ECIH exam-day guide
ECIH · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original ID (passport or driver's licence) with a name that matches your exam registration exactly. A mismatch or a photocopy is the most common reason candidates are turned away. If the name on your ID differs from your registration record, contact the provider before exam day to correct it.
Exam appointment confirmation
Have your booking confirmation, candidate ID / registration number, and exam code (ECIH is commonly listed as 212-89) available on screen or printed. You may be asked for these at check-in.
Second form of ID
Some providers and test centres require a second ID or a signature-bearing card. This varies by delivery method (test centre vs. remote proctoring) and by region, so confirm with the provider what applies to your booking.
Proctoring software installed and system-tested
For remote sittings, install the proctoring browser/agent and run the equipment check (webcam, microphone, speakers, bandwidth, OS version) at least a day ahead. Do it again the morning of the exam so any update or permission prompt is already resolved.
Stable internet plus a backup connection
Wired or strong Wi-Fi for the primary connection, and a phone hotspot or second network as fallback. Know in advance how to reach the proctor if the session drops.
Private, well-lit, clutter-free room
A closed door, nothing on the desk except what the provider permits, and no notes, books, posters, or second monitor within camera view. Expect a 360-degree room scan during check-in for remote proctoring.
Phone and wearables put away
Silence and stow phones, smartwatches, earbuds, and any second device out of reach unless the provider explicitly allows a phone for technical support. Follow the proctor's instructions on where to place them.
Confirm scratch paper / on-screen whiteboard policy
Rules on physical scratch paper, pens, and on-screen notepads differ between test-centre and remote delivery, and between providers. Confirm what is allowed with the provider; if physical paper is permitted, expect to show both sides to the camera before and after.
Confirm format, timing, and pass mark
Check your booking confirmation or the official candidate handbook for the current question count, time limit, passing score, and whether question review/navigation is allowed. Do not rely on second-hand numbers from forums; confirm with the provider.
Water, medication, and comfort items cleared
Drinks, snacks, and medication are often restricted or must be declared and shown to the proctor. Confirm with the provider what you may have at your desk, especially if you need medication during the sitting.
Light content review sheet, not new material
One page of your own notes on the incident handling lifecycle (Preparation, Identification/Detection, Containment, Eradication, Recovery, Post-Incident/Lessons Learned), evidence handling and chain of custody, and containment strategy trade-offs. Review it before you start; do not try to learn new topics on exam day.
Arrive or log in early
Plan to arrive or begin check-in well ahead of your slot; check-in, ID verification, and the room scan take time. Confirm the required lead time with the provider for your delivery method.
Plan the day
Stop consuming new material. Re-read your own summary of the incident handling phases and be able to state, for any scenario, which phase you are in and what the next action is. Practise scenario questions where you must choose the FIRST or BEST next step - many items hinge on sequencing rather than definitions. Confirm your appointment details, delivery method, ID requirements, and permitted items with the provider. Sleep on a normal schedule; do not plan an all-night session.
Run the full system/equipment check if testing remotely and confirm the room you will use is clear. Lay out ID, confirmation email, and any permitted items. Charge devices. Do a short, timed practice set (roughly 20 questions in 25 minutes) to calibrate pace, then stop. Get a full night's sleep; a final cram session costs more in focus than it gains in recall.
Eat normally, hydrate, and avoid heavy caffeine if you are already anxious. Re-run the camera/microphone check, close all other applications, silence notifications, and put your phone where the proctor instructs. Have your ID and confirmation within reach. Log in or arrive with margin so check-in delays do not eat into your time.
Answer every question you know, and skip-and-flag anything that needs long reasoning. Read the stem twice: watch for qualifiers like FIRST, BEST, MOST likely, LEAST, and for the role you are playing (first responder, incident handler, management). Eliminate two options first - distractors in this domain often describe a correct action taken at the wrong phase.
Return to flagged items and use remaining time deliberately rather than re-reading everything. Prefer the answer that follows the incident handling lifecycle and preserves evidence; destructive or premature actions (wiping, reimaging, rebooting before capture) are usually the wrong choice. If the exam does not penalise wrong answers, never submit with blanks. Use any scheduled break only if the provider permits one, and be aware the clock may keep running - confirm the policy before you start.
Note any technical issues and report them to the proctor before you close the session, not afterwards. Confirm with the provider how and when results are released and what the retake policy is; do not assume timing.
Rules to check
Bring valid government-issued photo ID whose name matches your registration exactly. If it does not, resolve it with the provider before exam day - do not expect an exception at check-in.
No unauthorised materials at your desk: no notes, printed material, books, second screens, phones, smartwatches, or earbuds unless the provider has explicitly approved an item. Physical scratch paper and on-screen notepads are governed by provider policy - confirm which applies to your delivery method.
Follow all proctor instructions, including the room scan, showing your desk, and turning out pockets. Refusing or disputing a proctor instruction during the session is usually treated as a conduct issue; raise objections afterwards through the provider's support channel.
Breaks are not guaranteed and the clock generally does not stop. Confirm in advance whether breaks are permitted, whether you must remain on camera, and how to request one, so an unplanned break does not cost you exam time.
The exam is scored on correct answers; there is typically no partial credit and no penalty for guessing. Unless the provider states otherwise, answer every question - confirm the scoring and pass-mark rules for your exam version with the provider.
Do not reproduce, share, screenshot, record, or discuss specific exam content, including question wording and answer options. You will likely be bound by a non-disclosure agreement; treat the material as confidential.
If technology fails - connection drop, frozen session, camera error - stop and contact the proctor or provider support immediately and note the time. Do not attempt lengthy self-troubleshooting while the clock runs, and keep any case/ticket reference for a later appeal.
Keep your behaviour consistent with professional ethics throughout: no impersonation, no assistance from another person in the room or remotely, and no attempt to look up answers. Violations can void your result and affect your certification status.