thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Courses  /  EC-Council  /  EC-Council Certified Incident Handler (ECIH) v3
Exam 212-89E|CIH v3 EC-Council College credit

EC-Council Certified Incident Handler (ECIH) v3

Learn what to do, in what order, when an incident lands: malware, email, network, web, cloud, endpoint and insider threats, start to finish.

5 days, instructor-led In class or live online Class Hub + 90 days Military funding accepted Up to 3 college credits

Course overview

10 modulesEvery incident typeMalware to insider threats
100 questionsThree-hour examExam 212-89, ECIH v3
DoD 8140Approved credentialANAB accredited

thinQtank® Learning is offering a unique instructor-led training camp that gives students the knowledge and skills needed to handle and respond to security incidents — not how an attack works, but what you do about it, in order, under pressure, and how you write it up afterward. Malware, email, network, web application, cloud, endpoint and insider incidents each get their own handling and response track, on top of the forensic readiness and first response that decide whether the evidence survives at all.

This course also helps students prepare to take the EC-Council Certified Incident Handler exam, 212-89. E|CIH is a specialist program and EC-Council expects at least one year of experience working as a cybersecurity professional before you sit it. This course is built on ECIH v3, the current version, which carries ten modules.

Your certification path

Where this course sits: what to have first, and where it leads.

This courseEC-Council Certified Incident Handler (ECIH) v3Exam 212-89

Course objectives

What you will be able to do by the end of the class.

Incident handling processApply the full incident handling and response process, from preparation to post-incident review.
First response and forensic readinessPrepare evidence collection in advance and preserve it at first response.
Malware and email incidentsContain and eradicate malware outbreaks and email-borne attacks.
Network and web application incidentsHandle network intrusions and web application compromises.
Cloud, endpoint and insider incidentsRespond to incidents in cloud tenants, on endpoints and from insiders.
Reporting and legalDocument incidents to a standard that holds up, within the relevant laws and regulations.

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • SOC analysts who are already handling incidents and want the method behind it
  • Incident response team members and team leads
  • Cyber forensic investigators, consultants, analysts and managers
  • Penetration testers who need to understand the other side of the callout
  • Security administrators and engineers on the escalation path
  • Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0

Prerequisites

  • At least one year of experience working as a cybersecurity professional. EC-Council states this plainly, and it is the honest bar — this course assumes you have seen a live environment
  • Working knowledge of networks, operating systems and common attacks
  • No certification is required first, but Security+ or CND is a comfortable place to be standing

Course outline

8 modules. Open any one to see what it covers.

01Incident handling fundamentals
  • Incidents and their business impact
  • Policies, plans and playbooks
  • Laws and standards
02The incident handling process
  • Preparation and detection
  • Containment, eradication and recovery
  • Post-incident activity
03Forensic readiness and first response
  • Forensic readiness planning
  • First response actions
  • Evidence preservation
04Malware incidents
  • Detecting malware
  • Containment and eradication
  • Recovery
05Email security incidents
  • Phishing and spoofing
  • Investigating email
  • Response steps
06Network and web application incidents
  • Network intrusions and DoS
  • Web application attacks
  • Handling and response
07Cloud security incidents
  • Cloud incident types
  • Provider and customer roles
  • Cloud response steps
08Insider and endpoint incidents
  • Insider threat indicators
  • Endpoint incident handling
  • Reporting and documentation

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labsLabs are built into the modules so you practise what you learn.
Exam preparation built inPractice questions and focused review aligned to exam 212-89.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the 212-89 exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by certified instructors
Additional hours of remote lab access across every incident type in the course
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course

Study plan

How the 5 days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • Incident handling fundamentals
  • The incident handling process
Day 2
  • Forensic readiness and first response
  • Malware incidents
Day 3
  • Email security incidents
  • Network and web application incidents
Day 4
  • Cloud security incidents
  • Insider and endpoint incidents
Day 5
  • Final review and exam strategy
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Book your exam while the material is fresh

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

EC-Council Certified Incident Handler (E|CIH v3) · exam 212-89

Exam code212-89
Questions100
Time3 hours
Passing scoreSet per exam form, 60%–85%
Format
Multiple choice
Voucher
Exam voucher available through thinQtank for $450
Validity
Valid for three years, maintained with 120 EC-Council continuing education credits

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 This certification is not on the DoD 8570 baseline list. Under DoD 8140, a degree or qualifying training can also meet the requirement. See which certifications qualify in the DoD Workforce Navigator.
College credit Pass the exam and these universities will count it toward a degree. This is what each school publishes about its own transfer policy; the registrar makes the final call.
3credits UMGC
Accepted WGU amount not published
3creditsACE recommendationaccepted by 1,500+ schools

Most schools only count IT certifications earned in the last three to five years (some require them to be current), and several will not award transfer credit once you have enrolled. Get your evaluation done first.

Where it can take you

Roles this certification is commonly asked for.

Incident ResponderLead or support the response when an incident is declared.
SOC Analyst (Tier 2)Take escalations and run them through the handling process.
Cyber Forensic InvestigatorPreserve and analyze evidence during incidents.
Security EngineerBuild the detection and response capability others rely on.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Nov 16 – 20, 2026 Sterling, VA Classroom + live online Reserve
Nov 30 – Dec 4, 2026 Atlanta, GA Classroom + live online Reserve
Dec 7 – 11, 2026 Burbank, CA Classroom + live online Reserve
Jan 4 – 8, 2027 Sterling, VA Classroom + live online Reserve
Jan 25 – 29, 2027 Atlanta, GA Classroom + live online Reserve
Feb 1 – 5, 2027 Burbank, CA Classroom + live online Reserve
Mar 1 – 5, 2027 Sterling, VA Classroom + live online Reserve
Mar 15 – 19, 2027 Atlanta, GA Classroom + live online Reserve
Mar 29 – Apr 2, 2027 Burbank, CA Classroom + live online Reserve
Apr 26 – 30, 2027 Sterling, VA Classroom + live online Reserve
May 10 – 14, 2027 Atlanta, GA Classroom + live online Reserve
May 24 – 28, 2027 Burbank, CA Classroom + live online Reserve

11 more dates through December 2027. Ask about a later date.

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam 212-89, with Class Hub open for 90 days after.

Frequently asked questions

Do I need experience?
EC-Council expects at least one year of cybersecurity work experience; attending official training satisfies the eligibility requirement.
How does E|CIH relate to CHFI?
E|CIH covers handling and responding to incidents; CHFI goes deeper into forensic investigation. They pair well.
Is the voucher included?
No. A 212-89 voucher is available through thinQtank for $450; ask and we add it.
What does it cost?
The standard price is $1,050; exam voucher available through thinQtank for $450. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
5 days of live, instructor-led training.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to EC-Council CHFI, CompTIA CySA+, EC-Council - Certified Network Defender (CND). Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your Certified Incident Handler (ECIH) v3?

Next class Nov 16 – 20, 2026 · Sterling, VA and live online.