EC-Council • ECIH
EC-Council Certified Incident Handler (ECIH) Practice Test
Validates competency across all stages of incident handling and response, including preparation, incident recording, triage, containment, evidence gathering, forensic analysis, eradication, recovery, and post-incident activities for network security incidents, malicious code incidents, and insider threats.
Exam Details
Questions
590
Duration
180 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Exam Overview
The EC-Council Certified Incident Handler (ECIH) is a specialist-level certification that validates a cybersecurity professional's ability to manage the complete lifecycle of security incident handling and response. Carrying exam code 212-89, the ECIH program covers all phases of the incident response process—from preparation and initial triage through containment, forensic evidence gathering, eradication, system recovery, and post-incident review. The curriculum addresses a wide range of incident categories, including network security incidents, malicious code and malware outbreaks, email security incidents, web application attacks, cloud security incidents, endpoint compromises, and insider threats.
Accredited by the American National Standards Institute (ANSI) and approved by the American Council on Education (ACE), the ECIH is recognized as a rigorous, academically vetted credential. The program exposes candidates to over 800 incident handling and response tools and more than 95 hands-on labs, emphasizing practical, method-driven competency over theoretical knowledge alone. The current version (v3) reflects the evolving threat landscape, incorporating modern attack vectors such as cloud-based incidents and advanced persistent threats.
Who Should Take This Exam
The ECIH is designed for cybersecurity professionals who are directly involved in detecting, analyzing, or responding to security incidents. Primary target roles include incident response team members, SOC (Security Operations Center) analysts, cyber forensic investigators, vulnerability assessment auditors, penetration testers, and risk assessment administrators. System administrators, network managers, firewall administrators, and IT managers responsible for organizational security posture are also well-suited candidates.
The certification is appropriate for professionals with at least one year of experience in cybersecurity who want to formalize and deepen their incident handling expertise. It is also pursued by federal employees and defense contractors seeking to meet compliance or role-specific requirements in government and regulated industry environments.
Prerequisites
EC-Council recommends that candidates have at least one year of experience working as a cybersecurity professional before attempting the ECIH exam. This foundational experience ensures familiarity with networking concepts, operating systems, common attack vectors, and basic security tooling—all of which are assumed knowledge within the curriculum.
There are no mandatory formal educational prerequisites, but a working understanding of TCP/IP networking, Windows and Linux system administration, log analysis, and basic digital forensics concepts will significantly aid comprehension of the course material. Candidates with prior exposure to security frameworks such as NIST SP 800-61 or SANS incident response methodology will find the structured approach of the ECIH program familiar. EC-Council also requires candidates to complete an eligibility application if they are challenging the exam without attending official training.
Exam Format
The ECIH exam (code 212-89) consists of 100 multiple-choice questions and must be completed within 3 hours (180 minutes). The exam is delivered through EC-Council's ECC Exam Center or at Pearson VUE testing centers worldwide, offering both online proctored and in-person options.
EC-Council uses a variable cut-score methodology based on the specific exam form administered. While the generally cited passing score is 70%, cut scores can range from 60% to 85% depending on the difficulty calibration of the form assigned to the candidate—this is determined through psychometric analysis and subject matter expert review during beta testing. There are no separate unscored pilot questions disclosed publicly. Certification must be renewed every three years through EC-Council's continuing education program.
Skills Measured
- 1.Module 1 – Introduction to Incident Handling and Response: Covers the fundamentals of incident handling, key definitions, types of incidents, the role of the incident handler, incident response team structure, and relevant legal and regulatory frameworks governing incident response activities.
- 2.Module 2 – Incident Handling and Response Process: Examines the end-to-end IH&R process model including preparation, detection and analysis, classification, escalation, notification procedures, and post-incident activities. Emphasizes building and maintaining incident response plans and playbooks.
- 3.Module 3 – First Response: Addresses first responder duties including incident documentation, evidence preservation, chain of custody, volatile and non-volatile data collection, initial containment decision-making, and coordinating with stakeholders during the early stages of an incident.
- 4.Module 4 – Handling and Responding to Malware Incidents: Covers malware classification (viruses, worms, ransomware, trojans, rootkits), malware behavior analysis techniques, static and dynamic analysis, containment strategies, and tools used for malware incident investigation.
