Course overview
thinQtank® Learning is offering a unique instructor-led training camp that gives students the knowledge and skills needed to handle and respond to security incidents — not how an attack works, but what you do about it, in order, under pressure, and how you write it up afterward. Malware, email, network, web application, cloud, endpoint and insider incidents each get their own handling and response track, on top of the forensic readiness and first response that decide whether the evidence survives at all.
This course also helps students prepare to take the EC-Council Certified Incident Handler exam, 212-89. E|CIH is a specialist program and EC-Council expects at least one year of experience working as a cybersecurity professional before you sit it. This course is built on ECIH v3, the current version, which carries ten modules.
What's included
14 itemsthinQtank® Learning Accelerated Custom Exam Study Guide for the 212-89 exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by certified instructors
Additional hours of remote lab access across every incident type in the course
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course
What you'll be able to do
16 objectives- Explain incident handling and response, and where it sits in a security program
- Understand the signs of an incident, and what it costs to miss them
- Apply the incident handling and response process end to end
- Build incident handling and response policies, plans and playbooks
- Establish forensic readiness before an incident rather than during one
- Carry out a first response that preserves evidence rather than destroying it
- Handle and respond to malware incidents
- Handle and respond to email security incidents
- Handle and respond to network security incidents
- Handle and respond to web application security incidents
- Handle and respond to cloud security incidents
- Handle and respond to insider threats
- Handle and respond to endpoint security incidents
- Apply the laws, regulations and standards that constrain an investigation
- Report and document an incident so the record stands up to later review
- Contribute to recovery, and to the post-incident review that prevents a repeat
The exam
- Exam 212-89 — EC-Council Certified Incident Handler
- One hundred multiple-choice questions
- Three hours to complete
- THE PASSING MARK MOVES. EC-Council uses several forms of this exam and sets a cut score for each one, ranging from 60% to 78%. There is no single published passing number, so prepare for the top of that range — you do not find out which form you have until you sit it
- Delivered through the EC-Council Exam Portal
- At least one year of experience working as a cybersecurity professional is expected
- ANAB accredited, and approved by the US Department of Defense under directive 8140
- Built on ECIH v3, the current version of the program, which carries ten modules
- E|CIH Voucher — an exam voucher is available through thinQtank for $450 USD. Ask when you register and we will add it to your enrollment
Who it's for, and what you need first
Target Audience
- SOC analysts who are already handling incidents and want the method behind it
- Incident response team members and team leads
- Cyber forensic investigators, consultants, analysts and managers
- Penetration testers who need to understand the other side of the callout
- Security administrators and engineers on the escalation path
- Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0
Prerequisites
- At least one year of experience working as a cybersecurity professional. EC-Council states this plainly, and it is the honest bar — this course assumes you have seen a live environment
- Working knowledge of networks, operating systems and common attacks
- No certification is required first, but Security+ or CND is a comfortable place to be standing
How it's delivered
Instructor-Led Training
Immersive Live-Online Training
On-Site and Custom Delivery
Training Camp Format
This course is delivered as an instructor-led training camp, with the exam sat in the classroom as part of the camp. Camps are scheduled by cohort, and the balance of lecture and hands-on lab work is set to suit the group and the delivery method. Contact us for the schedule covering your dates.
Dates and locations
26 scheduled| Dates | Location | Status | |
|---|---|---|---|
| Mon Sep 14 – Sep 18, 20265 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Guaranteed to run | Request info |
| Mon Sep 28 – Oct 2, 20265 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Guaranteed to run | Request info |
| Mon Oct 19 – Oct 23, 20265 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Guaranteed to run | Request info |
| Mon Nov 16 – Nov 20, 20265 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Nov 30 – Dec 4, 20265 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Dec 7 – Dec 11, 20265 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Jan 4 – Jan 8, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Jan 25 – Jan 29, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Feb 1 – Feb 5, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Mar 1 – Mar 5, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Mar 15 – Mar 19, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Mar 29 – Apr 2, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Apr 26 – Apr 30, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon May 10 – May 14, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon May 24 – May 28, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Jun 21 – Jun 25, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Jul 12 – Jul 16, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Jul 19 – Jul 23, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Aug 16 – Aug 20, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Aug 30 – Sep 3, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Sep 13 – Sep 17, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Oct 18 – Oct 22, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Oct 25 – Oct 29, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
| Mon Nov 15 – Nov 19, 20275 days · Mon–Fri | Burbank, CA3301 N San Fernando Blvd | Open | Request info |
| Mon Dec 6 – Dec 10, 20275 days · Mon–Fri | Sterling, VA21481 Ridgetop Cir | Open | Request info |
| Mon Dec 13 – Dec 17, 20275 days · Mon–Fri | Atlanta, GA431 Marietta St NW | Open | Request info |
Guaranteed to run means the class goes ahead whatever the enrollment.
Prices shown are MSRP. Qualified military personnel funding through Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0 pay a flat $1,500 per class, whatever the listed price. Everyone else — call 855-868-4467 about group pricing, discounts and current promotions.