- The Reality of C)IHE Exam Dates
- How C)IHE Testing Works
- Exam Format at a Glance
- Planning Your Scheduling Steps
- What to Verify Before You Book
- Fees and Bundles That Affect Your Timeline
- Mapping the 12 Preparation Areas to a Calendar
- The Outline Version Question
- After You Pass: Validity and Renewal Dates
- Frequently Asked Questions
- The C)IHE (Certified Incident Handling Engineer) from Mile2 is tested online through the Mile2 Learning Management System.
- No fixed public testing-window calendar was verified, so confirm availability in your Mile2 account before building a plan.
- The exam is 100 multiple-choice questions, approximately 2 hours, with a 70% minimum to pass.
- Certification validity runs three years, with 60 qualifying CEUs required under the dedicated renewal policy.
The Reality of C)IHE Exam Dates
Candidates searching for "C)IHE exam dates 2026" usually expect a calendar of fixed sitting dates, the way some certifications publish quarterly windows or seasonal testing periods. For the Certified Incident Handling Engineer from Mile2, the reviewed official material does not publish such a calendar. What it does establish is the delivery model: testing is online through the Mile2 Learning Management System.
That distinction matters for planning. Because the reviewed public sources do not list fixed regional sitting dates, this article does not invent any. Instead, it explains what is known about how the exam is administered, what you should confirm directly with Mile2 before committing to a date, and how to build a preparation calendar that works backward from whatever scheduling flexibility your account shows.
If you are still orienting yourself to the credential itself, the pages on what C)IHE certification is and C)IHE requirements and eligibility cover the basics before you get into scheduling.
How C)IHE Testing Works
Online delivery through the Mile2 LMS
The documented delivery channel is the Mile2 Learning Management System. In practice, this means your exam experience is tied to your Mile2 account rather than to a third-party test center booking flow. Whether you can start the exam at any hour or must book a slot, and what remote-proctoring conditions apply, were not verified in the reviewed material. Treat those as open questions to resolve inside your account or with Mile2 support.
You do not have to buy the course to buy the exam
One scheduling-relevant fact is that course purchase is not required to purchase the exam. That means a candidate who already has hands-on incident response experience can, in principle, skip the instructor-led route and move straight toward testing. The course itself is described as a five-day class with 40 CEUs, but those are course values. They are not exam duration and they are not scoring weights, so do not confuse the five-day class length with how long your test takes.
Suggested background
Mile2 suggests roughly 12 months of network-technology experience, working knowledge of networking and TCP/IP, and essential Linux knowledge. No mandatory degree or reference count was verified. These are suggestions rather than gates, but they should influence how early you book: if your TCP/IP fundamentals are rusty, you want runway before the exam date, not after.
Exam Format at a Glance
| Element | What Is Documented |
|---|---|
| Issuer | Mile2 |
| Credential | Certified Incident Handling Engineer (C)IHE) |
| Delivery | Online through the Mile2 Learning Management System |
| Questions | 100 multiple-choice |
| Duration | Approximately 2 hours |
| Passing score | Minimum 70% |
| Scored vs. unscored split | Not stated |
| Open-book / calculator policy | Not verified |
| Remote proctoring rules | Not verified |
| Adaptive testing | Not verified |
| Public pass rate | Not disclosed in reviewed official material |
Two hours for 100 questions works out to a pace of roughly 72 seconds per question on average, which is comfortable for knowledge-recall items but tighter for scenario-style questions that make you reason through an incident timeline. For a closer look at the passing threshold, see C)IHE passing score: exactly what you need to pass. For the difficulty question, how hard is the C)IHE exam goes deeper, and the candidate pass rate is not publicly disclosed in the reviewed official material, which is addressed in C)IHE pass rate: what the data shows.
Key Takeaway
Build your schedule around the confirmed facts: 100 questions, about two hours, 70% to pass, online through the Mile2 LMS. Everything else about timing, such as retake gaps and window availability, should be confirmed inside your Mile2 account before you pay.
Planning Your Scheduling Steps
Because a published window calendar was not verified, the most reliable approach is a sequence of verification steps rather than a date-hunting exercise.
- Create or access your Mile2 account. Since delivery runs through the Mile2 LMS, your account is where scheduling options will actually appear.
- Decide whether you need the course. The exam can be purchased without the course. If you already work incident response, that may shorten your timeline considerably.
- Check what the exam purchase includes. The indexed Exam Combo bundles the exam, simulator, and guide. Confirm whether you want the bundle or a different configuration.
- Confirm any availability windows or access periods. Ask Mile2 or check your account for how long an exam voucher or access period lasts once purchased.
- Confirm retake and proctoring rules. These were not verified in the reviewed material, so do not assume them.
- Book only after your practice results are stable. A buffer between your last practice session and test day protects you from rushing.
For a structured preparation approach to pair with this sequence, the C)IHE study guide for passing on your first attempt is a good companion.
What to Verify Before You Book
The reviewed official material leaves several practical rules unconfirmed. Rather than discovering them on test day, resolve them in advance.
Questions to Resolve With Mile2
None of the following were verified in the reviewed public sources, so confirm each one directly:
- Whether there are fixed testing windows or whether scheduling is on demand through the LMS
- How long exam access remains valid after purchase
- Remote-proctoring requirements, including identification, room, and equipment rules
- Whether the exam is open-book, and whether a calculator is permitted
- Whether the test is adaptive or fixed-form
- How many of the 100 questions are scored versus unscored
- Retake policy and any waiting period between attempts
Do not treat the absence of a stated rule as permission. Silence in the reviewed material means unverified, not unrestricted.
