- What the ITS Credential Actually Is
- Not the Certiport Credential: Clearing Up the Acronym
- Exam Format at a Glance
- The Ten Competency Areas
- Worked Scenarios the Exam Style Rewards
- Who Can Take It and What Experience Helps
- Registration, Remote Testing and Exam-Day Rules
- Retakes, Maintenance and the Security+ Rollover
- Preparation Resources and How Much to Trust Them
- Sequencing Your Preparation Around the Domains
- Career Context: Reading Salary Claims Carefully
- Frequently Asked Questions
- ETA International administers the Information Technology Security (ITS) credential: a 100-question, two-hour written exam with no hands-on component.
- A 75% score is required to pass, and the exam fee is USD 105 (remote proctoring adds USD 16).
- Exam questions derive from ten published competency areas, from network hardware security through social engineering.
- Certification lasts four years; maintenance needs 40 CE hours over the cycle or an employer verification form, plus fees.
What the ITS Credential Actually Is
ITS certification, in the sense used on this site, is the Information Technology Security credential issued by ETA International. It verifies that a technician understands how to protect networks, devices, facilities, software and people from threats, and that the candidate can reason through the policies, standards and recovery practices that surround security work. If you are brand new to the topic and want a broader orientation, the companion articles What Is ITS? and ITS Certification cover the basics from other angles.
The credential is built for working technicians rather than for academic security researchers. ETA publishes a competency document (copyright 2024) that lists exactly what a candidate is expected to know, and ETA states that examination questions derive from those competencies. That is unusually transparent. Rather than guessing at hidden exam content, you can read the blueprint, map your knowledge against it, and study the gaps.
Not the Certiport Credential: Clearing Up the Acronym
The letters "ITS" are used by more than one program in the IT world, which causes real confusion in search results. The ETA Information Technology Security credential is a separate thing from the Information Technology Specialist exams offered through Certiport. Different issuer, different exam structure, different fees, different subject matter. If a page you are reading quotes a fee, a question count or a domain list that does not match the figures in this article, check whether it is describing the Certiport program or some other credential entirely.
For the rest of this article, "ITS" means only the ETA Information Technology Security certification. For more on the naming question, see What Does ITS Stand For? and ITS Meaning.
Exam Format at a Glance
The ITS exam is a written knowledge examination. There is no lab, no simulation and no practical performance task. Everything is tested through questions, which means your preparation should emphasize understanding, terminology, and the ability to apply concepts to short scenarios.
| Item | Detail |
|---|---|
| Issuer | ETA International |
| Format | Written knowledge exam, no hands-on assessment |
| Number of questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Remote proctoring surcharge | USD 16 |
| Certification term | Four years |
A note on the 75% figure: it is a score threshold that each candidate must reach, not a statistic about how many people pass. No issuer-wide pass rate has been verified, so be skeptical of any site that quotes a precise one. Our article on the ITS passing score explains the threshold in more depth, and ITS Pass Rate discusses what can and cannot be said about outcomes.
At 100 questions in 120 minutes you have a little over a minute per item. That is comfortable for most candidates, but it does not leave room to agonize. Flag hard questions, finish the easy ones first, and return to the flagged items with whatever time remains.
The Ten Competency Areas
ETA's competency document organizes the exam into ten major areas. No percentage weights are published, so you should not assume any domain is worth more than another; treat all ten as fair game. Below is each area with the kind of understanding it demands. For a deeper breakdown, see ITS Exam Domains: Complete Guide to All 10 Content Areas.
Domain 1: Network Hardware Security Fundamentals
Securing the physical and logical devices that move data: routers, switches, firewalls and related infrastructure.
- Understand what each device does and how misconfiguration creates exposure
- Know how segmentation and access control limit the spread of an attack
- Be able to explain why default settings are a security liability
Domain 2: Physical Security
Controlling who can reach equipment and facilities, and detecting when they should not.
