Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by GIAC
Exam Format
240 min
106
69%
Practitioner
Registration
$999 USD
Pearson VUE, ProctorU, or online proctoring
Validity
4 years
GCIH Exam Topics and Domains
GCIH is organized into 12 weighted domains. Expect to work with PowerShell, WMI, Any.run, ATT&CK Navigator, and more.
1
Incident Response and Cyber Investigations
15%
Incident Response Process
PICERL ProcessDAIR Process
- Apply incident response methodologies to real-world scenarios
- Identify appropriate response phases for given incidents
- Document incident handling procedures
Live Examination Techniques
Windows Examination
- Perform live system examination on compromised hosts
- Identify indicators of compromise on running systems
2
Network and Log Investigations
12%
Network Investigation
Packet AnalysisNetwork Threat Hunting
- Analyze network traffic for security incidents
- Identify network-based indicators of compromise
- Perform network threat hunting
Log Analysis
Windows Event Logs
- Analyze log data for security incidents
- Correlate events across multiple log sources
3
Memory and Malware Investigation
10%
Memory Forensics
Basic Memory Analysis
- Perform basic memory forensics
- Identify malicious processes in memory
- Extract IOCs from memory dumps
Malware Analysis Basics
Behavioral Analysis
- Perform basic malware behavioral analysis
- Extract indicators of compromise from malware
4
Scanning and Mapping
8%
Network Scanning
Host DiscoveryCloud Scanning
- Understand attacker reconnaissance techniques
- Detect and respond to network scanning
- Enumerate services and vulnerabilities
MITRE ATT&CK Framework
Reconnaissance Tactics
- Apply MITRE ATT&CK framework to incident response
- Map attacker techniques to defensive controls
5
Password Attacks
10%
Password Compromises
Password AttacksMicrosoft 365 Attacks
- Understand password attack techniques
- Implement password defenses
- Detect password-based attacks
Authentication Bypass
Credential Theft
- Identify credential theft techniques
- Detect authentication bypass attempts
6
Web Application Attacks
12%
Injection Attacks
SQL InjectionCommand Injection
- Identify web application vulnerabilities
- Understand exploitation techniques
- Implement secure coding practices
Cross-Site Attacks
Cross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)
- Detect cross-site attacks
- Implement proper security controls
7
Exploit Frameworks
8%
Metasploit Framework
Exploitation TechniquesAuxiliary Modules
- Understand exploitation frameworks
- Detect exploit framework usage
- Implement defensive measures
8
Post-Exploitation Attacks
10%
Persistence Mechanisms
Windows PersistenceLinux Persistence
- Identify persistence mechanisms
- Detect post-exploitation activities
- Remove attacker persistence
Lateral Movement
Network PivotingData Collection
- Detect lateral movement techniques
- Identify data exfiltration attempts
- Implement containment strategies
9
Evasion Techniques
7%
Endpoint Security Bypass
AV/EDR EvasionDefense Evasion
- Identify evasion techniques
- Detect defense bypasses
- Implement layered security
10
SMB Security
5%
SMB Protocol Security
SMB VulnerabilitiesSMB Enumeration
- Secure SMB implementations
- Detect SMB-based attacks
- Implement SMB hardening
11
Drive-By Attacks
5%
Browser Exploitation
Drive-By Downloads
- Identify drive-by attack indicators
- Implement browser security controls
- Detect exploit kit usage
12
Cloud Security
6%
Cloud Environment Attacks
Cloud-Specific Threats
- Identify cloud-specific attack vectors
- Detect shadow IT usage
- Secure cloud deployments
How do I earn this certification?
Passing GCIH earns the GIAC Certified Incident Handler certification. It sits in the Digital Forensics and Incident Response track.
Current Level Exams
- GCFA - Certified Forensic Analyst
- GNFA - Network Forensic Analyst
- GCFE - Certified Forensic Examiner
- GCTI - Cyber Threat Intelligence
Next Level Options
- GX-IH - GIAC Experienced Incident Handler Advanced incident response skills
- GEIR - Enterprise Incident Response Enterprise-level incident management
- GSP - GIAC Security Professional Earn 3 Practitioner + 2 Applied Knowledge certs
- GSE - GIAC Security Expert Ultimate achievement - 6 Practitioner + 4 Applied Knowledge
Alternative Paths
- GPEN - Penetration TesterOffensive skills complement incident response
- GREM - Reverse Engineering MalwareDeep malware analysis capabilities
- GCFR - Cloud Forensics Responder Cloud-specific incident response
- GMON - Continuous MonitoringSOC and monitoring skills
- GCIA - Certified Intrusion AnalystNetwork traffic analysis expertise
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the official PlanetCert Practice Test alongside the study plan below to prepare efficiently for GCIH.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2024-2025
Updates
- Extended Detection and Response (XDR) May appear in future exam updates
- Zero Trust Architecture Influences containment and eradication strategies
- SOAR Platforms Understanding automation in IR processes
Who should take this exam?
This exam is typically taken by Incident handlers and Incident handling team leads.
- Basic understanding of networking and cybersecurity concepts
- Familiarity with Windows and Linux systems
- Understanding of TCP/IP protocols
- Basic command-line proficiency