Certification guide
GCIHGIAC Certified Incident Handler (GCIH): the honest guide
Everything GIAC publishes about GCIH, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from GCIH’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
See everything published on GCIHWhat the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 106 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCIH certification details ↗
Domain breakdown
Endpoint Attack and Post-Exploitation Detection is the heaviest domain at 21 percent, followed by Passwords and Credential Security at 17 percent.
GIAC publishes the GCIH objectives as an unweighted list of 15 outcome statements and does not publish percentages for them. The seven groupings above, and the percentages attached to them, are ours. We built them by clustering GIAC's published objective titles into related areas so the material can be studied in blocks. They are a study aid only, not an official GIAC weighting, and they should not be read as a prediction of how many exam items fall in each area.
- Endpoint Attack and Post-Exploitation Detection21%
- Passwords and Credential Security17%
- Incident Response and Cyber Investigation16%
- Network, Log, and Malware Investigation15%
- Scanning, Mapping, and SMB Security13%
- Web Application Attacks12%
- Integrating LLMs with Offensive Operations6%
Where to focus: GIAC allows 4 hours for 106 questions, which averages a little over two minutes per item, so a fast index into your own notes matters more than rereading them. GIAC tags GCIH as a CyberLive certification and describes CyberLive as performance-based challenges in lab environments with real security tools, so practice running the tools rather than only reading about them.
What comes after passing
GCIH is valid for 4 years. GIAC's renewal pages describe two routes: collect 36 CPE credits over four years, or retake the exam. After logging and justifying CPEs in the GIAC portal account and paying the renewal fee, GIAC states the certification is active for four more years. GIAC lists the GCIH certification renewal fee at $499, and notes that additional renewals within 2 years of paying for a full price ($499) renewal are $249.
Costs across the full renewal cycle are on the GCIH cost page.
Frequently asked questions
What does the GCIH exam cost?
GIAC's pricing page lists the GCIH certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, a certification renewal at $499, and a practice exam at $399. GIAC also notes that a missed proctored exam appointment incurs a $175 reseating fee.
Is the GCIH exam hands-on?
GIAC tags GCIH as a CyberLive certification. GIAC describes CyberLive as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools, and authentic code. The exam format section lists 1 proctored exam, 106 questions, 4 hours, and a minimum passing score of 69%.
Are there prerequisites for GCIH?
GIAC's GCIH certification page does not list any prerequisite. Under How To Prepare it points to training in a variety of modalities including live training and OnDemand, practical work experience, and college level courses or self-paced study through other programs or materials.
How long is GCIH valid and how is it renewed?
GIAC's renewal pages state that you collect 36 credits over four years to keep your certification active, and that after renewing your certification is active for four more years. GIAC lists two renewal methods: collecting 36 CPEs, or retaking the exam. A renewal fee applies, listed at $499 for GCIH.
Keep reading
- GCIH exam overview
The format, the domain weights and the renewal terms, sourced line by line.
- GCIH passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCIH?
An honest difficulty read from the format, the clock and the weights.