- Surveillance and monitoring, and what each camera or sensor type is good at
- Access control methods, including badges, biometrics and layered entry points
- RFID and NFC: how the technologies work and where they can be abused
Domain 3: Network Software Security
Protecting the protocols, services and software running on the network.
- Secure versus insecure protocols and their appropriate replacements
- Authentication and authorization concepts
- Cloud service models and the shared responsibility model
Domain 4: Wireless Security
Securing radio-based connectivity, which extends your network boundary beyond the walls.
- Wireless encryption and authentication standards, including legacy ones
- Common wireless attacks and the controls that counter them
- Bluetooth exposure and short-range wireless risks
Domain 5: Device Security
Hardening endpoints, mobile devices and connected things.
- Endpoint protection and configuration hardening
- Mobile device risks and management approaches
- IoT devices and why they are frequently weak points
Domain 6: Software Exploitations and Vulnerabilities
How attackers abuse software flaws and how defenders reduce that exposure.
- Recognizing common attack types and malware categories
- Patching, updating and vulnerability management
- Matching a described symptom to the likely exploit
Domain 7: Operational Standards, Policies and Risk Assessments
The governance layer: written rules, standards and the quantification of risk.
- Security policy purpose and structure
- Risk assessment concepts, including SLE, ARO and ALE calculations
- How standards and compliance expectations shape technical decisions
Domain 8: Disaster Recovery and Computer Forensics
Restoring operations after an incident and preserving evidence of what happened.
- Backup strategies and recovery site types
- Business continuity planning
- Evidence handling and the importance of preserving integrity
Domain 9: Cryptography
The mathematical protections behind confidentiality, integrity and authentication.
- Symmetric versus asymmetric encryption and when each is used
- Hashing and digital signatures
- Public key infrastructure, certificates and trust chains
Domain 10: Social Engineering
Attacks that target people rather than machines.
- Phishing and its variants, pretexting and impersonation
- Why human factors defeat technical controls
- Awareness training and procedural defenses
Worked Scenarios the Exam Style Rewards
Because the exam is written, many questions describe a situation and ask for the best response. Working through scenarios is a better use of study time than memorizing definitions in isolation. The examples below are original illustrations of the kinds of reasoning involved.
Cloud shared responsibility
A company moves a database to an infrastructure-as-a-service platform and assumes the provider will patch the database engine. Under the shared responsibility model, the provider secures the underlying facility and virtualization layer, while the customer is typically responsible for the operating system, database software and data on that instance. The right answer recognizes that moving to the cloud shifts some duties but never transfers all of them.
Physical surveillance and access control
A server room has a keypad lock, but a tailgater follows an employee through the door. A camera records the event after the fact, yet nothing stops the intrusion. This illustrates the difference between a preventive control (a mantrap or badge-plus-turnstile entry) and a detective control (the camera). Expect questions that ask you to classify controls and pick the one that actually prevents rather than merely records.
RFID and NFC
An access badge uses a short-range proximity technology. An attacker standing near an employee with a reader can capture the signal and later replay it. The reasoning here is about range, lack of mutual authentication on simple tags, and mitigations such as shielded badge holders and stronger credential schemes.
IoT and Bluetooth
A new smart device ships with a default password and joins the corporate network. Your analysis should cover changing defaults, isolating such devices on a separate network segment and disabling unused services. For Bluetooth, think about discoverable mode, pairing weaknesses and the case for turning the radio off when it is not needed.
Risk calculations: SLE, ARO and ALE
These formulas appear in the operational and risk domain and reward careful arithmetic. Single loss expectancy is the cost of one occurrence; annualized rate of occurrence is how often you expect it per year; annualized loss expectancy is their product. If one incident would cost USD 20,000 and you expect it twice a year, the annualized loss expectancy is USD 40,000. A control costing less than that annual loss is generally justifiable. Practice setting the problem up before you touch a calculator, since a misread input is the usual cause of a wrong answer.
