GIAC GCIH — the complete study guide

GCIH is open book, and that is exactly why people fail it. How to build the index that passes the exam, plus every attack technique and incident handling phase it tests.

GCIH is the exam people underestimate, and I know exactly why.

The content matters. But the index is what turns knowing the content into passing, and that is what most of this guide is about.

Careful

If you take one thing from this guide, take this.

You have roughly two minutes per question. Flipping through a stack of course books hunting for a term costs you three. An index turns a three-minute hunt into a fifteen-second lookup, and it is the difference between finishing comfortably and running out of time.

Tip

GCIH is built around six phases. Know them cold, in order, and know what belongs in each — the exam repeatedly asks which phase an action belongs to.

Two details the exam loves:

Tip

The index phase is the heaviest part and the one people try to shorten. Do not shorten it — it is the phase that passes the exam.

Sitting this one soon? I would like to know how the index goes — it is the part everyone wants to negotiate their way out of.

Keep going!

Contents

Exam domains