GCIH
The GCIH is GIAC's hands-on certification for detecting, responding to, and resolving security incidents — the credential mapped to SANS SEC504 that proves you can actually handle a live breach, not just describe one. It's a demanding, 4-hour, open-book exam that mixes scenario questions with CyberLive labs inside a real virtual machine, and at roughly $999 a re-sit is expensive in both money and lost time. Many candidates sit it under a tight employer deadline or a DoD 8140 / 8570 requirement. This page breaks down exactly what's tested, how it's delivered, and how to get it done right the first time.
Pay Only After You Pass
No upfront fee — you settle only after your verified passing result. We advertise guaranteed results — 100% pass guaranteed or money back.
How the GCIH exam is built — at a glance
106
A single 4-hour proctored session — roughly two minutes per item, so pace matters. There is no separate writing or essay component.
69%
The cut score for exam versions released on or after May 10, 2025. GIAC sets it per version via psychometrics — no curve, no partial credit.
Open
You may use printed notes and an indexed copy of the SEC504 courseware. Several items are CyberLive — hands-on tasks inside a live virtual machine.
CyberLive items drop you into a real virtual machine and ask you to perform a task — analyze a packet capture, read a log, run a command, or interrogate a system — then answer based on what you find. They reward people who have actually done the work, not just memorized definitions, and they are why GCIH is treated as a practitioner credential rather than a trivia test.
Open book is a trap if you lean on it. With 106 questions in 4 hours, you can't afford to look much up — a fast, well-built index across the SEC504 books is what separates a pass from a fail. No electronic resources or internet searches are permitted; it's your printed notes only, and the clock is unforgiving if you haven't internalized the material first.
GIAC publishes objectives, not fixed domain weights — these are the core competency areas
The core of GCIH: the incident-handling process — preparation, identification, containment, eradication, recovery, and lessons learned — plus structured investigation of compromised systems.
How attackers discover and map a network — reconnaissance, scanning tools, and the enumeration techniques you must recognize from a defender's seat to spot an intrusion early.
Understanding and attacking passwords, plus securing credentials and data in the cloud — guessing, cracking, hash handling, and the defenses that blunt each technique.
Endpoint exploitation, lateral movement, and pivoting through a network — including SMB security and how an attacker chains a single foothold into a full compromise.
Injection and API attacks, plus exploiting insecure direct object references — the web-layer techniques you must detect and respond to during an incident.
Detecting exploitation, covert communications, post-exploitation and evasive techniques; network and log investigations; and malware plus AI-assisted investigation workflows.
GIAC does not publish numeric weightings for GCIH objectives, so treat every area as fair game. Recent exam versions also fold in modern topics — securing cloud credentials and integrating large language models into offensive operations — reflecting how SEC504 has evolved. Always confirm the current objective list on the official GIAC certification page before you sit.
Two ways to sit the exam — and what to expect on test day
Take the exam from a private room at home, monitored live by a remote proctor through ProctorU. You'll complete a system check, a webcam room scan, and a government ID verification before the exam unlocks. Printed open-book materials are allowed in view, but no electronic devices or extra monitors.
Prefer a controlled room? Sit GCIH at a Pearson VUE test center, where staff verify your ID, store your belongings, and monitor the room. You bring your printed open-book materials in. This option suits anyone without a reliable home setup or a quiet, private space for 4+ hours.
A valid, unexpired government photo ID with your name matching your GIAC account exactly. The proctor captures a photo before the exam begins.
A clear desk, no second monitor, no phone within reach. Printed open-book notes are permitted; electronic copies, devices, and internet access are not.
Stay in frame for the full session. Breaks are limited and the clock keeps running. Talking aloud, leaving the seat, or losing connection can flag the session.
GCIH is built for hands-on defenders and responders
No formal requirements — but it's a serious practitioner exam
Difficulty: GCIH is open book, but that's deceptive. The breadth of attack and defense topics, the live CyberLive labs, and the 4-hour clock make it genuinely demanding. Candidates who pass typically combine real IR experience with weeks of indexing and practice tests — exactly the pressure point our help is designed to remove.
GCIH is a high-stakes, ~$999 exam sitting between you and a job requirement or a DoD 8140 baseline. Exam Assist pairs you with a vetted incident-response specialist and works on a pay-after-you-pass model — so the risk sits with us, not you. No upfront fee, guaranteed results: Exam Assist handles the sitting end to end, and you settle only after the verified result.
Tell us your delivery method (ProctorU or Pearson VUE), your exam date, and your background. Takes a couple of minutes over WhatsApp, Telegram, or Discord.
We review your timeline and target and tell you plainly whether it's realistic — before any money is discussed. If it isn't a fit, we say so.
Exam Assist handles the sitting end to end. You're matched with a GCIH specialist who maps the work around the open-book format, the CyberLive labs, and your proctoring environment — discreetly and confidentially.
You only pay once your passing result is confirmed in your GIAC account. No verified result, nothing owed.
Tell us your exam details and get an honest, no-pressure feasibility answer first.
Straight answers about the GIAC GCIH exam
Booking, and sibling GIAC certifications
Pair with a vetted incident-response specialist on a results-first arrangement. No upfront fee — settle only after a verified passing result.
Start the conversation GSECGIAC's broad foundation certification covering core defensive security skills — a common first GIAC credential before or alongside GCIH.
View exam GCIAFocused on traffic analysis and intrusion detection — a natural next step for GCIH holders deepening their detection skills.
View exam GPENThe offensive counterpart — understanding attacker tradecraft from the red-team side complements GCIH's incident-handling focus.
View examGet expert GCIH help with no upfront fee — you settle only after your verified passing result. Honest feasibility answer first, results-first arrangement always.