Recovery sites
A business needs to resume operations within hours after a facility loss. A cold site (space only) is cheap but slow; a hot site (fully equipped, near-real-time data) is fast but costly; a warm site sits between them. Match the recovery time requirement and budget to the site type, and watch for wording that tells you which tradeoff the question is probing.
PKI
A user's browser warns that a site's certificate is untrusted. Trace the chain: the server certificate should be signed by an intermediate authority that chains up to a trusted root. A break, an expiration or a name mismatch each produces a distinct failure. Know what a certificate authority does and what revocation is for.
Social engineering
An employee receives a call from someone claiming to be IT support who urgently needs a password to fix an account. The attacker uses authority and urgency to bypass judgment. The correct response is procedural: verify the caller through an independent channel and never disclose credentials by phone.
Key Takeaway
For every domain, practice explaining not just what a control is but which threat it counters and what it fails to cover. Scenario questions almost always hinge on that distinction.
Who Can Take It and What Experience Helps
ETA's competency document recommends prior computer-systems and networking experience, along with prior IT or networking certification, as preparation. ETA's issuer badge page additionally lists practicing-technician experience, passing the written examination and acceptance of the Code of Conduct. These are best read as recommended background and program expectations rather than a rigid gate, so confirm current details directly with ETA before registering. Our guide to ITS requirements walks through eligibility in more detail.
Importantly, the Stand-Alone route does not require the Associate CET (CETa) credential. If you later want to upgrade to Journeyman status, that step does require CETa and at least two years of combined training and experience, and the upgrade fee is USD 55.
Registration, Remote Testing and Exam-Day Rules
Testing is arranged through an ETA Certification Administrator. Two delivery modes exist: Trapeza online testing, or paper-and-pencil. Remotely proctored testing is also available through ExamRoom.AI after you register with ETA.
- Remote surcharge: USD 16 for this two-hour exam.
- Scheduling lead time: initial remote scheduling can take up to 72 hours, so do not leave it to the last minute.
- Equipment: a working webcam, microphone, a recent computer and at least 3 Mbps internet.
- Identification: photo ID is required.
- Permitted items: scratch paper and non-programmable or scientific calculators. Used scratch paper must be surrendered.
- Prohibited: phones, and you may not leave the room once the test has started.
Trapeza displays results immediately, so you will know where you stand when you finish. For the complete cost picture, including optional preparation spending, read ITS Certification Cost, and for timing logistics see ITS Exam Dates.
Retakes, Maintenance and the Security+ Rollover
If you do not pass
After an unsuccessful attempt, one eligible free retake is available following a 30-day wait. It must be completed within one year of the first exam. If you retake remotely, the proctoring fee still applies.
Keeping the credential active
ITS follows ETA's general, non-hands-on maintenance program over a four-year term. You have two paths:
- Submit the Certification Maintenance Form with 10 relevant continuing-education hours each year (40 over the four-year cycle), or
- Submit a supervisor-completed Employer Verification Form.
Either way, the fee is USD 25 annually, or USD 100 across the four years, and annual submission includes ETA membership. Many technicians find the employer verification route simpler when their daily work already involves security responsibilities.
The CompTIA Security+ rollover
A valid CompTIA Security+ (ce) credential provides an alternative route to ITS for USD 105, with proof of the current certificate. Lifetime Security+ certificates are excluded. Treat this strictly as an alternative path to the credential: it does not make any CompTIA syllabus the ETA ITS blueprint, and if you sit the ETA exam directly you should study ETA's published competencies.
| Route | Fee | Key condition |
|---|---|---|
| Direct written exam | USD 105 | Pass at 75% or higher |
| Security+ (ce) rollover | USD 105 | Proof of a current certificate; lifetime certificates excluded |
| Journeyman upgrade (later) | USD 55 | Requires CETa and two years combined training and experience |
Preparation Resources and How Much to Trust Them
The public landscape mixes sources of very different authority. In rough order of reliability:
- ETA's competency document and certification booklet: the issuer's own blueprint and exam facts. Start here.
