EC-Council · ECIH
EC-Council Certified Incident Handler (ECIH) Practice Tests
Validates competency across all stages of incident handling and response, including preparation, incident recording, triage, containment, evidence gathering, forensic analysis, eradication, recovery, and post-incident activities for network security incidents, malicious code incidents, and insider threats.
Exam Details
Practice Questions
590
≈ 4 practice exams
Duration
180 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
EC-Council Certified Incident Handler (ECIH) Practice Exam Preparation
Use this ECIH practice exam to prepare for EC-Council Certified Incident Handler (ECIH) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 590 questions for EC-Council ECIH, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The EC-Council Certified Incident Handler (ECIH) is a specialist-level certification that validates a cybersecurity professional's ability to manage the complete lifecycle of security incident handling and response. Carrying exam code 212-89, the ECIH program covers all phases of the incident response process—from preparation and initial triage through containment, forensic evidence gathering, eradication, system recovery, and post-incident review. The curriculum addresses a wide range of incident categories, including network security incidents, malicious code and malware outbreaks, email security incidents, web application attacks, cloud security incidents, endpoint compromises, and insider threats.
Accredited by the American National Standards Institute (ANSI) and approved by the American Council on Education (ACE), the ECIH is recognized as a rigorous, academically vetted credential. The program exposes candidates to over 800 incident handling and response tools and more than 95 hands-on labs, emphasizing practical, method-driven competency over theoretical knowledge alone. The current version (v3) reflects the evolving threat landscape, incorporating modern attack vectors such as cloud-based incidents and advanced persistent threats.
Who Should Take This Exam
The ECIH is designed for cybersecurity professionals who are directly involved in detecting, analyzing, or responding to security incidents. Primary target roles include incident response team members, SOC (Security Operations Center) analysts, cyber forensic investigators, vulnerability assessment auditors, penetration testers, and risk assessment administrators. System administrators, network managers, firewall administrators, and IT managers responsible for organizational security posture are also well-suited candidates.
The certification is appropriate for professionals with at least one year of experience in cybersecurity who want to formalize and deepen their incident handling expertise. It is also pursued by federal employees and defense contractors seeking to meet compliance or role-specific requirements in government and regulated industry environments.
Prerequisites
EC-Council recommends that candidates have at least one year of experience working as a cybersecurity professional before attempting the ECIH exam. This foundational experience ensures familiarity with networking concepts, operating systems, common attack vectors, and basic security tooling—all of which are assumed knowledge within the curriculum.
There are no mandatory formal educational prerequisites, but a working understanding of TCP/IP networking, Windows and Linux system administration, log analysis, and basic digital forensics concepts will significantly aid comprehension of the course material. Candidates with prior exposure to security frameworks such as NIST SP 800-61 or SANS incident response methodology will find the structured approach of the ECIH program familiar. EC-Council also requires candidates to complete an eligibility application if they are challenging the exam without attending official training.
Exam Format
The ECIH exam (code 212-89) consists of 100 multiple-choice questions and must be completed within 3 hours (180 minutes). The exam is delivered through EC-Council's ECC Exam Center or at Pearson VUE testing centers worldwide, offering both online proctored and in-person options.
EC-Council uses a variable cut-score methodology based on the specific exam form administered. While the generally cited passing score is 70%, cut scores can range from 60% to 85% depending on the difficulty calibration of the form assigned to the candidate—this is determined through psychometric analysis and subject matter expert review during beta testing. There are no separate unscored pilot questions disclosed publicly. Certification must be renewed every three years through EC-Council's continuing education program.
Skills Measured
- 1.Module 1 – Introduction to Incident Handling and Response: Covers the fundamentals of incident handling, key definitions, types of incidents, the role of the incident handler, incident response team structure, and relevant legal and regulatory frameworks governing incident response activities.
- 2.Module 2 – Incident Handling and Response Process: Examines the end-to-end IH&R process model including preparation, detection and analysis, classification, escalation, notification procedures, and post-incident activities. Emphasizes building and maintaining incident response plans and playbooks.
- 3.Module 3 – First Response: Addresses first responder duties including incident documentation, evidence preservation, chain of custody, volatile and non-volatile data collection, initial containment decision-making, and coordinating with stakeholders during the early stages of an incident.
- 4.Module 4 – Handling and Responding to Malware Incidents: Covers malware classification (viruses, worms, ransomware, trojans, rootkits), malware behavior analysis techniques, static and dynamic analysis, containment strategies, and tools used for malware incident investigation.
- 5.Module 5 – Handling and Responding to Email Security Incidents: Focuses on phishing, spear-phishing, business email compromise (BEC), email header analysis, identifying malicious attachments and links, and response procedures specific to email-based attack vectors.