- 5.Module 5 – Handling and Responding to Email Security Incidents: Focuses on phishing, spear-phishing, business email compromise (BEC), email header analysis, identifying malicious attachments and links, and response procedures specific to email-based attack vectors.
- 6.Module 6 – Handling and Responding to Network Security Incidents: Covers detection and response to network intrusions, DoS/DDoS attacks, man-in-the-middle attacks, network traffic analysis using tools such as Wireshark, and containment and recovery for network-layer incidents.
- 7.Module 7 – Handling and Responding to Web Application Security Incidents: Examines OWASP Top 10 attack scenarios (SQL injection, XSS, CSRF, etc.), web server log analysis, web application firewall (WAF) response, and eradication and hardening procedures following web-based attacks.
- 8.Module 8 – Handling and Responding to Cloud Security Incidents: Addresses incident response in AWS, Azure, and GCP environments, shared responsibility model implications, cloud-native logging and monitoring tools, and procedures for investigating and containing cloud infrastructure incidents.
- 9.Module 9 – Handling and Responding to Insider Threats: Covers detection of malicious and negligent insider activity, behavioral indicators, user and entity behavior analytics (UEBA), data loss prevention (DLP) integration, and legal considerations when handling insider threat investigations.
- 10.Module 10 – Handling and Responding to Endpoint Security Incidents: Focuses on endpoint detection and response (EDR) tools, host-based forensic analysis, memory forensics, incident containment at the endpoint level, and recovery procedures for compromised workstations and servers.
Study Tips
- Download and study the official ECIH Exam Blueprint v2 (available at cert.eccouncil.org) before beginning preparation—it maps all tested domains and is the authoritative guide for what will appear on the 212-89 exam.
- Complete all official EC-Council courseware labs: the ECIH program includes 95+ hands-on lab exercises covering real tools used in incident response. Hands-on practice with tools like Wireshark, Volatility, FTK Imager, and SIEM platforms directly reflects exam scenarios.
- Build a personal incident response playbook as you study each module. Documenting the response workflow for each incident type (malware, insider threat, cloud, web app) reinforces procedural knowledge tested in the multiple-choice questions.
- Study NIST SP 800-61 (Computer Security Incident Handling Guide) and SANS Incident Response methodology in parallel with EC-Council materials—the ECIH exam draws on industry-standard frameworks and terminology from both.
- Focus extra attention on Modules 4 (Malware), 6 (Network), and 9 (Insider Threats), as these represent some of the most complex incident categories and are heavily represented in the exam content based on the course structure.
- Use the EC-Council CodeRed or iClass platform for official practice tests and review questions. Third-party question banks can supplement preparation but should not replace the official study materials.
- Review relevant legal frameworks (such as GDPR breach notification requirements, HIPAA incident response obligations, and US federal laws like CFAA) since the ECIH exam tests knowledge of compliance and legal considerations in incident response.
Career Benefits
The ECIH certification positions holders for roles such as Incident Responder, SOC Analyst (Tier 2/3), Cyber Forensic Analyst, Threat Intelligence Analyst, and Information Security Manager. In the United States, incident handlers and response professionals earn an average salary of approximately $96,000 per year, with ranges typically between $85,000 and $108,000 depending on experience, industry, and location—with government, defense, and financial services sectors commanding premium compensation.
Compared to alternatives like the SANS GIAC Certified Incident Handler (GCIH), the ECIH is more accessible in terms of cost and entry requirements, making it a practical stepping stone for professionals earlier in their security careers. The ANSI accreditation and ACE approval add credibility recognized by government agencies and academic institutions. For professionals targeting compliance-heavy industries or federal positions, the ECIH also aligns with the NICE Cybersecurity Workforce Framework's 'Protect and Defend' work role category, broadening its applicability in government contracting environments.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 590 questions.
1. An incident handler performs triage on a security event and must determine if it qualifies as an incident according to NIST SP 800-61. An automated system scan detected an outdated software version on a workstation, but no exploitation occurred and no security policy was violated. How should this be classified? (Select one!)
ASecurity incident requiring full incident response
BSecurity event not requiring incident response
CIndicator confirming an incident has already occurred
DPrecursor indicating an incident may occur in the future
Explanation
According to NIST SP 800-61, an event is any observable occurrence in a system or network, while an incident is a violation or imminent threat of violation of security policies, acceptable use policies, or standard security practices. Since no policy violation occurred and no exploitation happened, this is classified as an event, not an incident. A precursor is a sign that an incident may occur in the future, such as a vulnerability announcement or threat intelligence. An indicator is evidence that an incident has occurred, such as IDS alerts or unusual traffic. This scenario represents routine security monitoring detecting a condition that requires remediation but not incident response.
