thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

EC-Council · Cybersecurity · Associate

EC-Council Certified Incident Handler (E|CIH) exam guide

Exam 212-89 (ECIH v3)

The EC-Council Certified Incident Handler (ECIH v3) validates the ability to prepare for, detect, contain, eradicate and recover from security incidents across malware, email, network, web application, cloud, insider and endpoint scenarios. It is DoD 8140 approved for incident response roles.

Questions100
Time limit180 minutes
Passing scoreSee official page
Exam feeSee official page
Valid for3 years
DeliveryEC-Council exam portal (remote proctored) or Pearson VUE test center

Format: Multiple choice. Fee note: EC-Council sells the exam mainly bundled with training (packages from about $999 on demand); standalone voucher pricing varies by region and is not published on the certification page.

Who it's for

SOC analysts, incident responders and IT staff with at least a year of cybersecurity experience who handle security incidents.

What the exam covers

Incident Handling and Response Process—
First Response—
Malware Incidents—
Email Security Incidents—
Network Security Incidents—
Web Application Security Incidents—
Cloud Security Incidents—
Insider Threats—
Endpoint Security Incidents—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: At least 1 year of cybersecurity experience, or attend official EC-Council training.

Recommended: Mid-level cybersecurity experience; the program is not aimed at beginners.

Keeping it active

Valid 3 years. Maintain through the EC-Council Continuing Education (ECE) program: earn 120 ECE credits in the 3-year cycle and pay the annual ECE fee.

Skills & careers

Skills it validates

  • Incident response planning and policy
  • First response and evidence preservation
  • Handling malware and email incidents
  • Responding to network and web application attacks
  • Cloud and endpoint incident handling
  • Managing insider threat incidents

Job roles

Incident HandlerIncident ResponderSOC AnalystThreat AnalystSecurity Administrator

DoD 8140

Recognized in the DoD 8140 qualification matrix for incident response work roles. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Incident handling process, policies, first response and evidence handling.
  2. Week 2: Malware, email and network incidents.
  3. Week 3: Web application, cloud, insider and endpoint incidents.
  4. Week 4: Practice with real IR playbooks (NIST SP 800-61) and timed practice tests.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know the incident handling phases in order and which actions belong in each.
  • Evidence preservation and first response steps are frequently tested.
  • Map incident types to the right containment strategy.
  • Know common email attack indicators (header analysis, spoofing).
  • 100 questions in 3 hours is generous; read each scenario carefully.

Key terms for this exam

All 37 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does ECIH cost?

EC-Council sells ECIH with training from about $999 on demand; exam-only pricing varies.

How many questions are on ECIH?

100 multiple choice questions in 3 hours.

ECIH vs GCIH?

GCIH is more technical and expensive; ECIH is broader and more affordable.

Who should take ECIH?

Mid-level practitioners with at least a year of cybersecurity experience.

How do I renew ECIH?

Earn 120 ECE credits over 3 years and pay the annual ECE fee.

Official page: www.eccouncil.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.