- 6.Module 6 – Handling and Responding to Network Security Incidents: Covers detection and response to network intrusions, DoS/DDoS attacks, man-in-the-middle attacks, network traffic analysis using tools such as Wireshark, and containment and recovery for network-layer incidents.
- 7.Module 7 – Handling and Responding to Web Application Security Incidents: Examines OWASP Top 10 attack scenarios (SQL injection, XSS, CSRF, etc.), web server log analysis, web application firewall (WAF) response, and eradication and hardening procedures following web-based attacks.
- 8.Module 8 – Handling and Responding to Cloud Security Incidents: Addresses incident response in AWS, Azure, and GCP environments, shared responsibility model implications, cloud-native logging and monitoring tools, and procedures for investigating and containing cloud infrastructure incidents.
- 9.Module 9 – Handling and Responding to Insider Threats: Covers detection of malicious and negligent insider activity, behavioral indicators, user and entity behavior analytics (UEBA), data loss prevention (DLP) integration, and legal considerations when handling insider threat investigations.
- 10.Module 10 – Handling and Responding to Endpoint Security Incidents: Focuses on endpoint detection and response (EDR) tools, host-based forensic analysis, memory forensics, incident containment at the endpoint level, and recovery procedures for compromised workstations and servers.
Study Tips
- Download and study the official ECIH Exam Blueprint v2 (available at cert.eccouncil.org) before beginning preparation—it maps all tested domains and is the authoritative guide for what will appear on the 212-89 exam.
- Complete all official EC-Council courseware labs: the ECIH program includes 95+ hands-on lab exercises covering real tools used in incident response. Hands-on practice with tools like Wireshark, Volatility, FTK Imager, and SIEM platforms directly reflects exam scenarios.
- Build a personal incident response playbook as you study each module. Documenting the response workflow for each incident type (malware, insider threat, cloud, web app) reinforces procedural knowledge tested in the multiple-choice questions.
- Study NIST SP 800-61 (Computer Security Incident Handling Guide) and SANS Incident Response methodology in parallel with EC-Council materials—the ECIH exam draws on industry-standard frameworks and terminology from both.
- Focus extra attention on Modules 4 (Malware), 6 (Network), and 9 (Insider Threats), as these represent some of the most complex incident categories and are heavily represented in the exam content based on the course structure.
- Use the EC-Council CodeRed or iClass platform for official practice tests and review questions. Third-party question banks can supplement preparation but should not replace the official study materials.
- Review relevant legal frameworks (such as GDPR breach notification requirements, HIPAA incident response obligations, and US federal laws like CFAA) since the ECIH exam tests knowledge of compliance and legal considerations in incident response.
Career Benefits
The ECIH certification positions holders for roles such as Incident Responder, SOC Analyst (Tier 2/3), Cyber Forensic Analyst, Threat Intelligence Analyst, and Information Security Manager. In the United States, incident handlers and response professionals earn an average salary of approximately $96,000 per year, with ranges typically between $85,000 and $108,000 depending on experience, industry, and location—with government, defense, and financial services sectors commanding premium compensation.
Compared to alternatives like the SANS GIAC Certified Incident Handler (GCIH), the ECIH is more accessible in terms of cost and entry requirements, making it a practical stepping stone for professionals earlier in their security careers. The ANSI accreditation and ACE approval add credibility recognized by government agencies and academic institutions. For professionals targeting compliance-heavy industries or federal positions, the ECIH also aligns with the NICE Cybersecurity Workforce Framework's 'Protect and Defend' work role category, broadening its applicability in government contracting environments.
Sample Questions
5 sample questions with answers and explanations. The full bank has 590 questions, enough for 4 full-length practice exams.
Preview — answers shown1. During malware analysis, an analyst creates YARA rules to detect ransomware families. The rule must match files smaller than 3MB containing two specific strings and starting with the PE header magic bytes. Which YARA condition correctly implements these requirements? (Select one!)
Amagic_bytes == PE and (1 of ($s*))
Bheader == MZ and size < 3000000 or all of ($s*)
Cuint16(0) == 0x5A4D and filesize < 3MB and (2 of ($s*))
Dpe.is_pe and filesize > 3MB and any of ($s*)
Explanation
uint16(0) == 0x5A4D checks for PE header magic bytes at offset 0, filesize < 3MB sets the size constraint, and (2 of ($s*)) requires at least two string matches. This syntax follows proper YARA condition structure. header == MZ uses invalid syntax. pe.is_pe requires importing the pe module. magic_bytes == PE is not valid YARA syntax. The correct condition combines file header validation, size limits, and string matching.
2. A Linux incident responder discovers a suspicious entry in /etc/ld.so.preload pointing to /tmp/malicious.so. What type of persistence mechanism has the attacker implemented? (Select one!)
