ECIH

EC-Council lists 100 multiple-choice questions with a three-hour duration, taken through the EC-Council Exam Portal. The exam title is 'EC-Council Certified Incident Handler'. Because the item count is high relative to the time limit, plan on roughly under two minutes per question so you can flag and revisit weaker items rather than stalling.

Yes. EC-Council states that to qualify for the program you must have at least one year of experience working as a cybersecurity professional, and describes the course as aimed at mid-level to senior practitioners rather than beginners. If you are new to security operations, build foundational networking, operating system, and log analysis skills first.

The public program page does not publish a passing score, and the passing_score field for this profile is null. Treat any specific cut score you see quoted elsewhere as unverified and confirm it with EC-Council or your accredited training partner before you rely on it for exam-day planning.

EC-Council's program page does not state a retake policy, so this profile records it as null. Voucher terms and any retake eligibility usually come from the training center or instructor you purchase through, so ask them directly about retake conditions before booking your attempt.

EC-Council describes the instructor-led course as a three-day program with 24 hours of total class time, followed by the three-hour certification exam. Self-paced learners using iLearn should expect to spend considerably longer, since the student manual runs to 1600+ pages and the labs cover 95 exercises across 22 scenario-based scenarios.

Start with the nine-stage process, then work through the module list. Modules 1 and 2 build the vocabulary and process backbone; Module 3 covers first response and evidence handling; Modules 4 through 10 each apply that same process to a different incident family. Learning the general process first stops you from memorizing ten disconnected playbooks.

The published modules cover malware incidents, email security incidents, network security incidents, web application security incidents, cloud security incidents (including Azure, AWS, and Google Cloud handling), insider threats, and endpoint security incidents that extend to mobile, IoT, and OT environments. Each module is structured around preparation, detection, containment, analysis, eradication, and recovery.

The usual problems are treating it as a vocabulary test and skipping the process order, ignoring first-response evidence handling, and studying incident types in isolation without the shared nine-stage flow. Questions often hinge on which stage comes next or which action preserves evidence, so drill sequencing and evidence handling rather than tool name recall.

EC-Council states the program is ANAB-accredited and approved by the US Department of Defense under directive 8140, and lists ECIH against the Cyber Defense Incident Responder work role. That recognition is EC-Council's own claim on its program page; verify current status with the accrediting and approving bodies if it matters for your role.

EC-Council lists iLearn as an asynchronous self-study video format, iWeek as live online instructor-led training, and in-person delivery through accredited training centers. EC-Council advertises single on-demand courses starting at $999, single live online courses starting at $1,399, and an unlimited on-demand subscription starting at $3,999.