Fees and Bundles That Affect Your Timeline
Timing and cost interact, especially if a promotional price is involved. The official indexed Exam Combo price was listed at USD $500 on sale against a $795 original price, and it includes the exam, the simulator, and the guide. However, the bare-exam fee, any member versus nonmember distinction, checkout taxes, and how long the sale lasts were not verified.
If you are weighing whether the spend is justified, is the C)IHE certification worth it and the C)IHE salary guide take up the return-on-investment question without leaning on invented figures.
Mapping the 12 Preparation Areas to a Calendar
The preparation scope comes from the twelve substantive modules of the currently linked Mile2 course outline, excluding the Module 00 introduction. These are unweighted preparation headings, not an official weighted blueprint, so no domain can be declared the largest by percentage. The allocation below is editorial: it sequences topics by dependency rather than by exam weight.
For the full breakdown of each area, see C)IHE exam domains: complete guide to all 12 content areas.
Foundations and Program Design
- Incident Handling Explained: what an incident is, incident handling versus incident response, the response process, and why a plan matters
- Incident Response Policy, Plan and Procedure Creation: the policy, plan, and procedure hierarchy and sharing information with outside parties
- Incident Response Team Structure: team models, model selection, personnel, and organizational dependencies
Services, Recommendations and Preparation
- Incident Response Team Services: intrusion detection, advisory distribution, education and awareness, information sharing
- Incident Response Recommendations: establishing a formal capability, information sharing, building a team
- Preparation: threat hunting, threat analysis frameworks, tools and toolkits, policy, procedures, preventing incidents
The Operational Core
- Detection and Analysis: attack vectors, signs of an incident, precursors and indicators, analysis, documentation, prioritization, notification
- Containment, Eradication and Recovery: choosing a containment strategy, evidence handling, identifying attacking hosts, eradication and recovery
Closing the Loop and Coordination
- Post Incident Activity: lessons learned, using collected incident data, evidence retention
- Incident Handling Checklist: building checklists
- Incident Handling Recommendations: recommendations and implementing threat intel
- Coordination and Information Sharing: coordination, purple teaming, information sharing techniques, granular sharing, sharing recommendations
The rationale for this ordering is dependency, not weight. Detection and containment questions are easier to reason about once you understand how teams are structured and how policy drives procedure, so the program-design topics come first. Post-incident, checklist, and coordination topics come last because they build on the lifecycle you will have already walked through. Eight weeks is a planning illustration, not a requirement; compress or expand it based on your experience, and use the C)IHE cheat sheet as a final-week review aid.
Topics worth extra attention
Several recurring themes cut across modules and are worth tracking as you study: the distinction between incident handling and incident response, the relationship between policy, plan, and procedure, the choice among team models, the role of precursors versus indicators, the evidence-handling discipline required during containment, and the way lessons learned feed back into preparation. Because the exam style is multiple-choice, expect questions that test whether you can pick the most appropriate action or definition in context.
The Outline Version Question
One timing risk deserves its own section. The currently linked outline carries the version string vs.922021 and describes the older four-phase NIST 800-61 incident response model. NIST published Revision 3 on April 3, 2025, but whether Mile2 has adopted that revision was not verified. The four-phase model in the course content is historical course content; it is not proof that Mile2 has aligned the exam to the newer revision.
The outline also mentions Cyber Range exercises. Those support training and should not be read as evidence of a practical, hands-on component on the certification exam. The documented exam is the 100-question multiple-choice test.
After You Pass: Validity and Renewal Dates
Your exam date also starts a clock. Under the dedicated renewal policy, certification is valid for three years, and renewal requires 60 qualifying CEUs, agreement to the applicable policies and ethics, and payment of the applicable renewal fee. The amount of that fee was not verified.
A note on conflicting wording: some older recertification language in attached Mile2 course PDFs mentions retaking the current exam and earning 20 CEUs per year. For current administration, rely on the dedicated renewal policy instead, which sets the three-year expiry and 60 CEU requirement. Do not combine the two and assume you owe both a retake and annual CEUs. Also keep in mind that CEUs are a renewal concept, not exam scoring weights, and the 40 CEUs attached to the five-day course are a separate course value.
Looking ahead, C)IHE jobs outlines the roles where an incident-handling credential tends to be relevant, and C)IHE training covers course options if you decide the class route fits your timeline. If you want to measure readiness before booking, the C)IHE practice tests on our main site are a practical way to check where you stand against the multiple-choice format.
Frequently Asked Questions
The reviewed official Mile2 material does not publish a fixed calendar of sitting dates, so none are listed here. The documented delivery method is online through the Mile2 Learning Management System. Confirm scheduling options in your Mile2 account.
The exam is approximately two hours and consists of 100 multiple-choice questions. The minimum passing score is 70%. The split between scored and unscored questions is not stated in the reviewed material.
No. Course purchase is not required to buy the exam. Mile2 suggests about 12 months of network-technology experience plus networking, TCP/IP, and essential Linux knowledge, but no mandatory degree or reference count was verified.
Open-book rules, calculator rules, remote-proctoring requirements, and whether the exam is adaptive were not verified in the reviewed official material. Confirm each of these with Mile2 before you book so there are no surprises.
Under the dedicated renewal policy, certification is valid for three years. Renewal calls for 60 qualifying CEUs, agreement to policies and ethics, and payment of the applicable renewal fee, whose amount was not verified.