The eCIR - Certified Incident Responder exam voucher costs Rs 64,900/= at induwara.lk, payable in Sri Lankan rupees by card or bank transfer. It is an official single-use voucher for the INE exam, not a practice test or a training course. The voucher is valid for 12 months from purchase. After payment our team confirms your order and sends the voucher code by email.
What this voucher is
The INE voucher for eCIR - Certified Incident Responder, with no currency conversion to work out. It is the exam fee itself — a single-use code you redeem when you book your exam with the vendor's testing provider. It is not a training course, a practice test bundle or a study guide.
Each voucher is valid for 12 months from the date of purchase, so you can book the exam when you are ready rather than the day you buy.
Who sits this exam
eCIR - Certified Incident Responder is aimed at SOC analysts, network engineers and anyone moving into a security role. It is a professional-level exam and expects real working experience, not just study. Sri Lankan banks, ISPs and BPO firms hire against named security certifications, and the exam fee is usually the part that stalls people.
Why buy it here
Vendor exam fees are quoted in US dollars, which means the rupee price you actually pay depends on your card's rate on the day and whatever your bank adds on top. Here the price is fixed in rupees — Rs 64,900/= — so what you see is what leaves your account.
You can pay by card through PayHere, or by direct bank transfer if you would rather not put an exam fee on a card. Both are confirmed by us before anything is sent.
How delivery works
Delivery is handled by a person, not a script. Once your payment is confirmed, our team contacts you and sends the voucher code to the email address on your order. That usually happens the same day, and you will hear from us either way — if there is any delay sourcing a particular voucher, we tell you rather than leaving the order sitting.
If you need an invoice for an employer or a training budget, say so when you order and we will issue one against the order number.
Exam at a glance
Prerequisites
None enforced. INE describes the eCIR as 'a certification for cybersecurity professionals with intermediate experience in incident detection, analysis, and response', listing aspiring incident responders, SOC analysts (Tier 1 and Tier 2), IT security personnel, and red teamers and penetration testers as the audience. It recommends the updated Incident Handling & Response Professional Learning Path as preparation. Commercial requirement: 'To take the eCIR exam, you'll need both an INE subscription and an exam voucher.'
Sat through
INE Security — online. INE states the eCIR 'is a fully practical exam, which immerses candidates in a realistic lab environment simulating a corporate breach', managed from the Certifications Dashboard, with auto-graded results and section-by-section score reporting. No test centre.
Certification valid
3
Price here
Rs 64,900/=
Exam details are taken from the vendor’s own documentation. Anything we could not confirm there is left out rather than estimated.
What you get, and what happens next
What you get
One official single-use exam voucher for eCIR, eCIR - Certified Incident Responder, covering the exam fee in full. It is a code, not a study course and not a practice test. There is nothing physical to ship and no delivery charge.
When it arrives
Emailed to the address on your order once we have confirmed the payment, by a person rather than automatically. In practice that is usually the same day and almost always within one working day. If sourcing a particular voucher is going to take longer, we tell you rather than leaving the order sitting.
How long it stays valid
12 months from purchase. Book and sit the exam before it expires, a code that has simply run out of time cannot be replaced, so do not buy months ahead of when you plan to use it.
How you redeem it
Redeemed inside INE's own certification dashboard. There is no test centre and no separate booking to make. The code unlocks the attempt on your account.
If the code does not work
If the vendor rejects it when you try to redeem it, tell us straight away and we replace it or refund you in full. Contact us before the voucher’s own expiry date.
If you do not pass
A voucher covers one attempt. A retake needs a new voucher, and the vendor, not us, sets how long you must wait before sitting the exam again. Check the vendor’s retake policy before you book.
Changing your mind
Full refund for any reason as long as we have not yet sent the code, including if you realise you have ordered the wrong exam, which is easy to do when codes look alike. Once the code has been sent it cannot be refunded, because the code is the product and it is single-use. Refunds & delivery in full.
