- The Exam at a Glance
- The Four Official Domains in One Pass
- Domain 1: Defense in Depth Quick Facts
- Domain 2: Operating System Security Quick Facts
- Domain 3: Network Device Security Quick Facts
- Domain 4: Secure Computing Quick Facts
- Decision Tables for Scenario Questions
- Fees, Vouchers and Retake Mechanics
- Validity, Renewal and Career Context
- Sequencing Your Review by Domain
- Frequently Asked Questions
- The exam is proctored and computer-based, with 35-45 questions in a standard 50-minute window.
- A scaled score of 700 on a 1-1000 scale passes; it is not a raw 70% requirement.
- The US retail voucher with retake is USD 133; the retake code must be used within 60 days of a failure.
- Four official domains: Defense in Depth, Operating System Security, Network Device Security, and Secure Computing.
The Exam at a Glance
This is the one-page reference for the IT Specialist - Network Security exam, issued by Certiport (a Pearson VUE business) under the Pearson IT Specialist program. Everything below comes from the official program pages and the 2025 Pearson exam objectives document. If you want deeper context on any single item, the linked guides on this site expand on it, starting with the ITS-NS study guide.
| Item | What to Know |
|---|---|
| Credential | IT Specialist - Network Security (Pearson / Certiport) |
| Question count | Published range of 35-45 questions; no fixed total or scored/unscored split is published |
| Time | 50 minutes standard, excluding administrative appointment activities |
| Format | Computer-based and proctored; the official tutorial shows multiple-choice items, review/navigation, and answer changes before submission |
| Passing score | 700 on a 1-1000 scaled score |
| Prerequisites | None formal; no bachelor's degree requirement |
| Recommended baseline | Hands-on familiarity with client operating systems, security applications, firewalls, devices and network ports, with roughly 150 hours of instruction or practical experience (preparation guidance, not an exam rule) |
| Validity | 5 years for awards earned on or after June 18, 2025; earlier awards do not expire |
The Four Official Domains in One Pass
The official objectives are organized under four headings. Treat these as the full scope: this exam is separate from the IT Specialist Cybersecurity and Networking exams, from Microsoft MTA, and from CompTIA Security+. Do not import a broader cybersecurity syllabus into your review. For the full treatment of each area, see the complete domains guide.
| Domain | Core Idea | Typical Question Angle |
|---|---|---|
| Defense in Depth | Layered controls so one failure does not expose everything | Pick the layer or control that addresses a described gap |
| Operating System Security | Windows and Linux permissions, authentication, auditing, encryption | Apply the right permission or authentication method to a scenario |
| Network Device Security | Wireless protection, firewalls, IDS/IPS, SIEM, isolation, protocol security | Choose or compare devices and settings for a stated threat |
| Secure Computing | Safer end-user behavior and protective practices | Identify the safest action or tool for an end-user situation |
Study priorities in this article are editorial. The provider does not publish percentage weights per domain in the sources used here, so do not assume any domain is worth a particular share of your score.
Domain 1: Defense in Depth Quick Facts
Defense in Depth
The central principle: no single control is trusted to stop every attack, so protections are stacked across physical, network, host, application, and user layers.
- Know that layering reduces the impact of any one failed control.
- Be able to place a control (door lock, firewall, host permission, encryption, user training) at the correct layer.
- Expect scenario wording such as "an attacker bypassed X; what additional layer would limit damage?"
- Connect this domain to the other three: permissions and auditing are host layers, firewalls and IDS/IPS are network layers, and safe computing habits are the user layer.
Because this domain frames the others, it rewards a quick mental map. When a question describes a failure, ask which layer failed and which neighboring layer would have contained it.
Domain 2: Operating System Security Quick Facts
This is where hands-on practice pays off most, since the objectives cover both Windows and Linux. Candidates who have only read about permissions tend to stumble on scenario wording.
Operating System Security
Controlling who can do what on a client system, proving who they are, recording what happened, and protecting data at rest.
- Permissions: Windows file and folder permissions and Linux file permissions; know how a user's effective access results from the settings applied to them.
- Authentication: the difference between proving identity (authentication) and granting access (authorization); recognize stronger versus weaker methods.
- Auditing: what logging captures, why it matters for accountability, and how it supports investigation.
- Encryption: protecting stored data so a lost or stolen device does not expose its contents.
Domain 3: Network Device Security Quick Facts
This domain covers protecting the network itself: the devices on it, how traffic is filtered or monitored, and how protocols are secured.
Network Device Security
Wireless protection, firewalls, IDS/IPS, SIEM, network isolation, and protocol security.
- Wireless protection: know that stronger wireless security settings protect against eavesdropping and unauthorized joins.
- Firewalls: filter traffic according to rules; connect them to device ports and allowed or blocked services.
- IDS vs IPS: an intrusion detection system observes and alerts; an intrusion prevention system can also act to block.
- SIEM: collects and correlates log and event data from many sources so patterns become visible.
- Network isolation: separating segments so a compromise in one area does not spread freely.
- Protocol security: recognizing when a secured protocol should replace an unsecured one.
The most common trap here is confusing detection with prevention. If a question stresses that a device "alerts the administrator," think detection; if it stresses that traffic is "stopped automatically," think prevention.
Domain 4: Secure Computing Quick Facts
Secure Computing
Safer end-user computing: the habits, settings, and tools that reduce risk on everyday devices.
