GIAC GCIH — the complete study guide

The GCIH is the exam people most often underestimate, for one specific reason: it is open book, and candidates take that to mean it is easy. It is not. It means the exam is a test of retrieval speed under time pressure, and the single highest-return thing you can do is build a good index.

Everything below assumes that. The content matters — but the index is what turns knowing the content into passing.

The exam at a glance#

The "open book" rule is narrower than people expect: printed, physical materials. No laptops, no PDFs, no phones. Whatever you want during the exam, you must have printed and bound in advance.

The index is the exam#

If you take one thing from this guide, take this.

You have roughly two minutes per question. Flipping through a stack of course books hunting for a term costs you three. An index turns a three-minute hunt into a fifteen-second lookup, and it is the difference between finishing comfortably and running out of time.

How to build one that works#

1. Work through the material once, normally. No index yet. Just understand it.
2. On the second pass, build a spreadsheet with these columns: Term | Book | Page | One-line definition | Notes.
3. Add an entry for every term, tool, command, protocol, port, acronym and technique. Aim for something in the region of 1,500–2,500 rows. Yes, really.
4. Write the one-line definition yourself. This matters more than the page number: for a good proportion of questions the definition alone answers it and you never open a book.
5. Sort alphabetically. Print it. Bind it. Tabs on each book by section.
6. Practise with it. Sit a practice test using only your index. You will immediately find the gaps — fix them and reprint.

The incident handling process#

GCIH is built around six phases. Know them cold, in order, and know what belongs in each — the exam repeatedly asks which phase an action belongs to.

1. Preparation      Policies, jump kit, communications plan, training,
                    baselines, warning banners, contact lists.
 
2. Identification   Detection and validation. Is this actually an incident?
                    Scope it. Assign a handler. Start the chain of custody.
 
3. Containment      Stop the bleeding. Short-term containment, system backup
                    (bit-for-bit image BEFORE changes), long-term containment.
 
4. Eradication      Remove the cause. Remove malware, close the vector,
                    improve defences. Determine root cause.
 
5. Recovery         Restore to production, validate, monitor closely for
                    re-infection. The system owner decides when to return
                    to service — not the handler.
 
6. Lessons Learned  Report within a defined window, meeting with all parties,
                    consensus on the report, actionable improvements.

Two details the exam loves:

• Back up the system before you change anything during containment. Evidence first, remediation second.
• The system owner makes the return-to-production decision, not the incident handler. Handlers recommend; owners decide.

Attack techniques you must know#

GCIH covers the attacker's playbook because you cannot handle an incident you cannot recognise. Expect questions on the mechanics, the tooling and the detection.

Reconnaissance#

• Open-source intelligence, WHOIS, DNS interrogation (zone transfers with dig axfr), search engine reconnaissance, social media, job postings, Shodan, Recon-ng, theHarvester.
• Defensive angle: what you leak publicly, and how to reduce it.

Scanning#

• Host discovery, port scanning, OS fingerprinting, version detection.
• Nmap in depth — this is heavily tested. Know the scan types and what each looks like on the wire.

# TCP connect — completes the handshake, loud, no privileges needed
nmap -sT target
 
# SYN "half-open" — sends SYN, RST on SYN-ACK, quieter, needs root
nmap -sS target
 
# UDP — slow, unreliable, but where the interesting services hide
nmap -sU target
 
# Version and default scripts
nmap -sC -sV -p- target
 
# Timing templates T0 (paranoid) .. T5 (insane)
nmap -T2 target

• Vulnerability scanning, network mapping, and the detection signatures each scan type produces in IDS logs.

Exploitation#

• Password attacks: guessing, spraying, brute force, dictionary, pass-the-hash, rainbow tables, and why salting defeats the last one.
• Buffer overflows: stack layout, the role of the instruction pointer, NOP sleds, shellcode, and the mitigations (ASLR, DEP/NX, stack canaries).
• Web application attacks: SQL injection, cross-site scripting, cross-site request forgery, command injection, file inclusion, directory traversal.
• Network attacks: sniffing, ARP cache poisoning, DNS spoofing, session hijacking, man-in-the-middle.
• Client-side attacks and social engineering: phishing, malicious documents, drive-by downloads.
• Denial of service: volumetric, protocol, application layer, amplification and reflection.
• Metasploit fundamentals — payloads, encoders, Meterpreter, and what each one leaves behind.

Post-exploitation, persistence and covering tracks#

• Privilege escalation on Windows and Linux: unquoted service paths, weak permissions, kernel exploits, SUID binaries, sudo misconfiguration, scheduled tasks and cron.
• Pivoting and lateral movement: port forwarding, tunnelling, SSH tunnels, pass-the-hash, PsExec, WMI, remote services.
• Persistence: registry run keys, services, scheduled tasks, startup folders, cron, systemd units, WMI event subscriptions, web shells, accounts.
• Covering tracks: log manipulation and clearing, timestomping, hidden files and alternate data streams, rootkits (user-mode vs kernel-mode), steganography.
• Command and control: beaconing, jitter, domain fronting, DNS tunnelling, encrypted channels.

Windows and Linux artefacts worth indexing#

Windows
  Security log            4624 logon, 4625 failed logon, 4672 special privileges
  Sysmon                  1 process create, 3 network connect, 11 file create
  Registry run keys       HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Prefetch                C:\Windows\Prefetch
  Scheduled tasks         schtasks /query /fo LIST /v
  Alternate data streams  dir /r
 
Linux
  Auth                    /var/log/auth.log or /var/log/secure
  Persistence             crontab -l, /etc/cron.*, systemd units, ~/.bashrc
  SUID hunt               find / -perm -4000 -type f 2>/dev/null
  Recent files            find / -mmin -60 -type f 2>/dev/null
  Network                 ss -tulpn, lsof -i

A ten-week study plan#

Weeks 1–4 — Content, first pass. Work through the material without building the index. The goal is comprehension. Take a lab break every session and actually run the tools: Nmap, Wireshark, Metasploit against your own targets.

Weeks 5–7 — The index. Second pass, building the spreadsheet as you go. This is the heaviest phase and it is the one that passes the exam. Do not shorten it.

Week 8 — Practice test one. Use your printed index and nothing else, under real time pressure. Score it, then spend the rest of the week fixing every gap the test exposed. Add the missing rows.

Week 9 — Labs and weak areas. Whatever the practice test said you were bad at, that is the week's syllabus. Reprint the index.

Week 10 — Practice test two, then sit the exam. If practice test two is comfortably above the passing mark with time to spare, you are ready.

Exam-day mechanics#

• Two minutes per question, maximum. If a lookup is taking longer, flag it and move on. Unanswered questions from running out of time are the most common failure mode.
• Answer from memory first. Only open the index when you are genuinely unsure. The index is a safety net, not a workflow.
• Read the question for the phase. Many questions are really asking "which incident handling phase is this?" wearing a technical costume.
• Bring your printed materials, tabbed and bound. Check GIAC's current rules on what is permitted before the day.

Resources#

• SANS SEC504 if your employer will fund it. It is expensive and it is the intended path.
• The two included practice tests — they are the best available signal of readiness.
• A lab you can attack: a vulnerable VM, a local Metasploitable, or a TryHackMe/Hack The Box subscription for the offensive techniques.
• Your own index. Nothing you buy will beat one you built.

The honest summary#

GCIH is not conceptually hard. It is broad, and it is fast. The candidates who pass are the ones who accepted early that building a 2,000-row index is the work, and did it.