What the exam covers
Endpoint & Network Analysis (35%)
Threat Detection & SIEM Operations (20%)
Digital Forensics & Evidence-Based Analysis (20%)
Reporting & Communication (15%)
Threat Intelligence & Attribution (10%)
Constructing and executing custom SIEM queries to identify suspicious and malicious activity
Evaluating persistence mechanisms including service creation, registry modifications, scheduled tasks and startup artifacts
Differentiating privilege escalation techniques such as exploit use, token manipulation and UAC bypass
Deconstructing macro-enabled documents, static PE analysis and Windows Registry artifact examination
Where it leads
Incident responder and SOC analyst (INE names Tier 1 and Tier 2 explicitly), digital forensics and incident response practitioner, and security operations lead. In Sri Lanka it maps most directly onto bank, telco and financial-sector security operations teams, and onto offshore SOC work delivered from Colombo.
Sitting this exam in Sri Lanka
Incident response is the security function Sri Lankan banks, telcos and regulated financial institutions are under the most pressure to demonstrate, and the eCIR is one of the few practical credentials that tests investigation rather than tooling knowledge. Reporting and communication is a graded 15% of the exam, which reflects the reality of the local role, where the analyst usually writes the incident report that goes to management rather than handing it to a separate team. The exam is sat online from home or office with no test centre booking, and INE requires a subscription alongside the voucher. Anyone holding an eCIR voucher bought before 6 August 2025 should treat it as expired.
Where these details come from
Every fact on this page was read off the vendor’s own documentation. Vendors change exam content, pricing and retirement dates without notice, so check these before you book.
I bought an eCIR voucher before August 2025 — is it still valid?
Probably not. INE's notice on the certification page states that the previous version of the exam was retired and that existing vouchers could be used 'through early 2026'. That deadline has passed. INE does still link a voucher-exchange programme from the same panel, with no closing date published, so it is worth contacting INE before discarding a voucher.
What does the current eCIR exam actually ask you to do?
Investigate a simulated corporate breach. INE describes it as 'a fully practical exam, which immerses candidates in a realistic lab environment simulating a corporate breach', where examinees 'must investigate the incident and answer a series of scenario-based questions that mirror the type of findings and information typically included in a professional incident report'. It is not a multiple-choice paper on incident response theory.
Which domain carries the most weight?
Endpoint and network analysis, at 35% — more than a third of the exam. Threat detection and SIEM operations and digital forensics are 20% each, reporting and communication 15%, and threat intelligence and attribution 10%. If you are preparing, endpoint artefacts are where the marks are.
Is report writing actually graded?
Yes — reporting and communication is a weighted 15%. INE's objectives name composing 'a clear investigation report including a timeline, impact assessment, and response actions', documenting IOCs, tools and payloads for stakeholders, and translating forensic data into containment, eradication and recovery recommendations. Analysts who can find the intrusion but cannot write it up lose real marks.
Does INE publish the eCIR time limit or pass mark?
No. The certification page says to complete the exam 'within the allotted time' and gives no pass mark. We will not fill that in with a guess. INE does confirm the exam is auto-graded and that the score report shows performance in each of the five domains.
Do I need to be a certified analyst already to sit it?
No formal prerequisite. INE targets it at professionals with intermediate experience in incident detection, analysis and response — listing aspiring incident responders, Tier 1 and Tier 2 SOC analysts, IT security personnel and even red teamers — and recommends the Incident Handling & Response Professional Learning Path. Nothing blocks registration.
Do I need an INE subscription too?
Yes. INE states: 'To take the eCIR exam, you'll need both an INE subscription and an exam voucher.' A bundle pairing the voucher with three months of access is one of INE's routes. Budget for both.
What does the eCIR voucher cost in Sri Lanka?
Our eCIR voucher is Rs 64,900/= in rupees, issued against the current version of the exam.
Where to go next
The step before and the step after this one, plus a comparable exam from another vendor.
