OpenExamsFREE PRACTICE — ANY EXAM

EC-Council Certified Incident Handler — Information & Free Practice

200 free questions · Answer explanations · No signup required

Start free practice →

Exam Review

About EC-Council Certified Incident Handler

EC-Council Certified Incident Handler · US

Key exam facts

Provider
EC-Council develops and administers the examination, delivered through the ECC Exam Center / EC-Council Test Centers.
Format
Proctored multiple-choice examination.
Exam questions
Total questions: 100.
Time limit
3 hours.
Passing score
Form-specific percentage cut score ranging from 60% to 85%.
Exam fee
US exam voucher with Remote Proctor Services: USD 450 list price; eligible academic discounts may apply. Non-training eligibility processing has a separate non-refundable USD 100 fee; training bundles and partner prices vary.

Topics covered

  • Incident Response and Handling Process (11%)

    • Information Security Incidents
    • Incident Management
    • Incident Response Automation and Orchestration
    • Incident Handling Standards and Frameworks
    • Incident Handling Laws and Acts
    • Incident Response and Handling Process
    • Preparation
    • Incident Recording and Assignment
    • Incident Triage
    • Notification
    • Containment
    • Evidence Gathering and Forensics Analysis
    • Eradication
    • Recovery
    • Post-Incident Activities

  • First Response (11%)

    • First Responder
    • Securing and Documenting the Crime Scene
    • Collecting Evidence at the Crime Scene
    • Preserving, Packaging, and Transporting the Evidence

  • Malware Incidents (11%)

    • Malware Incidents Handling Preparation
    • Malware Incidents Detection
    • Malware Incidents Containment and Eradication
    • Recovery after Malware Incidents
    • Guidelines for Preventing Malware Incidents

  • Email Security Incidents (12%)

    • Types of Email Security Incidents
    • Preparation for Handling Email Security Incidents
    • Detection and Containment of Email Security Incidents
    • Eradication of Email Security Incidents
    • Recovery after Email Security Incidents
    • Best Practices against Email Security Incidents

  • Network Level Incidents (12%)

    • Preparation for Handling Network Security Incidents
    • Network Security Incidents Detection and Validation
    • Handling Unauthorized Access Incidents
    • Handling Inappropriate Usage Incidents
    • Handling Denial-of-Service Incidents
    • Handling Wireless Network Security Incidents

  • Application Level Incidents (11%)

    • Preparation for Handling Web Application Security Incidents
    • Web Application Security Incidents Detection and Analysis
    • Containment and Eradication of Web Application Security Incidents
    • Recovery from Web Application Security Incidents
    • Best Practices for Securing Web Applications

  • Cloud Security Incidents (10%)

    • Challenges in Cloud Incident Handling and Response
    • Handling Cloud Security Incidents
    • Handling Azure Security Incidents
    • Handling AWS Security Incidents
    • Handling Google Cloud Security Incidents
    • Best Practices Against Cloud Security Incidents

  • Insider Threats (11%)

    • Types of Insider Threats
    • Preparation Steps for Handling Insider Threats
    • Detection, Containment, and Eradication of Insider Threats
    • Recovery After Insider Attacks
    • Best Practices against Insider Threats

  • Endpoint Security Incidents (11%)

    • Need for Endpoint Security Incident Handling and Response
    • Preparation for Handling Endpoint Security Incidents
    • Detection and Validation of Endpoint Security Incidents
    • Handling Mobile-based Security Incidents
    • Handling IoT-based Security Incidents
    • Handling OT-based Security Incidents

How to prepare

Work through the topics, read the explanation after each answer, and revisit the areas where you miss questions. Use the official outline and reference materials below to guide your study.

These independent practice questions are not actual exam items and do not guarantee a passing result.

Frequently asked questions

What is the exam format?

Proctored multiple-choice examination.

How many questions are on the exam?

Total questions: 100.

How long is the exam?

3 hours.

What is the passing score?

Form-specific percentage cut score ranging from 60% to 85%.

How much does the exam cost?

US exam voucher with Remote Proctor Services: USD 450 list price; eligible academic discounts may apply. Non-training eligibility processing has a separate non-refundable USD 100 fee; training bundles and partner prices vary.

Official sources and references

Confirm current exam arrangements with the exam provider.