ASystemd service persistence through malicious unit files
BLD_PRELOAD userland rootkit that hijacks shared library loading
CCron job persistence for scheduled malware execution
DKernel module rootkit that operates at ring 0 privilege level
Explanation
The /etc/ld.so.preload file specifies shared libraries to be loaded before all others by the dynamic linker, allowing attackers to implement userland rootkits that intercept system calls and library functions. This LD_PRELOAD technique enables function hooking to hide files, processes, and network connections at the library level without kernel modifications. Kernel module rootkits use /lib/modules/ and operate at kernel level, not through ld.so.preload. Systemd service persistence uses unit files in /etc/systemd/system/, not shared library preloading. Cron job persistence uses crontab entries and /etc/cron.d/, not library injection mechanisms.
3. During a Linux incident response investigation, an analyst needs to identify all files with the SUID bit set, which could indicate privilege escalation backdoors. Which command correctly identifies SUID files? (Select one!)
Aps aux | grep root
Bnetstat -anp | grep LISTEN
Ccat /etc/passwd | wc -l
Dfind / -perm -4000 -ls
Explanation
The command find / -perm -4000 -ls searches the entire filesystem starting from root for files with the SUID permission bit set (octal 4000). SUID files run with the owner's privileges rather than the user who executes them. While legitimate programs like passwd and sudo use SUID, attackers often create malicious SUID binaries to maintain privileged access. The -ls option provides detailed output including permissions, owner, size, and path. The netstat command displays network connections and listening ports, not file permissions. The ps aux | grep root command shows processes running as root but not SUID files. The cat /etc/passwd command counts user accounts and has no relation to SUID permissions.
4. An organization implements defense against application layer DDoS attacks targeting their web application. Attackers send HTTP requests that appear legitimate but slowly consume server resources. Which three mitigation techniques are most effective against this attack? (Select three!)
Multiple correct answersADeploy behavioral monitoring to establish traffic baselines and detect anomalies
BImplement challenge-response mechanisms like CAPTCHAs to verify human users
CConfigure global DNS scrubbing centers to absorb bandwidth floods
DDeploy web application firewall with bot detection capabilities
EEnable SYN cookies to prevent TCP handshake exhaustion
FImplement rate limiting at the router level
Explanation
Application layer attacks require different mitigation approaches than volumetric or protocol attacks. Behavioral monitoring establishes baselines of normal user behavior and detects anomalies like unusual request patterns or slow connections. Challenge-response mechanisms distinguish legitimate human users from automated bots. Web application firewalls with bot detection identify and block malicious automated traffic at layer 7. Global DNS scrubbing centers are designed for volumetric attacks that saturate bandwidth, not application layer attacks. SYN cookies mitigate SYN flood protocol attacks at layer 4, not application layer attacks. Router-level rate limiting is less effective for application attacks that mimic legitimate traffic patterns.
5. An organization implements User and Entity Behavior Analytics for insider threat detection. The system establishes behavioral baselines by analyzing access patterns, data movement, and user activities. Which key advantage does UEBA provide over traditional rule-based Data Loss Prevention systems for detecting insider threats? (Select one!)
AUEBA operates independently without requiring any human analyst intervention for threat investigation and response decisions
BUEBA requires pre-classification of all sensitive data and manual configuration of content detection rules before detecting any insider threats
CUEBA detects anomalies and deviations from established behavioral baselines that indicate malicious activity even when attackers use legitimate credentials and authorized access
DUEBA relies exclusively on signature-based detection to identify known malware patterns without analyzing user behavior patterns
Explanation
UEBA's primary advantage over rule-based DLP is its ability to detect behavioral anomalies and deviations from established baselines that indicate insider threats, even when attackers operate within their authorized access using legitimate credentials. UEBA uses machine learning to identify unusual login patterns, abnormal data access, unexpected file transfers, and suspicious privilege escalations that static rules cannot capture. Rule-based systems only detect predefined patterns and can be bypassed by insiders who already have authorized access. UEBA does not require pre-classification of all data as it infers sensitivity based on file lineage, location, user role, and access patterns. UEBA is not signature-based but rather uses behavioral analytics and baseline comparisons. While UEBA provides automated alerting, human analysts remain essential for precise investigation and response decisions based on UEBA insights.
More EC-Council Practice Exams
Digital Forensics Essentials (DFE)
DFE · 626 questions
EC-Council Certified Disaster Recovery Professional (EDRP)
EDRP · 623 questions
Certified Application Security Engineer .NET (CASE-.NET)
CASE-.NET · 625 questions
EC-Council Certified Encryption Specialist (ECES)
ECES · 627 questions
Ethical Hacking Essentials (EHE)
EHE · 627 questions
ICS/SCADA Cybersecurity
ICS-SCADA · 627 questions
$17.99
One-time access to this exam
590 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available