A clinic covered by the HIPAA breach rule discovers a breach of unsecured health records. What is the outer limit for notifying the affected individuals?45 CFR 164.404, paragraph (b)
A new incident report arrives. Which two things does triage do with it first?NIST SP 800-61 Rev. 3, Table 3, RS.MA-02
A user logs in to a file server at 9 a.m. with no sign of anything wrong. In NIST SP 800-61 Rev. 3 terms, what is that login?NIST SP 800-61 Rev. 3, section 1
An incident lead asks for a higher level of management to take the decisions. What does NIST SP 800-61 Rev. 3 call this, as distinct from escalation?NIST SP 800-61 Rev. 3, Table 3, RS.MA-04
In RFC 2350, what is a response team's constituency?RFC 2350, Appendix A
In the NIST SP 800-61 Rev. 3 model, where do the lessons learned from every activity go?NIST SP 800-61 Rev. 3, section 2.1
Recovery calls for a restore from last week's backup. What should be done with the backup first?NIST SP 800-61 Rev. 3, Table 3, RC.RP-03
Show all 100 questions (93 more)
Incident response and handling process, continued
Under CISA's incident response playbook for federal civilian agencies, how soon after determining an incident must the agency notify CISA?CISA Cybersecurity Incident & Vulnerability Response Playbooks, Incident Response Playbook, Coordination
What does an incident response playbook provide?NIST SP 800-61 Rev. 3, section 2.3
Where does NIST suggest recording the current status of each incident (new, in progress, forwarded for investigation, resolved)?NIST SP 800-61 Rev. 2 (archived), section 3.2.5
Which document sets out the specific technical processes, techniques, checklists and forms the response team uses?NIST SP 800-61 Rev. 2 (archived), section 2.3.3
First response 11
A responder needs the deleted files and slack space of a drive as well as its live files. Which copy captures them?NIST SP 800-86, section 4.2.1
An evidence log gives the time and date of each handling of an item. What must go with each time?NIST SP 800-61 Rev. 2 (archived), section 3.3.2
Before touching a running computer at the scene, what should the responder note or photograph?NIST SP 800-86, section 3.1.2
Files are copied from a suspect drive for analysis. Which arrangement does NIST SP 800-86 describe?NIST SP 800-86, section 4.2
How does RFC 3227 say access to archived evidence should be handled?RFC 3227, section 4.2
In RFC 3227's order of volatility, which of these is collected last?RFC 3227, section 2.1
RFC 3227 lists five properties of usable computer evidence. What does "authentic" mean there?RFC 3227, section 2.4
What do the letters in a file's MAC times stand for?NIST SP 800-86, section 4.2.3
What does RFC 3227 tell a responder to note about the system clock?RFC 3227, section 2
Which of these does NIST SP 800-86 class as volatile operating system data, lost when the host loses power?NIST SP 800-86, sections 5.1.1 and 5.1.2
Why can a graceful operating system shutdown cost a responder evidence?NIST SP 800-86, section 5.2.2
Malware incidents 11
A malicious program on a host listens for commands on a TCP port. What does NIST SP 800-83 call it?NIST SP 800-83 Rev. 1, section 2.2
A team finds infected hosts by searching logs for evidence of recent infections. Which identification technique is this?NIST SP 800-83 Rev. 1, section 4.2.2.1
After which finding should an infected host be rebuilt, not just disinfected?NIST SP 800-83 Rev. 1, section 4.4
In NIST SP 800-83, what sets a worm apart from a virus?NIST SP 800-83 Rev. 1, section 2.1
NIST names two main aspects of recovery from a malware incident. One is restoring the functionality and data of infected hosts. What is the other?NIST SP 800-83 Rev. 1, Executive Summary
Ransomware is spreading and a server cannot be disconnected from the network. CISA says to power it down. What is lost by doing so?CISA #StopRansomware Guide, Part 2, Detection and Analysis
Shortly before files are encrypted, a host deletes its volume shadow copies and turns off its recovery services. Which ATT&CK technique is this?MITRE ATT&CK, T1490 Inhibit System Recovery
What is a blended attack?NIST SP 800-83 Rev. 1, section 2.1
Which defensive architecture runs an application in a controlled environment that restricts what it may do and isolates it from other applications?NIST SP 800-83 Rev. 1, section 3.5.2
Which way of finding infected hosts does NIST call not feasible for most situations?NIST SP 800-83 Rev. 1, section 4.2.2
Why does CISA say backups should be kept offline?CISA #StopRansomware Guide, Part 1, Preparing for Ransomware and Data Extortion Incidents
Email security incidents 12
A clerk realises she typed her work password into a fake sign-in page. According to CISA, what should she do?CISA, Avoiding Social Engineering and Phishing Attacks, What do you do if you think you are a victim?
