eLearnSecurity Certified Threat Hunting Professional (eCTHP) Certification Practice Exam

What Is the eCTHP Certification?

eCTHP, the Certified Threat Hunting Professional from INE Security, proves you can find attackers who are already inside a network and haven’t set off an alarm. During the exam you run a real threat hunt on a corporate network in INE’s virtual labs, then propose defensive strategies based on what you found.

It’s not a multiple-choice test. You connect over VPN and hunt.

eCTHP Exam at a Glance

What Does eCTHP Cover?

Endpoint and network hunting together make up more than half the exam, and endpoint alone can be up to 40%. That’s where your lab hours should go.

Who Should Take eCTHP?

SOC analysts ready to move from reactive to proactive work, threat hunters who want a recognised practical credential, and IR staff who want to catch intrusions earlier.

How to Prepare for eCTHP

1. Start with a hypothesis. Practise turning threat intel (a TTP, a campaign report) into something you can search for.
2. Hunt endpoints properly. Process trees, parent-child anomalies, persistence, PowerShell and WMI abuse, Sysmon events.
3. Hunt the network. Beaconing, odd DNS, unusual ports and protocols, lateral movement.
4. Map to MITRE ATT&CK. It gives your hunt structure and helps when proposing defences.
5. Write recommendations. The exam expects you to suggest defensive strategies, not just list findings.

A 4-Week eCTHP Study Plan

Week 1: Methodology and intel. Learn the hunting loop (hypothesis, investigate, uncover, inform) and practise turning threat reports into hunt queries.

Week 2: Endpoint hunting. Sysmon, process trees, persistence locations, credential access and living-off-the-land binaries.

Week 3: Network hunting. Beaconing detection, DNS anomalies, protocol misuse and lateral movement indicators.

Week 4: Full hunts. Run two or three complete hunts in a lab, document findings and write defensive recommendations for each.

Is eCTHP Worth It?

Threat hunting is one of the most requested blue team skills, and few certifications test it practically. eCTHP shows you can hunt in a real environment rather than just describe the process, which is exactly what SOC managers want to see when promoting analysts into hunting roles.

Common eCTHP Mistakes

• Hunting without a hypothesis and drowning in data
• Focusing only on network logs when endpoints carry more of the score
• Finding malicious activity but not explaining how to detect or stop it next time

Voucher Timing and Retakes

INE’s current voucher terms give you 180 days from the date the voucher lands in your account to sit the exam. If you fail the first attempt, the free retake must be used within 14 days of that attempt, so leave yourself buffer inside the 180 days. INE has also run a voucher exchange programme for eCTHP, letting holders of older unused vouchers swap them for the latest version free of charge. If you bought a voucher a while ago, check whether it still matches the current exam before you start.

Where eCTHP Fits

eCTHP rewards analysts who can form a hypothesis, query logs and network data to test it, and tell real attacker behaviour from noise. It pairs naturally with eCIR. Hunting finds intrusions earlier, and incident response contains them. Practise in a lab SIEM with real attack telemetry, not just reading about ATT&CK techniques.

Related Practice Exams

• eLearnSecurity Certified Incident Response Professional (eCIR)
• CREST Certified Threat Intelligence Manager (CCTIM)

What’s in the CertsArea eCTHP Practice Pack?

• 300 practice questions with explanations covering every domain
• PDF plus practice test software for Windows, Mac and mobile
• Free updates for 180 days and instant download

Use it to test your theory and methodology alongside lab work. If you’re also aiming at incident response, see our eCIR practice exam.

Frequently Asked Questions About eCTHP

Is eCTHP hands-on?

Yes. You perform a threat hunt on a lab network and propose defensive strategies.

Which domain matters most?

Endpoint Threat Hunting, at 30–40% of the exam.

How long is eCTHP valid?

Three years.

Can I retake eCTHP?

One free retake is included, to be completed within 14 days of the first attempt.

Is eCTHP good for beginners?

It’s best after some SOC or blue team experience. Total beginners usually find it tough.

What tools should I know?

A SIEM such as Elastic or Splunk, Sysmon and Windows event logs, and basic packet analysis tools.