Free practice test
GCIHFree GIAC Certified Incident Handler (GCIH) practice test
10 original GCIH questions, playable right now. No account, no card, no email gate. Every answer opens the full explanation: the concept, why the right option is right, and why each wrong option is wrong, cited to the authoritative documentation behind it.
Sample question 1 of 10
An engineer hardening endpoints learns some programs quietly gain admin rights without a prompt when UAC is not at its strictest setting. Which change reduces this risk?
Sample question 2 of 10
After an MFA fatigue incident a team wants a push method that stops blind one-tap approvals of prompts the user did not start. Which OWASP mitigation fits?
Sample question 3 of 10
A company outsources its SOC to a managed provider and assumes the provider now carries every incident response duty. What must define the actual split of responsibilities?
Sample question 4 of 10
A responder confirms that a beaconing implant using HTTPS for command and control is also sending stolen files back through that same HTTPS session. Which exfiltration technique does this describe?
Sample question 5 of 10
An analyst finds a service reporting an old version and wants to flag it as vulnerable. Why does Nmap caution against trusting the version number alone?
Sample question 6 of 10
An engineer hardening a Windows IIS server against directory traversal reviews where to place the web root. What does the cheat sheet advise to limit traversal impact?
Sample question 7 of 10
A developer has added system-prompt safeguards and input handling, yet jailbreaks still succeed against the model. Which additional measure best reduces the risk?
Sample question 8 of 10
An analyst hunts only for schtasks.exe in command logs and still misses a scheduled task the attacker created. Which method most likely evaded that search?
Sample question 9 of 10
An engineer explains why attackers succeed at credential stuffing even when users pick strong passwords. Which user habit does OWASP identify as the enabling weakness?
Sample question 10 of 10
A team wants documented, ready-to-follow procedures giving responders concrete steps for common scenarios like ransomware or phishing. What are they creating?
Full GCIH question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
What this test covers
These 10 questions are drawn across the published exam blueprint rather than from one chapter: this set touches Endpoint Attack and Post-Exploitation Detection, Passwords and Credential Security, Incident Response and Cyber Investigation, Network, Log, and Malware Investigation, Scanning, Mapping, and SMB Security, Web Application Attacks, Integrating LLMs with Offensive Operations. Every question is original, written from the official objectives, and verified against a cited vendor page before it serves. None are recalled exam content, which is why the explanations can cite their sources.
A 10-question sample tells you where you stand, not whether you are ready. The full experience is numbered practice exams: 106 questions apportioned to the official domain weightings, sat under the real 240-minute clock and scored against the published cut score.
Other free GIAC practice tests
Keep reading
- GCIH practice questions
Free sample questions with the full explanation on every answer.
- GCIH exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GCIH passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCIH?
An honest difficulty read from the format, the clock and the weights.
- What GCIH costs
The voucher price, the retake, and what renewal costs across the cycle.
- GCIH guide
Who it is for, study plans by experience level, and whether it is worth it.