A DKIM signature carries d=example.com and s=mail2026. Where does the verifier look up the public key?RFC 6376, section 3.6.2.1
A message passes DKIM with d=mailer.example.net, but its From header says billing@example.com. Why does DMARC fail it?RFC 7489, section 3.1.1
A phishing message shows a trusted name in its From header and still passes SPF. Which identity does SPF check?RFC 7208, section 2.4
A text message tells staff to tap a link and confirm their payroll login. What does CISA call this form of social engineering?CISA, Avoiding Social Engineering and Phishing Attacks, What is a smishing attack?
After a mailbox takeover is contained, responders check the mailbox for a rule that quietly sends copies of mail outside. Which ATT&CK technique leaves such a rule?MITRE ATT&CK, T1114.003 Email Forwarding Rule
An attacker who controls one staff mailbox uses it to send convincing lures to colleagues. What does ATT&CK call this?MITRE ATT&CK, T1534 Internal Spearphishing
Each SMTP server that relays a message inserts a Received trace record. Where?RFC 5321, section 4.1.1.4
How many DNS-querying terms may an SPF record cause before evaluation must return permerror?RFC 7208, section 4.6.4
In a DMARC record, what is the rua tag for?RFC 7489, section 6.3
What sets Spearphishing Attachment apart from the other spearphishing sub-techniques in ATT&CK?MITRE ATT&CK, T1566.001 Spearphishing Attachment
Which header line preserves the envelope sender that was given in the SMTP MAIL command?RFC 5321, section 4.4
Network level incidents 12
A handler pings the address an attack came from and gets no reply. What does that show?NIST SP 800-61 Rev. 2 (archived), section 3.3.3
An attacker plugs in a rogue wireless access point that passes itself off as the office network. Which NIST attack vector covers it?NIST SP 800-61 Rev. 2 (archived), section 3.2.1
Bandwidth looks normal, yet a web application has run out of processing power under a stream of requests. Which CISA attack type fits?CISA, FBI and MS-ISAC, Understanding and Responding to DDoS Attacks, DoS and DDoS Attacks Categorized Into Three Technique Types
CISA sorts DDoS techniques into three types. Which type exploits weak protocol implementations, typically at layers 3 and 4?CISA, FBI and MS-ISAC, Understanding and Responding to DDoS Attacks, DoS and DDoS Attacks Categorized Into Three Technique Types
How do SYN cookies let a server survive a SYN flood?RFC 4987, section 3.6
How does a content delivery network help during a DDoS attack?CISA, FBI and MS-ISAC, Understanding and Responding to DDoS Attacks, What Steps Should Your Organization Take
What does a wireless IDPS analyze?NIST SP 800-94, Executive Summary
What is a packet sniffer designed to do?NIST SP 800-86, section 6.2.2
What makes a distributed denial-of-service attack harder to block than a plain DoS attack?CISA, FBI and MS-ISAC, Understanding and Responding to DDoS Attacks, Overview
Which practice has a provider drop packets whose source address lies outside the prefix assigned to that customer?RFC 2827 (BCP 38), Abstract
Which type of IDPS examines network traffic for unusual flows, such as a DDoS attack or a client that starts serving other systems?NIST SP 800-94, Executive Summary
Why is a rogue access point on the office network more than a nuisance?NIST SP 800-153, section 3.1.1
Application level incidents 11
A comment posted on a forum runs script in the browser of every later visitor. Which type of cross-site scripting is this?MITRE CWE-79, Alternate Terms
A logged-in user visits a hostile page, and the page silently submits a funds transfer to the bank site in her name. Which weakness did the bank site have?MITRE CWE-352, Description
A web server has been compromised. When analyzing the intrusion, which data does NIST SP 800-44 say to start with?NIST SP 800-44 Version 2, section 9.3
An application keeps no record of logins, failed logins or high-value transactions. Which OWASP Top 10 category describes the gap?OWASP Top 10:2021, A09 Security Logging and Monitoring Failures, Description
An attacker sets a session ID in a victim's browser, waits for the victim to log in, then uses the same ID. Which weakness allowed it?MITRE CWE-384, Description
