Use this quick start guide to collect all the information about GIAC GCIH Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the GIAC Incident Handler (GCIH) exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual GIAC Certified Incident Handler (GCIH) certification exam.
The GIAC GCIH certification is mainly targeted to those candidates who want to build their career in Cybersecurity and IT Essentials domain. The GIAC Certified Incident Handler (GCIH) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of GIAC GCIH.
GIAC GCIH Exam Summary:
| Exam Name | GIAC Certified Incident Handler (GCIH) |
| Exam Code | GCIH |
| Exam Price | $979 (USD) |
| Duration | 240 mins |
| Number of Questions | 106 |
| Passing Score | 70% |
| Books / Training | SEC504: Hacker Tools, Techniques, and Incident Handling |
| Schedule Exam | Pearson VUE |
| Sample Questions | GIAC GCIH Sample Questions |
| Practice Exam | GIAC GCIH Certification Practice Exam |
GIAC GCIH Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Detecting Covert Communications | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against the use of covert tools such as netcat. |
| Detecting Evasive Techniques | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against methods attackers use to remove evidence of compromise and hide their presence. |
| Detecting Exploitation Tools | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against the use of Metasploit. |
| Drive-By Attacks | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against drive-by attacks in modern environments. |
| Endpoint Attack and Pivoting | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against attacks against endpoints and attack pivoting. |
| Incident Response and Cyber Investigation | - The candidate will demonstrate an understanding of what Incident Handling is, why it is important, an understanding of the PICERL incident handling process, and industry best practices in Incident Response and Cyber Investigations. |
| Memory and Malware Investigation | - The candidate will demonstrate an understanding of the steps necessary to perform basic memory forensics, including collection and analysis of processes and network connections and basic malware analysis. |
| Network Investigations | - The candidate will demonstrate an understanding of the steps necessary to perform effective digital investigations of network data. |
| Networked Environment Attack | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against attacks in shared-use environments, including Windows Active Directory and cloud environments. |
| Password Attacks | - The candidate will demonstrate a detailed understanding of password cracking attacks, common password weaknesses, and password defenses. |
| Post-Exploitation Attacks | - The candidate will demonstrate an understanding of how attackers maintain persistence and collect data, and how to identify and defend against an attacker already in a traditional network or a cloud environment. |
| Reconnaissance and Open-Source Intelligence | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate public and open source reconnaissance techniques. |
| Scanning and Mapping | - The candidate will demonstrate an understanding the fundamentals of how to identify, defend against, and mitigate against scanning; to discover and map networks and hosts, and reveal services and vulnerabilities. |
| SMB Scanning | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate reconnaissance and scanning of SMB services. |
| Web App Attacks | - The candidate will demonstrate an understanding of how to identify, defend against, and mitigate against Web Application Attacks. |
To ensure success in GIAC GCIH certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for GIAC Incident Handler (GCIH) exam.