ECIH (EC-Council Certified Incident Handler) — Free Online Mock Test
ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
ECIH exam at a glance
ECIH key facts & eligibility
| Conducting body | EC-Council. |
|---|---|
| Official website | eccouncil.org — ECIH ↗ |
| Mode | Proctored multiple-choice exam via the EC-Council exam portal (ECC EXAM). Duration 3 hours. |
| Frequency | On demand. |
| Scoring & marking | Current version ECIH v3, exam 212-89: 100 multiple-choice questions. EC-Council sets a cut score per exam form (typically 60–85%) rather than a single fixed pass mark. Covers the full incident-handling-and-response lifecycle and per-vector handling of malware, email, network, web-application, cloud, insider-threat and endpoint incidents. |
| Score validity | Maintained under EC-Council Continuing Education (ECE) — credits over a 3-year cycle. |
| Language | English. |
Who is eligible for ECIH?
EC-Council recommends about 1 year of information-security experience, or completion of official ECIH training. A specialist-level credential for mid-level security professionals.
Last verified July 2026 against EC-Council — Certified Incident Handler (ECIH). Always confirm current details on the official website before you register.
ECIH section breakdown
The ECIH mock test on Wrexa Edge replicates the real exam's section structure — same names, same question count per section, same time limits. No inter-section breaks — the timer runs continuously.
-
ECIH (60 Q)
ECIH scoring & marking scheme
Strategy: ECIH has no negative marking. Attempt every question — blank answers cost you potential marks but cannot pull your score down.
Scale: ECIH (pass 700/1000).
How ECIH is conducted
- Mode
- Test format
- Backtracking
- Mark for review
ECIH time strategy
With 60 questions in 180 minutes, you have about 180 seconds per question on average. Successful candidates aim for the following pacing on each section:
- ECIH (60 Q)
Wrexa Edge's analytics show your actual time-per-question after every mock so you can spot which sections you're losing time on.
ECIH topics covered
Across the 50 Wrexa Edge variants of ECIH, the following topics appear most often (sample distribution from one variant):
ECIH (60 Q)
- CYBEROPS — Attacks · 8
- D2 — Social attacks · 6
- D2 — Malware · 6
- CYBEROPS — Monitoring · 5
- CYBEROPS — SOC · 3
- CYBEROPS — Risk Concepts · 3
- D1 — Cryptography · 3
- D2 — Network attacks · 3
ECIH difficulty calibration
Advanced tier. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep.
ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
Verified content — Wrexa Edge's ECIH bank has been deeply curated with real exam-aligned content (estimated 100% syllabus coverage).
How Wrexa Edge prepares you for ECIH
- Real test-day interface
- 50 distinct variants
- Detailed analytics
- Spaced repetition (Notebook)
- Optional proctoring
- Free to start
Expert take: what ECIH really tests
The EC-Council Certified Incident Handler (ECIH v3, 212-89) is a specialist-level, method-driven credential covering the complete incident-handling-and-response lifecycle. It is a 100-question, 3-hour exam with a form-dependent cut score.
Preparation tips
- Memorise the incident-handling stages in order (preparation → triage → containment → eradication → recovery → post-incident).
- Study per-vector handling (malware, email, cloud, insider) as distinct playbooks.
- Use the official ECIH v3 courseware labs to reinforce forensic and evidence-handling steps.
⚠️ Common mistakes to avoid
- Studying against ECIH v2 material — ensure v3 (212-89) content.
- Treating it as a penetration-testing exam; the focus is response and handling, not offensive testing.
ECIH study plan
A phase-by-phase roadmap from your first concept to test-ready. Stretch or compress each phase to fit the time you have before your attempt.
- Memorise the incident-handling stages in order (preparation → triage → containment → eradication → recovery → post-incident)
- Study the ECIH v3 process framework
- Use the official ECIH v3 courseware
- Study malware, email, network, web-application, cloud, insider and endpoint incident playbooks
- Reinforce forensic and evidence-handling steps
- Work the courseware labs
- Take practice assessments on v3 content
- Keep the focus on response/handling, not offensive testing
- Review the full 3-hour blueprint
Where ECIH can take you
A strong ECIH result opens up these careers and higher-study paths:
- Incident handler / responder
- SOC / CSIRT team member
- Security / threat analyst
Best books & official prep for ECIH
- EC-Council ECIH v3 courseware — EC-Council
Official practice: EC-Council offers the official ECIH v3 training with labs and practice assessments.