During eradication, responders find a script on a public web server that gives the attacker a command line through the browser. What does ATT&CK call it?MITRE ATT&CK, T1505.003 Web Shell
In the OWASP Top 10 of 2021, under which category does cross-site scripting now fall?OWASP Top 10:2021, A03 Injection, Overview
Which category did the OWASP Top 10 of 2021 move up from fifth position to first?OWASP Top 10:2021, A01 Broken Access Control, Overview
Which cookie attribute stops page scripts from reading a session cookie through document.cookie?OWASP Session Management Cheat Sheet, HttpOnly Attribute
Which of these should an application not write directly into its logs, according to the OWASP logging cheat sheet?OWASP Logging Cheat Sheet, Data to exclude
Why does NIST SP 800-44 call restoring a compromised web server from backups the riskier of its two options?NIST SP 800-44 Version 2, section 9.3
Cloud security incidents 10
A responder preserves the disk of a suspect instance with an Amazon EBS snapshot. What kind of copy is a snapshot?Amazon EBS User Guide, Amazon EBS snapshots
An administrator starts revoking all access for a compromised Microsoft Entra user. What does Microsoft warn about the timing?Microsoft Learn, Revoke user access in Microsoft Entra ID
How long does Azure keep activity log events before deleting them, unless they are collected elsewhere?Microsoft Learn, Activity log in Azure Monitor, Retention period
Investigators find no record of who read the objects in a Google Cloud storage bucket. Which audit logs, off by default, would have recorded it?Google Cloud, Cloud Audit Logs overview, Types of audit logs
Temporary credentials of an IAM role have been stolen. What does revoking the role's sessions do?AWS IAM User Guide, Revoke IAM role temporary security credentials
What does NIST SP 800-144 call vital when responding to an incident in a cloud service?NIST SP 800-144, section 4.9
Which Google Cloud audit logs are always written and cannot be disabled?Google Cloud, Cloud Audit Logs overview, Types of audit logs
Which practice does the AWS Well-Architected security pillar list as an anti-pattern for incident response access?AWS Well-Architected Security Pillar, SEC10-BP05 Pre-provision access
Why can recognizing and analyzing an incident be harder in a public cloud, according to NIST SP 800-144?NIST SP 800-144, section 4.9
With no trail configured, how far back does the CloudTrail event history show management events in an AWS Region?AWS CloudTrail User Guide, CloudTrail concepts, CloudTrail event history
Insider threats 11
A clerk mistypes an address and emails a sensitive document to a competitor. Which type of insider threat is this?CISA, Defining Insider Threats, What are the Types of Insider Threats?
A contractor's access ended last month. Under CISA's definition, is that person still an insider?CISA, Defining Insider Threats, What is an Insider?
A departing engineer copies design files to a USB drive. Which ATT&CK technique describes the exfiltration?MITRE ATT&CK, T1052 Exfiltration Over Physical Medium
After an administrator is dismissed, responders audit for accounts he made for himself to get back in. Which ATT&CK technique are they looking for?MITRE ATT&CK, T1136 Create Account
An employee is recruited by a criminal group to help it commit fraud against the employer. What does CISA call this?CISA, Defining Insider Threats, What are the Types of Insider Threats?
An employee who knows the badge policy holds a secure door open for a stranger. Which type of insider threat is this?CISA, Defining Insider Threats, What are the Types of Insider Threats?
CISA describes the mitigation approach of a successful insider threat program in three parts. Which are they?CISA, Detecting and Identifying Insider Threats
How do organizations manage an insider threat, in CISA's words?CISA, Managing Insider Threats
Vendors who are not formal members of an organization have been given access to its systems to do their work. Which insider threat type covers them?CISA, Defining Insider Threats, What are the Types of Insider Threats?