2. An analyst creates indicators of compromise for threat intelligence sharing using STIX 2.x. The analyst needs to link a specific malware sample to the threat actor group that uses it. Which STIX relationship type correctly represents this association? (Select one!)
AThreat-Actor uses Malware
BMalware uses Threat-Actor
CMalware attributed-to Threat-Actor
DThreat-Actor indicates Malware
Explanation
In STIX 2.x, the relationship Threat-Actor uses Malware correctly models that a threat actor group employs specific malware in their campaigns. The uses relationship type connects threat actors to their tools and malware. The reverse relationship Malware uses Threat-Actor is semantically incorrect as malware is employed by actors, not vice versa. The indicates relationship connects Indicators to what they detect, not actors to malware. While attributed-to can link attacks to actors, the standard relationship for actor-to-malware association is uses.
3. A security operations center uses IBM QRadar SIEM and needs to create a rule to detect authentication brute force attacks. The rule should trigger when a single source IP has more than 15 failed login attempts within 10 minutes. Which QRadar component should be configured to correlate these events? (Select one!)
AEvent rules with accumulation tests to count failed logins by source IP
BCustom property rules to extract authentication failure data
CFlow rules to analyze NetFlow data for suspicious patterns
DOffense rules to consolidate related authentication events into offenses
Explanation
Event rules with accumulation tests in QRadar count events matching specific criteria (failed logins) within a time window grouped by attributes (source IP), making them ideal for brute force detection. The rule accumulates EventCode for authentication failures, groups by source IP, and triggers when count exceeds threshold. Offense rules consolidate triggered rules into incidents but do not perform the initial detection logic. Flow rules analyze network flow data, not authentication events. Custom property rules extract data fields but do not implement detection logic.
4. A network forensics analyst investigates DNS tunneling used for data exfiltration. The analyst examines DNS query logs and identifies suspicious patterns. Which three characteristics most reliably indicate DNS tunneling activity? (Select three!)
Multiple correct answersADNS query lengths exceeding 50 characters
BStandard A record lookups to popular domains like google.com
CShannon entropy exceeding 3.5 bits per character in subdomain strings
DMore than 100 unique subdomains queried for a single parent domain
EQuery response times under 100 milliseconds
FPredominant use of MX record lookups for email routing
Explanation
DNS tunneling detection relies on identifying abnormal query patterns. Query lengths exceeding 50 characters are suspicious because legitimate DNS queries are typically much shorter, while tunneling encodes data in long subdomain strings. Shannon entropy exceeding 3.5 bits per character indicates random-looking encoded data rather than human-readable domain names. More than 100 unique subdomains for a single parent domain suggests automated data exfiltration rather than legitimate lookups. Standard A record lookups to popular domains are normal DNS activity. Fast query response times are normal and do not indicate tunneling. MX record lookups for email routing are legitimate DNS activity. DNS tunneling typically uses TXT or NULL records for maximum data capacity, combined with long randomized subdomains.
5. An incident response team implements WMI event subscriptions for system monitoring but discovers that attackers have also used WMI for persistence. Which three WMI classes must be examined together to identify malicious WMI-based persistence? (Select three!)
Multiple correct answersA__EventFilter
B__InstanceCreationEvent
CCommandLineEventConsumer
D__FilterToConsumerBinding
EWin32_Process
FWin32_Service
Explanation
WMI persistence requires three components working together: __EventFilter defines the trigger condition or event that will activate the persistence mechanism (such as system startup or specific time), CommandLineEventConsumer specifies the action to execute (typically running a malicious command or script), and __FilterToConsumerBinding links the filter to the consumer, creating the complete persistence chain. All three components must be present and properly linked for WMI persistence to function. Investigating all three classes reveals the complete attack. __InstanceCreationEvent is an event type that filters might use but is not itself a required class to examine. Win32_Process and Win32_Service are informational WMI classes for querying running processes and services, not persistence mechanism components. Sysmon Event IDs 19, 20, and 21 monitor creation of these three WMI persistence components respectively.
$7
One-time access to this exam
Full access to all 590 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available