ECIH exam at a glance
50 full-length mock tests
Attempt 50 full-length mocks
Each is a distinct question set built on the real 60-question, 180-minute pattern, with instant scoring and section-wise analysis. The first is free; unlock all 50 forever for $1.99 (one-time, no subscription).
ECIH key facts & eligibility
| Conducting body | EC-Council. |
|---|---|
| Official website | eccouncil.org — ECIH ↗ |
| Mode | Proctored multiple-choice exam via the EC-Council exam portal (ECC EXAM). Duration 3 hours. |
| Frequency | On demand. |
| Scoring & marking | Current version ECIH v3, exam 212-89: 100 multiple-choice questions. EC-Council sets a cut score per exam form (typically 60–85%) rather than a single fixed pass mark. Covers the full incident-handling-and-response lifecycle and per-vector handling of malware, email, network, web-application, cloud, insider-threat and endpoint incidents. |
| Score validity | Maintained under EC-Council Continuing Education (ECE) — credits over a 3-year cycle. |
| Language | English. |
Who is eligible for ECIH?
EC-Council recommends about 1 year of information-security experience, or completion of official ECIH training. A specialist-level credential for mid-level security professionals.
Last verified July 2026 against EC-Council — Certified Incident Handler (ECIH). Always confirm current details on the official website before you register.
ECIH section breakdown
The ECIH mock test on Wrexa Edge replicates the real exam's section structure — same names, same question count per section, same time limits. No inter-section breaks — the timer runs continuously.
-
ECIH (60 Q)
Marking scheme
+1 per correct. Try your score.
Strategy: ECIH has no negative marking. Attempt every question — blank answers cost you potential marks but cannot pull your score down.
Scale: ECIH (pass 700/1000).
How ECIH is conducted
- Mode
- Test format
- Backtracking
- Mark for review
ECIH time strategy
With 60 questions in 180 minutes, you have about 180 seconds per question on average. Successful candidates aim for the following pacing on each section:
- ECIH (60 Q)
Wrexa Edge's analytics show your actual time-per-question after every mock so you can spot which sections you're losing time on.
ECIH topics covered
Across the 50 Wrexa Edge variants of ECIH, the following topics appear most often (sample distribution from one variant):
ECIH (60 Q)
- First Response & Forensic Readiness — Evidence Handling · 7
- Incident Handling & Response Process — Preparation · 5
- First Response & Forensic Readiness — Volatile Data · 5
- IH&R Fundamentals — IH&R Teams · 4
- Incident Handling & Response Process — Containment · 4
- IH&R Fundamentals — Signs of an Incident · 3
- IH&R Fundamentals — Vulnerability Management · 3
- IH&R Fundamentals — Concepts · 3
ECIH difficulty calibration
Advanced tier. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep.
ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
Verified content — Wrexa Edge's ECIH bank has been deeply curated with real exam-aligned content (estimated 100% syllabus coverage).
How Wrexa Edge prepares you for ECIH
- Real test-day interface
- 50 distinct variants
- Detailed analytics
- Spaced repetition (Notebook)
- Optional proctoring
- Free to start
Expert take: what ECIH really tests
The EC-Council Certified Incident Handler (ECIH v3, 212-89) is a specialist-level, method-driven credential covering the complete incident-handling-and-response lifecycle. It is a 100-question, 3-hour exam with a form-dependent cut score.
Preparation tips
- Memorise the incident-handling stages in order (preparation → triage → containment → eradication → recovery → post-incident).
- Study per-vector handling (malware, email, cloud, insider) as distinct playbooks.
- Use the official ECIH v3 courseware labs to reinforce forensic and evidence-handling steps.
Common mistakes to avoid
- Studying against ECIH v2 material — ensure v3 (212-89) content.
- Treating it as a penetration-testing exam; the focus is response and handling, not offensive testing.
ECIH study plan
A phase-by-phase roadmap from your first concept to test-ready. Stretch or compress each phase to fit the time you have before your attempt.
- Memorise the incident-handling stages in order (preparation → triage → containment → eradication → recovery → post-incident)
- Study the ECIH v3 process framework
- Use the official ECIH v3 courseware
- Study malware, email, network, web-application, cloud, insider and endpoint incident playbooks
- Reinforce forensic and evidence-handling steps
- Work the courseware labs
- Take practice assessments on v3 content
- Keep the focus on response/handling, not offensive testing
- Review the full 3-hour blueprint
Where ECIH can take you
A strong ECIH result opens up these careers and higher-study paths:
- Incident handler / responder
- SOC / CSIRT team member
- Security / threat analyst
Best books & official prep for ECIH
- EC-Council ECIH v3 courseware — EC-Council
Official practice: EC-Council offers the official ECIH v3 training with labs and practice assessments.
Previous-year papers: EC-Council does not release past papers; practice comes with the official courseware.
Sample ECIH practice questions
5 questions taken from the ECIH mock tests on Wrexa Edge. Try each one, then reveal the answer.
-
Q1. An "indicator of compromise" (IoC) is best described as:
- A control that prevents a breach from occurring
- A predictor of future attacker behavior before any breach
- A compliance requirement mandated by regulators
- Forensic evidence, such as a malicious hash, IP, or registry key, that suggests a system has been breached
Show answer
Answer: D — Forensic evidence, such as a malicious hash, IP, or registry key, that suggests a system has been breached
-
Q2. Which of the following is a "precursor" rather than an "indicator" of an incident?
