EC-Council Certified Incident Handler (ECIH)
The E|CIH exam can be attempted after the completion of the official E|CIH course taught either by any EC-Council Authorized Training Center (ATCs) or by EC-Council directly. Candidates that successfully pass the exam will receive the E|CIH certificate and membership privileges. Members are required to adhere to the policies of EC-Councils Continuing Education Policy.
Duration: 3 Days or 24 hours total class time
The incident handling skills taught in E|CIH are complementary to the job roles below as well as many other cybersecurity jobs:
• Penetration Testers
• Vulnerability Assessment Auditors
• Risk Assessment Administrators
• Network Administrators
• Application Security Engineers
• Cyber Forensic Investigators/ Analyst and SOC Analyst
• System Administrators/Engineers
• Firewall Administrators and Network Managers/IT Managers
E|CIH is a specialist-level program that caters to mid-level to high-level cybersecurity professionals. In order to increase your chances of success, it is recommended that you have at least 1 year of experience in the cybersecurity domain.
E|CIH members are ambitious security professionals who work in Fortune 500 organizations globally.
E|CIH allows cybersecurity professionals to demonstrate their mastery of the knowledge and skills required for Incident Handling
Exam Title EC-Council Certified Incident Handler
Exam Code 212-89
Number of Questions 100
Duration 3 hours
Availability EC-Council Exam Portal
Test Format Multiple Choice
Passing Score 70%
To be eligible to sit the E|CIH Exam, the candidate must either:
Attend official E|CIH training through any of EC-Council’s Authorized Training Centers (ATCs) or attend EC-Council’s live online training via iWeek or join our self-study program through iLearn (see https://iclass.eccouncil.org).
Module 01: Introduction to Incident Handling and Response
Module 02: Incident Handling and Response Process
Module 03: Forensic Readiness and First Response
Module 04: Handling and Responding to Malware Incidents
Module 05: Handling and Responding to Email Security Incidents
Module 06: Handling and Responding to Network Security Incidents
Module 07: Handling and Responding to Web Application Security Incidents
Module 08: Handling and Responding to Cloud Security Incidents
Module 09: Handling and Responding to Insider Threats