EC-Council Certified Incident Handler certification exam
Proctored knowledge assessment using objective and scenario-based questions
- Type
- Written
- Delivery
- Online
- Duration
- 240 min
Exam sections
E CIH
EC-Council Certified Incident Handler certification exam examines how candidates understand and apply e cih within the wider credential scope. This area connects core concepts to the decisions, dependencies, and consequences practitioners encounter when carrying out the work described by incident handling and response across preparation, triage, containment, evidence, recovery, malware, email, web, cloud, and insider events.
Question notes
Expect this topic to appear through scenario interpretation, objective questions, or practical tasks consistent with the overall EC-Council Certified Incident Handler certification exam format. No separate question count or timing is assigned unless the provider publishes one.
Preparation tips
Build a small practice scenario around e cih and complete it without relying on step-by-step prompts. Afterwards, explain why each decision was appropriate and identify the signal that would have changed your approach.
212
This area concentrates on 212 as it appears in realistic tasks and scenarios. Candidates need to recognize the relevant inputs, choose a defensible approach, and understand how the result supports incident handling and response across preparation, triage, containment, evidence, recovery, malware, email, web, cloud, and insider events.
Question notes
Candidates may encounter 212 through comparisons, troubleshooting prompts, configuration choices, analysis, or applied exercises. Exact distribution can change with the active exam form.
Preparation tips
Practise explaining 212 to a technical peer without reading definitions. Then validate the explanation by completing representative tasks and checking whether your result satisfies the intended objective. For the ec-council-ecih--212-89 assessment, focus this exercise specifically on 212 and the decisions a candidate must make in that context.
Incident Response
Incident Response forms a distinct part of the capability assessed in EC-Council Certified Incident Handler certification exam. The section brings together terminology, working methods, common constraints, and the judgment needed to deliver incident handling and response across preparation, triage, containment, evidence, recovery, malware, email, web, cloud, and insider events.
Question notes
Expect this topic to appear through scenario interpretation, objective questions, or practical tasks consistent with the overall EC-Council Certified Incident Handler certification exam format. No separate question count or timing is assigned unless the provider publishes one.
Preparation tips
Review a realistic artifact connected to incident response—such as a configuration, report, backlog, model, log set, or design—and identify both correct practice and subtle weaknesses that an assessment could probe.
Incident Handling
Questions or tasks in this area explore incident handling from both conceptual and operational perspectives. Strong performance depends on connecting the topic to the broader responsibility of incident handling and response across preparation, triage, containment, evidence, recovery, malware, email, web, cloud, and insider events.
Question notes
Candidates may encounter incident handling through comparisons, troubleshooting prompts, configuration choices, analysis, or applied exercises. Exact distribution can change with the active exam form.
Preparation tips
Use a lab, case study, or worked example to connect incident handling to observable outcomes. Deliberately introduce one incorrect assumption, diagnose its effect, and document the correction in your own words.