GIAC Certified Incident Handler (GCIH) exam guide

Exam GCIH

GIAC Certified Incident Handler (GCIH) proves you can detect, respond to and resolve incidents, and understand the attacker techniques behind them. Tied to SANS SEC504, it is one of the most requested GIAC certifications for SOC and incident response roles.

Questions106

Time limit240 minutes

Passing score69% (exam versions from 10 May 2025)

Exam feeSee official page

Valid for4 years

DeliveryRemote proctored (ProctorU) or Pearson VUE test center

Format: Proctored exam with multiple choice and CyberLive hands-on lab questions; open book. Fee note: GIAC shows the price at checkout; attempts bundled with SANS training cost less than standalone attempts. Includes practice tests.

Who it's for

SOC analysts, incident responders and system administrators who handle security incidents.

What the exam covers

Incident response process and cyber investigation—

Detecting and investigating attacks—

Reconnaissance and scanning—

Password and access attacks—

Web application attacks—

Evasion and post-exploitation—

Drive-by and endpoint attacks—

Network and memory investigation—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Hands-on IT or security operations experience; SANS SEC504 is the aligned course.

Keeping it active

Valid four years: earn 36 CPEs in the cycle and pay GIAC's certification maintenance fee, or renew by retaking the current exam.

Skills & careers

Skills it validates

Running the incident handling process
Detecting attacker reconnaissance and exploitation
Analysing logs, network traffic and memory
Understanding password, web and lateral movement attacks
Containment and eradication
Using common attacker tools defensively

Job roles

Incident ResponderSOC AnalystSecurity AnalystThreat HunterSecurity EngineerCyber Defense Analyst

DoD 8140

Listed in the DoD 8140 qualification matrix for cyber defense and incident response work roles; historically approved for 8570 CSSP Incident Responder and Analyst. Confirm on the DoD CWQ site. Open the DoD Workforce Navigator

Where it fits in your path

Take before

CompTIA Security+GIAC Security Essentials (GSEC)

Go next

GIAC Certified Intrusion Analyst (GCIA)GIAC Certified Forensic Analyst (GCFA)GIAC Penetration Tester (GPEN)CompTIA CySA+

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

Week 1-3: Work through SEC504 books (or equivalent) one per week, highlighting key commands.
Week 4: Build a detailed index of terms, tools and page numbers.
Week 5: Repeat all labs, especially those using Linux and Windows command-line investigation.
Week 6: Take both GIAC practice tests under exam conditions and fix gaps in your index, then book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam date Hours per week

Exam-day tips

GIAC exams are open book (printed notes only); build a tabbed index of your course books before the exam.
CyberLive questions run in a VM; practise the labs until commands are second nature.
106 questions in 4 hours is about 2 minutes each; do not over-rely on the index.
Use the first practice test early to find weak areas and the second as a final check.

Frequently asked questions

How much does GCIH cost?

GIAC shows the price at checkout; it is cheaper when bundled with SANS SEC504.

Is GCIH open book?

Yes, printed materials are allowed.

How do I renew GCIH?

Every four years with 36 CPEs and the maintenance fee.

GCIH vs CySA+?

GCIH is deeper and more hands-on but far more expensive; CySA+ is a budget alternative.

Is GCIH worth it?

It is one of the most requested GIAC certs for incident response roles, especially in government.

Official page: www.giac.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.

1. Map it thinQguide™ · 409 cert guides 2. Learn it thinQterms™ · 7,491 terms 3. Untangle it 180 look-alike comparisons 4. Prove it thinQready™ · free readiness check

Find your exam