Previous-year papers: EC-Council does not release past papers; practice comes with the official courseware.
Frequently asked questions
- What is the ECIH exam pattern?
- EC-Council Certified Incident Handler contains 60 questions across 1 section: ECIH (60 Q). Total duration is 180 minutes (about 180 seconds per question).
- Does ECIH have negative marking?
- No — ECIH has no negative marking. Each correct answer is worth 1 mark, so attempt every question.
- How is ECIH scored?
- Scaled score range: 100 to 1000. ECIH (pass 700/1000).
- How can I practise ECIH online for free?
- Wrexa Edge gives you 10 free full-length ECIH mock tests — with instant scoring, detailed explanations and analytics — plus 40 more with Pro. Start practising in under a minute, no card required.
- What is the difficulty level of ECIH?
- ECIH is rated Advanced difficulty on Wrexa Edge. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep. ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
- How long is the ECIH exam?
- ECIH runs for 180 minutes total. On Wrexa Edge the timer is enforced exactly as on the real exam — including no inter-section breaks.
- What topics are covered in ECIH?
- ECIH is split into: ECIH (60 Q). Each section is timed and weighted separately. ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
- What tools or aids are allowed during ECIH?
- No special tools are required. Note: real exam is proctored — Wrexa Edge mirrors this with a webcam-based proctoring flow you can enable.
- Is the ECIH test adaptive?
- No — ECIH is a fixed-form (linear) test. Every candidate sees the same number of questions per section.
- How many ECIH mock tests does Wrexa Edge offer?
- Wrexa Edge generates 50 distinct ECIH variants — each with different question content, not just shuffled options — the first 10 free for everyone and 40 more with Pro. That's 3000 unique practice questions in the real test-day interface.
- Is there a free ECIH test series 2026?
- Yes. The Wrexa Edge ECIH test series for 2026 gives you 10 free full-length mock tests (50 in total) plus subject-wise and topic-wise tests — instant scoring and detailed analysis, no card required.
- Are ECIH previous year question–style papers included?
- Every ECIH mock is modelled on the official exam pattern and the style of previous years' papers — the same 60-question structure, sections and marking — so your practice mirrors the real paper you'll sit.
- Which is the best free ECIH mock test online?
- Wrexa Edge's ECIH mock test replicates the real exam interface, timing and marking scheme, with instant score, section-wise analysis and 50 fresh variants — a strong free choice for 2026 preparation.
- Can I take the ECIH mock test on mobile?
- Yes. ECIH mock tests run in any browser on mobile, tablet or desktop — no app or download needed. Start on your phone and your progress and analytics sync when you sign in.
- What is the ECIH syllabus?
- The ECIH syllabus maps to its 1 section: ECIH (60 Q). Wrexa Edge's mock tests cover the complete syllabus topic by topic — see the topics-covered breakdown above — so you practise every area at real exam difficulty.
- What is the eligibility for ECIH?
- Eligibility for ECIH — age, qualification and number of attempts — is set by the official conducting body and can change each cycle, so always confirm the current official notification before applying. Wrexa Edge focuses on realistic ECIH practice: 10 free full-length mocks in the exact exam pattern, ready whenever you are.
- When is the ECIH exam and how should I prepare?
- Official ECIH exam dates are announced by the conducting body for each cycle — check the latest notification for the current schedule. To be ready, follow a phased study plan and take full-length timed mocks; Wrexa Edge gives you 10 free ECIH mocks with instant scoring so you can track your readiness week by week.
Related exams & practice tests
Candidates preparing for ECIH also practise these on Wrexa Edge:
Browse more: All Tech & IT Certifications exams → · Full exam catalog →
Ready to ace ECIH?
Join thousands of candidates practising on Wrexa Edge. Free signup, 50 variants per exam, instant scoring.
Start practising free →