EC-Council Certified Incident Handler (ECIH / E|CIH) Practice Test
Prepare for the EC-Council Certified Incident Handler exam with free practice tests covering incident response, first response, malware incidents, email security incidents, network incidents, application incidents, cloud incidents, insider threats, and endpoint incidents. Each 20-question test uses a proportional timer based on the official ECIH exam pace of 1.8 minutes per question.
Mixed Set — ECIH Practice Tests
Use these mixed ECIH practice tests to review the full EC-Council incident handling blueprint. Questions are distributed across all 9 domains, with emphasis on incident handling process, first response, malware, email, network, application, cloud, insider, and endpoint security incidents.
Domain Wise — ECIH Mock Tests
Target one ECIH incident response objective at a time with focused mock tests. Each domain-wise test contains 20 questions mapped to the official EC-Council Certified Incident Handler blueprint.
About the ECIH Certification Exam
The EC-Council Certified Incident Handler certification validates the knowledge and skills needed to prepare for, detect, analyze, contain, eradicate, recover from, and document cybersecurity incidents.
What Is the ECIH?
The EC-Council Certified Incident Handler (ECIH / E|CIH) is an incident handling and response certification designed for cybersecurity professionals who need a structured approach to managing security incidents. It covers planning, incident recording, triage, notification, containment, evidence gathering, forensic analysis, eradication, recovery, and post-incident improvement.
ECIH is designed for incident handlers, incident responders, SOC analysts, CSIRT members, digital forensic analysts, cybersecurity analysts, security engineers, network defenders, IT administrators, and security operations professionals who handle cyber incidents in enterprise environments.
ECIH skills support roles such as incident responder, SOC analyst, CSIRT analyst, cyber defense incident responder, digital forensic analyst, malware response analyst, security operations engineer, and incident response coordinator. In the broader U.S. cybersecurity market, information security analysts earned a median annual wage of $124,910 in May 2024.
Exam Format (2026)
Exam name: EC-Council Certified Incident Handler (ECIH / E|CIH).
Exam code: 212-89.
Testing method: EC-Council Exam Portal.
Questions: 100 multiple-choice questions.
Duration: 3 hours.
Question types: Multiple-choice questions focused on incident handling, first response, malware, email incidents, network incidents, application incidents, cloud incidents, insider threats, and endpoint incidents.
Passing score: EC-Council cut scores vary by exam form and can range from 60% to 85%.
Exam fee: ECIH certification cost varies by delivery mode, region, learning path, and training provider. Confirm the current price with EC-Council or an authorized training partner before purchase.
Eligibility Requirements
Recommended experience: EC-Council states that ECIH is designed for mid-level to senior-level cybersecurity professionals with at least 1 year of experience in the cybersecurity domain.
Recommended background: Candidates should understand cybersecurity fundamentals, incident response concepts, information security incidents, malware, email threats, network security, web application security, cloud security, endpoint protection, and forensic readiness.
Training path: Candidates commonly prepare through EC-Council’s ECIH program using in-person training, self-study, or live online delivery.
Hands-on readiness: The ECIH program includes labs, incident response tools, playbooks, runbooks, templates, and scenario-based incident handling exercises.
Ethical requirement: ECIH preparation should be performed only in authorized labs, training ranges, owned environments, or systems where monitoring and incident response permission exists.
ECIH Domain Weights — Official Exam Blueprint v2
The ECIH exam blueprint contains 9 domains. Email Security Incidents and Network Level Incidents each carry 12%, while the other major incident response domains range from 10% to 11%.
| Domain | Objective Area | Weight |
|---|---|---|
| Domain 1 | Incident Response and Handling Process | 11% |
| Domain 2 | First Response | 11% |
| Domain 3 | Malware Incidents | 11% |
| Domain 4 | Email Security Incidents | 12% |
| Domain 5 | Network Level Incidents | 12% |
| Domain 6 | Application Level Incidents | 11% |
| Domain 7 | Cloud Security Incidents | 10% |
| Domain 8 | Insider Threats | 11% |
| Domain 9 | Endpoint Security Incidents | 11% |
How Our Practice Tests Are Designed
Official blueprint alignment — The mixed and domain-wise tests follow the ECIH Exam Blueprint v2 domains: Incident Response and Handling Process, First Response, Malware Incidents, Email Security Incidents, Network Level Incidents, Application Level Incidents, Cloud Security Incidents, Insider Threats, and Endpoint Security Incidents.
Incident-handler scenario style — Questions focus on practical response decisions such as incident triage, containment, evidence gathering, malware response, phishing response, network incident validation, cloud incident handling, insider threat detection, and endpoint incident response.
Proportional timer — The real ECIH exam has 100 questions in 3 hours, or 1.8 minutes per question. Each 20-question practice test is timed at approximately 36 minutes to match the real exam pace.
Domain-specific improvement — Use mixed sets to measure overall readiness, then use domain-wise tests to target weak areas. For example, repeated misses in Email Security Incidents, Network Level Incidents, or Endpoint Security Incidents should guide your next study session.
ECIH Exam Preparation Tips
Study Strategy
Master the incident lifecycle: Learn the full response process from preparation and incident recording through triage, notification, containment, evidence gathering, eradication, recovery, and post-incident activity.
Study incident types separately: Malware, email, network, application, cloud, insider, and endpoint incidents require different evidence sources, containment decisions, and recovery steps.
Practice first response discipline: First responder decisions affect evidence integrity. Review crime scene documentation, evidence collection, preservation, packaging, transportation, and chain of custody.
Connect response to prevention: For every incident type, learn the follow-up controls that reduce recurrence, such as improved monitoring, patching, user awareness, access control, logging, segmentation, and playbook updates.
Test-Taking Strategy
Read for the response stage: Identify whether the question is about preparation, detection, triage, containment, eradication, recovery, forensics, communication, or lessons learned before selecting an answer.
Choose evidence-safe actions: Prefer answers that preserve logs, collect evidence correctly, minimize damage, document actions, and maintain legal and organizational requirements.
Manage the timer: The real exam pace is 1.8 minutes per question. These practice tests give about 36 minutes for 20 questions so you can read incident scenarios carefully.
Eliminate weak responses: Remove answers that skip containment, destroy evidence, fail to notify stakeholders, ignore scope, or move to recovery before the incident is understood.
Frequently Asked Questions
Ready to Test Your ECIH Knowledge?
Start with a mixed ECIH practice test to measure your readiness, then use the domain-wise tests to strengthen weak incident response areas before exam day.
Start ECIH Practice Test 1 →