What have researchers found about insiders who turn to malicious activity?CISA, Detecting and Identifying Insider Threats
What is a threat assessment for insiders?CISA, Assessing Insider Threats
Endpoint security incidents 11
A managed phone has been reported lost. Which action does NIST SP 800-124 describe for a device that may have fallen into untrusted hands?NIST SP 800-124 Rev. 2, section 4.2.1.3
A responder wants to reboot a controller on a production line to clear malware. What does NIST SP 800-82 say about such typical IT strategies?NIST SP 800-82 Rev. 3, section 2.4
A seized phone must be kept from receiving new data or a remote wipe. Which three options does NIST SP 800-101 give?NIST SP 800-101 Rev. 1, section 4.3
A workstation is found to be sending files to a public file-sharing site that staff use every day. Why does ATT&CK say such a channel gives an attacker cover?MITRE ATT&CK, T1567 Exfiltration Over Web Service
An examiner records what a phone shows on its screen while working through its menus. Which level of the mobile tool classification is this?NIST SP 800-101 Rev. 1, section 3.1
How does NIST SP 800-82 describe what operational technology does?NIST SP 800-82 Rev. 3, Executive Summary
In NIST SP 800-82, what does manual mode mean for an OT system?NIST SP 800-82 Rev. 3, section 2
NISTIR 8228 sets three risk mitigation goals for IoT devices. What does the first, protect device security, aim to prevent?NISTIR 8228, Executive Summary
What does NIST SP 800-124 mean by sideloading?NIST SP 800-124 Rev. 2, section 3.1.9
Which mobile acquisition method physically removes the memory from the device?NIST SP 800-101 Rev. 1, section 3.1
Why can incident handling take more manual work for IoT devices than for laptops and servers?NISTIR 8228, Executive Summary
How this list was compiled: Own questions, written to the nine domains and weights of EC-Council's ECIH Exam Blueprint v2 (https://cert.eccouncil.org/wp-content/uploads/2024/01/ECIH-Exam-Blueprint-v2.pdf, read 2026-10-12). Facts were read on 2026-10-12 in public texts: NIST SP 800-61 Rev. 3 and the archived Rev. 2, SP 800-44 Version 2, 800-82 Rev. 3, 800-83 Rev. 1, 800-86, 800-94, 800-101 Rev. 1, 800-124 Rev. 2, 800-144 and 800-153 and NISTIR 8228; CISA's incident response playbooks, #StopRansomware Guide, DDoS guide, phishing tip and insider threat pages; 45 CFR 164.404; IETF RFCs 2350, 2827, 3227, 4987, 5321, 6376, 7208 and 7489; MITRE ATT&CK and CWE pages; the OWASP Top 10 of 2021 and cheat sheets; and the documentation of Amazon Web Services, Microsoft Azure and Google Cloud. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from an EC-Council exam, course, sample question or assessment, or from another practice product.
How it works
An unofficial EC-Council Certified Incident Handler practice test: 100 questions of our own, spread over the nine domains of the ECIH exam blueprint. It is not affiliated with EC-Council and uses none of the exam's own questions.
Read the full guide
What the ECIH exam covers
EC-Council's ECIH Exam Blueprint v2, read on October 12, 2026, weights nine domains. Six carry 11% each: incident response and handling process, first response, malware incidents, application level incidents, insider threats and endpoint security incidents. Email security incidents and network level incidents carry 12% each, and cloud security incidents 10%. The bank follows those weights.
Where the answers come from
EC-Council's course text is not public, so each answer rests on a public guide the question links to: NIST's incident handling, forensics and malware guides, CISA's playbooks, IETF RFCs, OWASP and the cloud providers' documentation. Rev. 3 superseded NIST SP 800-61 Rev. 2 in April 2025; questions that cite Rev. 2 are labeled archived.
RFC 3227 collects evidence from most volatile to least: registers and cache first, archival media last.
NIST SP 800-83 finds infected hosts three ways: forensic, active and manual identification. It calls the manual way not feasible for most situations.
Google Cloud always writes its Admin Activity audit logs; Data Access logs are off by default, except for BigQuery.
Questions and answers
How many questions are on the ECIH exam?
100 multiple-choice questions in 3 hours, by EC-Council's ECIH page (exam prefix 212-89). Exam mode here asks all 100 of our questions against a 180-minute clock.
What is the passing score for the ECIH exam?
There is no single figure. EC-Council sets a cut score for each exam form, and its certification page says cut scores run from 60% to 85%. This page shows your percent in each domain and no pass or fail.
Is this an ECIH v3 practice test?
EC-Council's page calls the current program ECIH v3, with ten course modules. The exam blueprint, version 2, sorts them into nine domains, and this bank follows the blueprint.