- Commercial courses: for example, eITprep offers a CompTIA Security+ Study Guide for ETA ITS, listed at USD 59.95 for six months, with two custom practice exams, 100 electronic flashcards, a searchable glossary and 45 course contact hours. Those figures describe the product, not the exam. The 45 contact hours are course time and should not be confused with the two-hour written test. The course does not confer certification, and its public description does not identify a Security+ edition, so map anything you learn from it back to ETA's 2024 competencies.
- Unofficial question banks and shared documents: useful for volume practice but unverified. Treat them as supplements, never as ground truth.
For a structured plan built on these resources, see our ITS Study Guide and the condensed ITS Cheat Sheet. When you are ready to test yourself under realistic conditions, take a few sessions on our ITS practice test site. If you want a sense of the training landscape more broadly, ITS Training covers the options.
Sequencing Your Preparation Around the Domains
You do not need an elaborate method here; you need an order that respects how the domains build on each other. Foundation topics first, abstract topics once you have the vocabulary, scenario drills last.
Infrastructure foundations
- Domain 1 (Network Hardware Security) and Domain 3 (Network Software Security)
- These supply the vocabulary every later domain assumes
The perimeter beyond the cable
- Domain 2 (Physical Security), Domain 4 (Wireless) and Domain 5 (Device Security)
- Group RFID/NFC, Bluetooth and IoT together since they share short-range risks
Threats and cryptography
- Domain 6 (Exploitations) and Domain 9 (Cryptography)
- Give PKI extra time; trust chains reward diagrams
Governance, recovery and people
- Domain 7, Domain 8 and Domain 10
- Drill SLE/ARO/ALE arithmetic and recovery-site matching daily
- Finish with full-length timed practice
Adjust the pace to your background. A technician who already administers networks daily may compress the early weeks, while someone coming from a help-desk role may want more time on cryptography and risk math. If you are wondering how demanding all this is in practice, How Hard Is the ITS Exam? offers a candid look.
Career Context: Reading Salary Claims Carefully
People who hold security-oriented technician credentials tend to work in network support, field service, infrastructure installation, IT operations and security-adjacent technician roles, often for employers that maintain their own networks or service others' systems. ETA is best known in the electronics and communications technician community, so employers familiar with its programs are the most likely to recognize the credential by name.
A word of caution on pay. ETA's official ITS fact sheet labels its wage figures as 2016 data and its employment projections as covering 2022 to 2032. Those are dated, and they describe the occupation generally rather than proving a pay premium for holding this specific certification. Treat any precise salary promise attached to ITS with suspicion, and weigh the credential on its documented value: verified knowledge against a published blueprint. For discussion of the broader question, see ITS Salary Guide, Is the ITS Certification Worth It? and ITS Jobs.
Frequently Asked Questions
It is ETA International's Information Technology Security credential, earned by passing a 100-question, two-hour written exam at a 75% threshold. It has no hands-on component and is valid for four years with maintenance. It is distinct from Certiport's Information Technology Specialist exams.
The exam fee is USD 105, with a USD 16 surcharge if you test with remote proctoring. Optional study materials cost extra. See our ITS certification cost breakdown for the full picture.
No. The Stand-Alone route does not require CETa. CETa becomes relevant only if you later pursue the Journeyman upgrade, which also requires at least two years of combined training and experience and a USD 55 fee.
One eligible free retake is available after a 30-day wait and must be taken within one year of your first attempt. A remote retake still carries the proctoring fee.
Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over four years), or a supervisor-completed Employer Verification Form. Either way the cost is USD 25 per year, or USD 100 over the four-year term.
Understanding what the certification is, and what it is not, is the first step. From here, review the ten competency areas against your own experience, pick your testing method, and use the practice questions on our main site to find the weak spots before exam day.