the first exam. A remote retake still incurs the proctoring fee.
Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over four years), or a supervisor-completed Employer Verification Form, plus the annual fee.