FirstTry

Certification guide

GCIH

GIAC Certified Incident Handler (GCIH): the honest guide

GCIH is GIAC's incident handling exam. One proctored sitting, 106 questions, four hours, and a minimum passing score of 69 percent for exam versions released on or after 10 May 2025. Delivery is web based and proctored either remotely through ProctorU or on site at a Pearson VUE center, and an attempt has to be used within 120 days of the day GIAC activates it.

Two things make it unlike most security exams. It is open book for printed material, so the index you build while studying is a legitimate exam tool and no digital reference is allowed. And it is a CyberLive exam: some questions drop you into a live virtual machine with the real tools and score what you do there rather than what you can describe. GIAC does not publish how many of the 106 items are hands-on.

GCIH is a defender's exam built around attacker technique. Its objectives run from the incident response process through endpoint attack and post-exploitation detection, password and credential attacks, network, log and malware investigation, scanning, mapping and SMB security, and web application attacks, so you study how intrusions happen in order to detect and contain them. GIAC publishes those objectives with no weighting for any of them, and the groupings and percentages on our objectives page are ours, not GIAC's, and are labeled that way.

Who GCIH is for

A good fit if

  • You work a SOC, a CSIRT or a blue team and want a credential whose exam involves handling an incident rather than writing about one.
  • You are a systems or network administrator who ends up first on the scene when something is wrong, and you want to formalize the response process you already improvise.
  • You know attacks better than you know the six step incident handling process, and you want the exam that examines both sides together.
  • You are moving from general security work into incident response and want proof that reads across employers rather than a vendor tool certificate.
  • You are taking the affiliated SANS training and want the credential the course is built around.

Probably not, if

  • You have never worked an incident or driven the tools. The CyberLive items put you in front of a live environment with a clock running, and there is no partial credit for knowing what a tool does without having used it.
  • You want a first security certification. The attempt alone is $999 and the objectives assume you already understand networks, operating systems and common attacks.
  • Your work is pure penetration testing or pure forensics. GCIH sits between them, and GIAC certifies deep offensive testing and deep forensic analysis as separate credentials.
  • You need a credential this month to clear a hiring filter. A 120 day attempt window, a 30 day wait after any failure and an index that takes weeks to build are the wrong shape for that.

Is GCIH worth it?

For a working incident handler, the case rests on the exam format rather than on the acronym. A CyberLive certification says somebody watched you use the tools under time, which is a different claim from a multiple choice pass, and it is the reason the credential holds its value whether or not you sat the course.

It is worth less as a first credential or on a resume for a role that never responds to incidents. The attempt is $999, renewal is a four year cycle with 36 CPE credits and a fee, and none of that pays back unless the skills get used.

Self funding the attempt is a defensible decision for a responder who already has the experience. Self funding the training is a different question entirely, and the honest comparison there is against what the same money buys in lab hardware, cloud time, conferences and a year of deliberate practice.

What the exam actually asks you to do

A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 106 are hands-on, so neither do we.

Item formats

  • Multiple choice
  • Hands-on lab

The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCIH certification details ↗

Domain breakdown

Endpoint Attack and Post-Exploitation Detection is the heaviest domain at 21 percent, followed by Passwords and Credential Security at 17 percent.

GIAC publishes the GCIH objectives as an unweighted list of 15 outcome statements and does not publish percentages for them. The seven groupings above, and the percentages attached to them, are ours. We built them by clustering GIAC's published objective titles into related areas so the material can be studied in blocks. They are a study aid only, not an official GIAC weighting, and they should not be read as a prediction of how many exam items fall in each area.

  • Endpoint Attack and Post-Exploitation Detection21%
  • Passwords and Credential Security17%
  • Incident Response and Cyber Investigation16%
  • Network, Log, and Malware Investigation15%
  • Scanning, Mapping, and SMB Security13%
  • Web Application Attacks12%
  • Integrating LLMs with Offensive Operations6%

Where to focus: GIAC allows 4 hours for 106 questions, which averages a little over two minutes per item, so a fast index into your own notes matters more than rereading them. GIAC tags GCIH as a CyberLive certification and describes CyberLive as performance-based challenges in lab environments with real security tools, so practice running the tools rather than only reading about them.

GIAC: GIAC certification objectives ↗

Study plans by experience level

Working SOC analyst or incident responder

6 to 8 weeksat 6 to 8 hours

  1. 1Read GIAC's objectives and, for each one, write down the tool you would reach for and the command you would run. Anything you cannot answer from memory is the study list, and the list is usually shorter than it feels.
  2. 2Build the index from week one: one line per tool, artifact, log source and attack technique, with the page it lives on in your printed references. Print it in the final week and do not plan around searching a PDF you will not be allowed to open.
  3. 3Spend two weeks on endpoint attack and post-exploitation detection: what an attacker does after the first foothold, and the process, service, registry and log artifacts each step leaves behind.
  4. 4Spend two weeks on credential attacks and on network, log and malware investigation: how passwords and hashes are captured and abused, and how you read packet captures, logs and a suspicious binary to reconstruct what happened.
  5. 5Finish with a week rehearsing the mechanics under time. Detect, investigate and contain in your own lab with a clock, then sit a practice test with the printed index beside you and fix every gap the index failed to answer.

