GIAC (SANS)

GIAC Certified Incident Handler

GCIH

The GIAC Certified Incident Handler (GCIH) certification validates your ability to detect, respond to, and resolve computer security incidents using a wide range of essential security skills. It is designed for incident handlers, system administrators, and security practitioners who are first responders. Earning GCIH demonstrates you can manage security incidents by understanding common attack techniques, vectors, and tools.

Practice Free Questions

6Domains

15Objectives

141Practice pages

682Free questions

GCIH free practice questions

Choose any objective and open any question page — no sign-in required.

Incident Response and Cyber Investigation

50 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50

Network and Log Investigations

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

Malware and AI Assisted Investigations

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

Detecting Evasive and Post-Exploitation Techniques

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Detecting Exploitation and Covert Communications Tools

42 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–42

Endpoint Attack and Pivoting

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Exploiting Insecure Web Application References

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Web Application API Attacks

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

Web Application Injection Attacks

80 questions · 16 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–60 61–65 66–70 71–75 76–80

Attacking Passwords

41 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–41

Understanding Passwords

39 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–39

Securing Credentials and Data in the Cloud

42 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–42

Scanning and Mapping

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

SMB Security

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

Integrating LLMs with Offensive Operations

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (15 objectives · 141 pages).

GIAC Certified Incident Handler

GCIH free practice questions

Domain 1 · Incident Response and Investigation20% of practice bank · 3 objectives · 139 questions20%

Domain 2 · Attack Techniques and Detection18% of practice bank · 3 objectives · 123 questions18%

Domain 3 · Web Application Security25% of practice bank · 3 objectives · 172 questions25%

Domain 4 · Credential and Access Security18% of practice bank · 3 objectives · 122 questions18%

Domain 5 · Network and Infrastructure Security14% of practice bank · 2 objectives · 94 questions14%

Domain 6 · Emerging Technologies and Offensive Operations5% of practice bank · 1 objectives · 32 questions5%