GCIHGIAC Certified Incident Handler (GCIH) practice exams
Original questions written from the published objectives and cited to official documentation, never recalled exam content. How we verify, why not dumps.
- Exam code
- GCIH
- Cost
- $999USD
- Questions
- 106questions
- Duration
- 240minutes
- Passing score
- 69percent
- Level
- Mid level
- Valid for
- 4years
- Study guide
- How to prepare
- Sources
- 90official pages
- Format
- 1proctored exam
GCIH practice exams
2 full-length forms, 106 questions each, apportioned to the published domain weightings.
A technician documents how Nmap's UDP scan probes a host. Which action does the scan take against each targeted UDP port?
The answer
By sending a UDP packet to each target port
Checked against
nmap.org, checked September 2026UDP scan works by sending a UDP packet to every targeted port.
What the exam tests
Exam domains
GIAC publishes the GCIH objectives as an unweighted list of 15 outcome statements and does not publish percentages for them. The seven groupings above, and the percentages attached to them, are ours. We built them by clustering GIAC's published objective titles into related areas so the material can be studied in blocks. They are a study aid only, not an official GIAC weighting, and they should not be read as a prediction of how many exam items fall in each area.
The percentage is the exam weighting; the bar is how many verified questions we hold there, so a short bar is where our bank is thin.
- Endpoint Attack and Post-Exploitation Detection21%45 verified
- Passwords and Credential Security17%37 verified
- Incident Response and Cyber Investigation16%35 verified
- Network, Log, and Malware Investigation15%33 verified
- Scanning, Mapping, and SMB Security13%29 verified
- Web Application Attacks12%27 verified
- Integrating LLMs with Offensive Operations6%13 verified
Where to focus: GIAC allows 4 hours for 106 questions, which averages a little over two minutes per item, so a fast index into your own notes matters more than rereading them. GIAC tags GCIH as a CyberLive certification and describes CyberLive as performance-based challenges in lab environments with real security tools, so practice running the tools rather than only reading about them.
What the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 106 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCIH certification details ↗
Between sittings
The same bank the numbered forms are assembled from.
Quick Practice
Open now
All 219 verified questions, untimed, with the explanation after each answer.
Domain Drill
Open now
Every domain on its own, for the area a score report says is weakest.
Review Missed
Fills as you go
Re-asks the questions you got wrong. Nothing to review until you miss something.
GIAC’s free resources
Study from the source. The page below is free to read, and it is what our own questions are written from.
Official GCIH exam page & objectives ↗Keep reading
- Free GCIH practice test
10 original questions, playable now. No account, no card.
- GCIH exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GCIH passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCIH?
An honest difficulty read from the format, the clock and the weights.
- What GCIH costs
The voucher price, the retake, and what renewal costs across the cycle.
- GCIH guide
Who it is for, study plans by experience level, and whether it is worth it.
Frequently asked questions
What does the GCIH exam cost?
GIAC's pricing page lists the GCIH certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, a certification renewal at $499, and a practice exam at $399. GIAC also notes that a missed proctored exam appointment incurs a $175 reseating fee.
Is the GCIH exam hands-on?
GIAC tags GCIH as a CyberLive certification. GIAC describes CyberLive as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools, and authentic code. The exam format section lists 1 proctored exam, 106 questions, 4 hours, and a minimum passing score of 69%.
Are there prerequisites for GCIH?
GIAC's GCIH certification page does not list any prerequisite. Under How To Prepare it points to training in a variety of modalities including live training and OnDemand, practical work experience, and college level courses or self-paced study through other programs or materials.
How long is GCIH valid and how is it renewed?
GIAC's renewal pages state that you collect 36 credits over four years to keep your certification active, and that after renewing your certification is active for four more years. GIAC lists two renewal methods: collecting 36 CPEs, or retaking the exam. A renewal fee applies, listed at $499 for GCIH.