GIAC Certified Incident Handler Certification (GCIH)

• Incident Handling and Computer Crime Investigation
• Computer and Network Hacker Exploits
• Hacker Tools (Nmap, Metasploit and Netcat)
  

• Incident handlers
• Incident handling team leads
• System administrators
• Security practitioners
• Security architects
• Any security personnel that are first responders

GCIH with CyberLive

• Discipline-specific certifications
• Practical testing that validates their knowledge and hands-on skills

• Actual programs
• Actual code
• Virtual machines

Candidates are asked practical questions that require performance of real-world-like tasks that mimic specialized job roles.

Find out more about CyberLive here.

NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.

GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.

• Attacking Passwords
  The candidate will demonstrate a detailed understanding of how to conduct password attacks.
• Detecting Evasive and Post-Exploitation Techniques
  The candidate will be able to identify and defend against an attacker already in an environment, discover methods used to establish persistence, hide their presence, and achieve actions on objectives.
• Detecting Exploitation and Covert Communications Tools
  The candidate will demonstrate an understanding of how to identify and defend against the use of exploitation tools such as Metasploit and covert communications tools such as netcat.
• Endpoint Attack and Pivoting
  The candidate will demonstrate an understanding of how to identify and defend against endpoint specific attacks and pivoting in an environment.
• Exploiting Insecure Web Application References
  The candidate will demonstrate an understanding of common methods for exploiting insecure web application references.
• Incident Response and Cyber Investigation
  The candidate will demonstrate an understanding of the PICERL and DAIR incident handling processes and incident response challenges.
• Integrating LLMs with Offensive Operations
  The candidate will demonstrate an understanding of LLM prompt processing, risks, common attack methods, and defend against AI specific attacks in modern environments.
• Malware and AI Assisted Investigations
  The candidate will demonstrate an understanding of the steps necessary to perform basic basic malware analysis and understand how AI can be used to augment investigative efforts.
• Network and Log Investigations
  The candidate will demonstrate an understanding of the steps necessary to perform effective investigations of network and log data.
• Scanning and Mapping
  The candidate will demonstrate an understanding of how to discover and map networks and hosts, reveal services and vulnerabilities, and identify and defend against scanning.
• Securing Credentials and Data in the Cloud
  The candidate will demonstrate an understanding of how to identify, defend against, and mitigate password attacks and insecure storage in cloud-based environments.
• SMB Security
  The candidate will demonstrate an understanding of SMB features, vulnerabilities, how to discover and access shares, and how to secure the service.
• Understanding Passwords
  The candidate will be able to identify password hashes, understand password weaknesses, and secure passwords.
• Web Application API Attacks
  The candidate will demonstrate the basics of interacting with and abusing access to web APIs.
• Web Application Injection Attacks
  The candidate will demonstrate an understanding of common web application injection attacks.

• Training is available in a variety of modalities including live training and OnDemand.
• Practical work experience can help ensure that you have mastered the skills necessary for certification
• College level courses or self paced study through another program or materials may meet the needs for mastery.
• Get information about the procedure to contest exam results.

Practice Tests

• These tests are a simulation of the real exam allowing you to become familiar with the test engine and style of questions.
• Practice exams are a gauge to determine if your preparation methods are sufficient.
• The practice bank questions are limited so you may encounter the same question on practice tests when multiple practice tests are purchased.
• Practice exams never include actual exam questions.
• Purchase a GCIH practice test here.
• GIAC recommends leveraging additional study methods for test preparation.