Administrator moving into incident response

12 to 16 weeksat 8 to 10 hours

  1. 1Learn the process before the tools. GCIH is built on a defined incident handling process, and a candidate who cannot describe preparation, identification, containment, eradication, recovery and lessons learned loses questions that require no technical depth at all.
  2. 2Build the lab: a Linux analysis box, two or three Windows machines joined to a domain you control, and a way to generate and capture traffic. Every objective on GIAC's list can be rehearsed against that, and none of them can be rehearsed against production.
  3. 3Work through the attack side in the order the objectives take it: scanning and mapping, SMB security, web application attacks, then endpoint attack and post-exploitation, so that you understand the technique before you try to detect it.
  4. 4Move to the investigation side and make yourself do it by hand at least once: read a packet capture in Wireshark, walk a Windows event log, and triage a suspicious process rather than trusting a single tool to label it.
  5. 5Spend a block on credentials: how NTLM hashes, network responses and Kerberos tickets differ, where each is stored, and which attack each one enables, because the exam asks what a thing is rather than which tool touches it.
  6. 6Give the last three weeks to the index, timed practice and the CyberLive mechanics, which administrators most often leave until they have run out of time.

Sitting the affiliated SANS training with the attempt bundled

8 to 10 weeks after the courseat 5 to 8 hours

  1. 1Book the exam date before the course ends. The attempt runs on a 120 day clock from activation, and the attempt that lapses is always the one with no date in the calendar.
  2. 2Index the course books in the first fortnight while the material is fresh, by topic, tool and command, with book and page numbers. GIAC's preparation page treats the index as an essential part of studying, and one built from memory in the last week is slower to use.
  3. 3Repeat every lab without the workbook and time yourself. The CyberLive questions are lab tasks with a clock, and the gap between following a walkthrough and working from a blank prompt is the whole difficulty.
  4. 4Use a practice test at the halfway point to find weak objectives rather than to predict a score, then use the last one as a timed dress rehearsal in the final week.
  5. 5Revisit the incident handling process and the lessons learned material last. It is the part that feels like reading rather than doing, and the exam asks about it in scenario form.

Common mistakes

Treating open book as a reason to study less
Four hours for 106 questions is a little over two minutes each, and the CyberLive items take longer than that, which means the rest have to take less. A candidate who has to look up how a tool works rather than where a fact is written runs out of clock. The book confirms what you know; it does not replace knowing it.
Bringing the wrong kind of reference
GIAC allows printed books, notes and study guides, and no digital items at all. A tablet of annotated PDFs stays outside the room. Build the index on paper and rehearse with it on paper, because a reference you have never used under time is not a reference.
Studying the attacks and skipping the process
GCIH pairs attacker technique with a structured incident handling process, and candidates who come from a technical background revise the exploits and lose marks on containment, eradication, chain of custody and lessons learned. The process questions are the ones you can prepare with no lab at all, so leaving them is giving away the easy marks.
Learning tools instead of artifacts
Detecting post-exploitation is about knowing what a normal process, service, scheduled task or log entry looks like so the abnormal one stands out. Knowing which tool lists processes is not the same as knowing which process should not be there. The exam asks the second question.
Letting the 120 day window run out
The attempt expires 120 days after activation. An extension costs money, a missed appointment costs a seating fee, and starting again costs the full attempt price. Put the exam date in the calendar on the day GIAC activates the attempt, not on the day you feel ready.
Expecting a practice test to teach you something
GIAC says its practice bank is limited, that the same question can appear on more than one practice test, and that practice exams never include actual exam questions. They are a rehearsal of pacing and of the engine. Buy one late rather than three early.

What comes after passing

Set the four year renewal date in a calendar on the day you pass. The routes are 36 CPE credits plus the renewal fee, or retaking the exam, and credits are far easier to log as you earn them than to find in the last six months of the cycle.

Write up an incident beside the credential. GCIH attests to the mechanics of detection and response; what it cannot show is the judgment calls, the communication under pressure and the after-action report somebody could act on, which is the half of the job that gets people trusted with the next one.

GIAC's own next steps from here are the intrusion analysis certification if your work is in network detection, the forensic analysis one if it moves toward deep investigation, and the reverse engineering malware one if the samples you meet need pulling apart.

Costs across the full renewal cycle are on the GCIH cost page.

Frequently asked questions

How much does the GCIH exam cost?

GIAC's pricing table lists the GCIH certification attempt at $999 and an exam retake at $899, with prices excluding applicable sales tax. The same row lists an attempt extension, a certification renewal and a practice exam separately, and GIAC charges a seating fee for a missed proctored appointment.

How many questions is the GCIH, and what score do I need?

GIAC publishes the GCIH format as 1 proctored exam, 106 questions, 4 hours, with a minimum passing score of 69 percent. GIAC adds that the 69 percent score was set by a psychometric standard setting study and applies to candidates who receive an exam version released on or after 10 May 2025, and it points you to your GIAC account to confirm the format and passing score for your own attempt.

Is the GCIH exam hands-on?

Yes. GIAC tags GCIH as a CyberLive certification, which it describes as a hands-on format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools and authentic code. GIAC does not publish how many of the 106 items are CyberLive.

What happens if I fail GCIH?

A 30 day wait applies before you can sit again, and a retake can be bought within 30 days of your exam deadline, which extends the deadline by 60 days including that wait. A waiver can shorten the 30 days but a 14 day minimum cannot be waived, and after three failed attempts GIAC requires a year before a new attempt unless it accepts a documented waiver.

Do I need SANS training or a prerequisite for GCIH?

No. GIAC publishes no prerequisite on the GCIH certification page, and under How To Prepare it lists training in a variety of modalities including live training and OnDemand, practical work experience, and college level courses or self-paced study through other programs or materials as the ways candidates prepare.

Keep reading

Every guide and cost breakdown, by vendor

Practice GCIH for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free GCIH questions