- Expect "what should the user do" framing rather than deep configuration.
- Recognize risky behavior and select the safest alternative.
- Understand how backups and protective tools reduce the cost of an incident, and be ready to choose an appropriate backup approach for a described need.
- Tie user-level choices back to Defense in Depth: the user is a layer too.
These questions often look easy, which is exactly why candidates rush them. Read the full scenario before selecting the answer; small qualifiers change which option is best.
Decision Tables for Scenario Questions
Because the exam leans on scenarios, a few quick comparisons are worth memorizing. The tables below summarize distinctions candidates most often blur.
Detect or prevent?
| Tool | Primary Action | Think of It As |
|---|---|---|
| Firewall | Allows or blocks traffic by rule | Gatekeeper at the boundary |
| IDS | Monitors and alerts | Alarm system |
| IPS | Monitors and blocks suspicious activity | Alarm plus automatic response |
| SIEM | Aggregates and correlates events | Central view across many logs |
Identity concepts
| Concept | Question It Answers |
|---|---|
| Authentication | Who are you? |
| Authorization / permissions | What are you allowed to do? |
| Auditing | What did you actually do, and can we prove it? |
Key Takeaway
When two answer choices both sound reasonable, return to the verb in the question. "Identify," "restrict," "record," "block," and "alert" each point to a different control category, and the correct option almost always matches that verb.
If you want to see how hard these distinctions feel under time pressure, the difficulty guide walks through where candidates typically lose points.
Fees, Vouchers and Retake Mechanics
Pricing details are easy to misread, so keep these points straight. The full breakdown is in the certification cost guide.
- US individual retail price: USD 133 for the IT Specialist Exam Voucher + Retake. This is not an exam-only price and not a universal price across every channel.
- Proctoring: Certiport Authorized Testing Centers (CATCs) may charge extra for proctoring.
- Voucher life: the original voucher expires one year after purchase.
- Retake code: if you fail, the issued retake code must be used within 60 days.
- Delivery channels: testing is available through CATCs, and Pearson VUE also offers test-center and OnVUE delivery. Match your voucher to the delivery channel you plan to use.
- Identity and rules: identity verification, a proctor, and exam-security/NDA rules apply to every sitting.
For scheduling windows and deadlines, see the exam dates guide, and for eligibility details check the requirements guide.
Validity, Renewal and Career Context
How long the credential lasts
Awards earned on or after June 18, 2025 expire after five years. Awards earned before that date remain non-expiring. To renew, you purchase a voucher and pass the current version of the exam. This dated policy takes precedence over older one-time-issuance wording that may still appear on the program page.
What the salary data does and does not say
The U.S. Bureau of Labor Statistics reported a May 2025 median pay of USD 129,180 for information security analysts. That figure describes the occupation as a whole. It is not a salary attached to this certification, not an entry-level offer, and not evidence of any pay premium from holding the credential. Treat it as context for where security careers can lead, not as an expected starting wage. The salary guide and the ROI analysis discuss how to weigh this honestly.
Likewise, be cautious with pass-rate claims. Institutional cohort results and vendor guarantees do not establish an exam-wide success rate. The pass rate article explains why published numbers are rarely comparable.
Sequencing Your Review by Domain
If you have about four weeks, this order reflects how the domains build on each other rather than any official weighting. For a broader preparation plan, see the study guide.
Defense in Depth plus Operating System Security (part 1)
- Build the layered-controls mental map first, since it frames everything else.
- Practice Windows and Linux permissions hands-on.
Operating System Security (part 2)
- Cover authentication, auditing, and encryption with small scenarios.
- Drill the authenticate / authorize / audit distinction until it is automatic.
Network Device Security
- Compare firewall, IDS, IPS, and SIEM side by side.
- Review wireless protection, isolation, and protocol security.
Secure Computing and full review
- Work through safe-practice and backup-selection scenarios.
- Take timed practice sessions in the 50-minute window and review every miss by domain.
The official CertPREP practice option, powered by GMetrix, offers training and testing modes. Its practice-bank sizes and timers are not live-exam specifications, so use it to build familiarity with the format rather than to predict your exact experience. You can also try the free practice tests on our main site to check which domain needs the most work before you sit the real exam.
Frequently Asked Questions
The published exam-form range is 35-45 questions with a standard 50-minute time limit, excluding administrative appointment activities. No fixed total or scored/unscored split is published, so plan for a range rather than a single number.
A scaled score of 700 on a 1-1000 scale. This is not a raw 70% requirement, and it is not a candidate pass-rate statistic. See the passing score guide for more detail.
No bachelor's degree is required. The provider describes a candidate profile of hands-on familiarity with client operating systems, security applications, firewalls, devices and network ports, with at least 150 hours of instruction or practical experience. That is preparation guidance, not a mandatory course or a 150-hour exam requirement.
This exam is scoped to the Pearson Network Security objectives only: Defense in Depth, Operating System Security, Network Device Security, and Secure Computing. It is separate from ITS Cybersecurity, ITS Networking, Microsoft MTA, and CompTIA Security+, so do not study another credential's syllabus as a substitute.
Awards earned on or after June 18, 2025 expire after five years, and earlier awards remain non-expiring. Renewal requires buying a voucher and passing the current exam. For broader background on the credential, see what the certification is.