FirstTry
GCIHGIAC Certified Incident Handler (GCIH)

Practice Exam 1

5 of this form’s 106 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    Network, Log, and Malware Investigation

    During lateral movement inside a single enclave, a responder needs to predict which protocols an adversary is most likely to abuse for internal command and control between hosts. Which set fits?

  2. Question 2 of 5

    Incident Response and Cyber Investigation

    During a ransomware incident, handlers want to shut down a revenue-critical service to contain spread. Who holds the decision-making authority for that high-impact action?

  3. Question 3 of 5

    Scanning, Mapping, and SMB Security

    An analyst wants to learn which hosts on a subnet are alive without probing any ports on them. Which Nmap option performs host discovery only and prints the responsive hosts?

  4. Question 4 of 5

    Endpoint Attack and Post-Exploitation Detection

    A responder sees rundll32 load a crafted DLL that invokes an auto-elevated COM object to write into a protected directory on the host. What is the attacker doing?

  5. Question 5 of 5

    Passwords and Credential Security

    After an MFA fatigue incident a team wants a push method that stops blind one-tap approvals of prompts the user did not start. Which OWASP mitigation fits?

0 of 106 completed

0%

The other 101 questions are the rest of this form: same 240 minute clock, same 69 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on GCIH.

What this exam covers

  • Endpoint Attack and Post-Exploitation Detection22 questions / 21% of the exam
  • Passwords and Credential Security18 questions / 17% of the exam
  • Incident Response and Cyber Investigation17 questions / 16% of the exam
  • Network, Log, and Malware Investigation16 questions / 15% of the exam
  • Scanning, Mapping, and SMB Security14 questions / 13% of the exam
  • Web Application Attacks13 questions / 12% of the exam
  • Integrating LLMs with Offensive Operations6 questions / 6% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.