The content of the exam for the EC-Council Certified Incident Handler certification revolves around nine domains. They all have different weights in the content. The specific knowledge and skills as well as percentage share of questions related to each subject area of EC-Council 212-89 are outlined below:

• Email Security Incidents (10%). Here the examinees need to show good comprehension of email security as well as familiarity with deceptive and suspicious email; email incident; phishing email.
• Incidents Occurred in a Cloud Environment (8%). The last topic focuses on Cloud computing threats; eradication; security in Cloud computing; recovery in Cloud.
• Process Handling (14%). Within this domain, the applicants need to demonstrate competency in security auditing; incident handling and response; incident readiness; forensic investigation; security incidents; eradication and recovery.
• Incident Response and Handling (16%). This topic requires a solid understanding of information security; threat intelligence; computer security; risk management; incident handling; security policies.
• Application Level Incidents (8%). The objective entails your knowledge of web application threats and vulnerabilities; web attacks; eradication of web applications.
• Insider Threats (7%). To deal with the questions from this domain, the learners should be conversant with insider threats; eradication; employee monitoring tools; detecting and preventing insider threats.
• Malware Incidents (8%). In the framework of this area, the students are required to be aware of malware, malware incident triage, as well as malicious code.
• Forensic Readiness and First Response (13%). This subject area encompasses an understanding of digital evidence; forensic readiness; computer forensics; volatile evidence; preservation of electronic evidence anti-forensics; static evidence.
• Network and Mobile Incidents (16%). This section comes with the individuals’ knowledge of inappropriate usage; network attacks; Denial-of-Service; unauthorized access; wireless network; eradication of mobile incidents and recovery; mobile platform vulnerabilities and risks.

Reference: https://www.eccouncil.org/programs/ec-council-certified-incident-handler-ecih/

Career Path

After accomplishing the ECIH certification, you can apply for the CHFI (Computer Hacking Forensic Investigator) and the CASE (Certified Application Security Engineer) to become a multi-domain specialist. In addition, there are many other specialized certifications that you can opt to master in IT security. Thus, if you plan to become a Licensed Security consultant, it's recommended to take the Licensed Penetration Test Master (LPT) qualification. In all, these certificates can attract potential employers and lead you to a successful path.

To get more details about it please visit:

ECCouncil 212-89 Exam Reference