- A spike in reconnaissance scans suggesting an attack may soon occur
- Antivirus alerting on a file already executing on a host
- Log entries showing data being exfiltrated
- A ransomware note displayed on a user desktop
Show answer
Answer: A — A spike in reconnaissance scans suggesting an attack may soon occur
-
Q3. Multiple failed logins followed by a successful login from an unfamiliar country is most likely a sign of:
- Normal password rotation by the user
- A credential-based unauthorized access attempt
- A scheduled backup job
- A DNS cache refresh
Show answer
Answer: B — A credential-based unauthorized access attempt
-
Q4. What is the primary goal of a vulnerability management program?
- To respond to incidents only after they are confirmed
- To collect legally admissible forensic evidence
- To continuously identify, assess, prioritize, remediate, and verify weaknesses before they are exploited
- To notify law enforcement of all detected threats
Show answer
Answer: C — To continuously identify, assess, prioritize, remediate, and verify weaknesses before they are exploited
-
Q5. In the vulnerability management lifecycle, what typically follows remediation of a flaw?
- Deleting the asset from the inventory
- Publicly disclosing the vulnerability details
- Escalating to the containment phase
- Verification (rescanning to confirm the fix was effective)
Show answer
Answer: D — Verification (rescanning to confirm the fix was effective)
Frequently asked questions
- What is the ECIH exam pattern?
- EC-Council Certified Incident Handler contains 60 questions across 1 section: ECIH (60 Q). Total duration is 180 minutes (about 180 seconds per question).
- Does ECIH have negative marking?
- No — ECIH has no negative marking. Each correct answer is worth 1 mark, so attempt every question.
- How is ECIH scored?
- Scaled score range: 100 to 1000. ECIH (pass 700/1000).
- How can I practise ECIH online for free?
- Wrexa Edge gives you a free full-length ECIH mock test — with instant scoring, detailed explanations and analytics — plus 49 more with a one-time $1.99 unlock that never expires. Start practising in under a minute, no card required.
- What is the difficulty level of ECIH?
- ECIH is rated Advanced difficulty on Wrexa Edge. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep. ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
- How long is the ECIH exam?
- ECIH runs for 180 minutes total. On Wrexa Edge the timer is enforced exactly as on the real exam — including no inter-section breaks.
- What topics are covered in ECIH?
- ECIH is split into: ECIH (60 Q). Each section is timed and weighted separately. ECIH · 100 Q in 180m. Incident handling & response process, malware/email/network/web app incidents, cloud & insider threats, forensic readiness. · Official language: English.
- What tools or aids are allowed during ECIH?
- No special tools are required. Note: real exam is proctored — Wrexa Edge mirrors this with a webcam-based proctoring flow you can enable.
- Is the ECIH test adaptive?
- No — ECIH is a fixed-form (linear) test. Every candidate sees the same number of questions per section.
- How many ECIH mock tests does Wrexa Edge offer?
- Wrexa Edge generates 50 distinct ECIH variants — each with different question content, not just shuffled options — the first one free for everyone and 49 more with a one-time $1.99 unlock. That's 3000 unique practice questions in the real test-day interface.
- Is there a free ECIH test series 2026?
- Yes. The Wrexa Edge ECIH test series for 2026 gives you a free full-length mock test (50 in total) plus subject-wise and topic-wise tests — instant scoring and detailed analysis, no card required.
- Are ECIH previous year question–style papers included?
- Every ECIH mock is modelled on the official exam pattern and the style of previous years' papers — the same 60-question structure, sections and marking — so your practice mirrors the real paper you'll sit.
- Which is the best free ECIH mock test online?
- Wrexa Edge's ECIH mock test replicates the real exam interface, timing and marking scheme, with instant score, section-wise analysis and 50 fresh variants — a strong free choice for 2026 preparation.
- Can I take the ECIH mock test on mobile?
- Yes. ECIH mock tests run in any browser on mobile, tablet or desktop — no app or download needed. Start on your phone and your progress and analytics sync when you sign in.
- What is the ECIH syllabus?
- The ECIH syllabus maps to its 1 section: ECIH (60 Q). Wrexa Edge's mock tests cover the complete syllabus topic by topic — see the topics-covered breakdown above — so you practise every area at real exam difficulty.
- What is the eligibility for ECIH?
- EC-Council recommends about 1 year of information-security experience, or completion of official ECIH training. A specialist-level credential for mid-level security professionals. Wrexa Edge focuses on realistic ECIH practice: a free full-length mock in the exact exam pattern, ready whenever you are.
- When is the ECIH exam and how should I prepare?
- Official ECIH exam dates are announced by the conducting body for each cycle — check the latest notification for the current schedule. To be ready, follow a phased study plan and take full-length timed mocks; Wrexa Edge gives you a free ECIH mock with instant scoring so you can track your readiness week by week.
Related exams & practice tests
Candidates preparing for ECIH also practise these on Wrexa Edge:
Browse more: All Tech & IT Certifications exams → · Full exam catalog →
Ready to ace ECIH?
Join thousands of candidates practising on Wrexa Edge. Free signup, 50 variants per exam, instant scoring.
Start practising free →