The GIAC Certified Incident Handler (GCIH) is a practitioner-level credential for security staff who detect, respond to and resolve incidents, and the GCIH exam that gates it is one proctored exam of 106 questions in 4 hours, with a minimum passing score of 69%. There are no formal prerequisites: GIAC does not require a degree, prior certifications or an endorsement, only an approved certification attempt in your account. The exam tests attacker techniques and the incident handling process end to end, from scanning and password attacks to post-exploitation detection and investigation, which is why SOC and IR hiring managers read it as evidence of hands-on readiness rather than recall. This guide covers the current format, the attempt-window rules, the training-versus-self-study decision, and what renewal costs after you pass.
What the GCIH Covers
The published objectives read like an attacker playbook mirrored by a defender checklist. GIAC groups them into domains that include incident response and cyber investigation built on the PICERL and DAIR processes, network and log investigations, scanning and mapping with tools such as Nmap, SMB security, password attacks and defense, web application injection and API attacks, endpoint attacks and pivoting, evasive post-exploitation techniques, securing credentials and data in the cloud, and a newer objective on integrating LLMs with offensive operations and defending against AI-specific attacks. In practice you need to recognize what common hacker tools look like on the wire and in logs, not just recite definitions of attack classes.
That breadth is the main trade-off. GCIH is wider than a pure blue-team exam and less code-intensive than an exploit-development certification, so it suits incident handlers, team leads, system administrators and first responders who want the full attack lifecycle in one credential. If your real goal is deep web application exploitation, a hands-on certification such as the Burp Suite Certified Practitioner tests that skill directly in a lab environment, whereas GCIH verifies that you can handle the incident those exploits eventually create.
Exam Format and Pass Mark
The exam is web-based and fully proctored, and GIAC allows an unusual resource: printed, unannotated paper materials. No electronic devices or digital notes are permitted, so the de facto skill that separates prepared candidates from unprepared ones is a well-organized printed index of your study materials. Building one is not optional busywork; it is the format working as designed.
| Item | Detail |
|---|---|
| Certification | GIAC Certified Incident Handler (GCIH) |
| Format | Single web-based, proctored exam |
| Questions | 106 |
| Time limit | 4 hours |
| Passing score | 69% |
| Proctoring options | Remote via ProctorU or onsite via Pearson VUE |
| Attempt window | 120 days from activation |
The pass mark is not a number that transfers automatically between exam versions. GIAC states that it re-runs psychometric standard-setting studies and applies the result to every candidate who receives the GCIH exam version released on or after May 10th, 2025, so the 69% figure you see quoted today is tied to that version. Before scheduling, open the Certification Information section of your own GIAC account and confirm the format and cut score that apply to your specific attempt, because an older version can carry a different requirement.
Your 120-Day Exam Window
An attempt is not a voucher with an indefinite shelf life. Once GIAC activates the attempt in your account after payment, you will have 120 days from the date of activation to complete your certification attempt, and the clock starts at activation, not when you first open the exam software. Two practical consequences follow. First, buy the attempt when you are already deep in preparation, not months in advance out of optimism. Second, book the proctoring slot early: both remote sessions through ProctorU and onsite sessions through Pearson VUE fill up around popular weeks, and rescheduling windows tighten close to the appointment.
If you simply miss a proctored appointment, GIAC charges a $175 reseating fee and grants a 7-day extension from your existing deadline. That is an expensive way to buy one week, so treat the calendar as part of exam strategy.
How to Prepare for GCIH
Two viable routes exist, and choosing between them honestly is the biggest cost lever you control. The official course, SANS SEC504: Hacker Tools, Techniques, and Incident Handling, is built around the GCIH objectives, with dozens of hands-on labs across Windows, Linux and cloud targets plus a capstone capture-the-flag event, but it is priced accordingly and often paid by employers. Self-study using the published objectives, a home lab, and standard references is slower and demands discipline, but it is the route most independent candidates take. An ordered plan that works for either route:
- Download the current exam objectives from the GIAC certification page and turn each objective into a checklist row; anything you cannot explain out loud becomes a study gap.
- Decide the training route with your budget and timeline on paper: employer-funded SEC504, OnDemand self-paced, or fully independent study.
- Build a home lab with free tools and actually run Nmap scans, password attacks, Netcat listeners and Metasploit modules so recognition in logs comes from memory of doing, not reading.
- Start your printed index on day one and add one page per topic; tab it by objective so lookups during the exam take seconds, not minutes.
- Take the official GIAC practice exams under real timing; they simulate the test engine and gauge readiness, though the question bank is limited and never contains actual exam questions.
- Keep an error log and review it weekly; the discipline of turning each wrong answer into a targeted study action is what converts practice attempts into passing attempts, the same review loop we describe for practice exam error analysis.
- Schedule the real exam when two consecutive timed practice attempts sit comfortably above the passing bar, not on a fixed calendar date.
- In the final week, do no new topics: re-index, rehearse lookups, and verify your proctoring setup and allowed materials against the current rules.
Retakes, Renewals and Fees
GIAC sells attempts individually, and orders are non-transferable and non-refundable once access is granted, so plan the purchase date against the attempt window. If you fail, a retake attempt is purchasable separately at a lower price than a first attempt, which is why candidates who schedule their first try slightly early still have a rational fallback within the same season. After passing, the credential is not permanent: GIAC certifications renew on a recurring cycle through continuing professional education credits plus a maintenance fee, and renewal pricing is tiered. A full-price renewal costs $499, and additional renewals within 2 years of that payment cost $249, which rewards stacking renewals for multiple GIAC certifications rather than paying full price for each one. Budget for the maintenance cycle, not just the exam, when you compare GCIH against cheaper entry-level credentials.
Sources
- GIAC — GIAC Certified Incident Handler (GCIH), exam format, objectives and attempt rules: https://www.giac.org/certifications/certified-incident-handler-gcih
- SANS — GIAC Certified Incident Handler (GCIH) certification overview and SEC504 alignment: https://www.sans.org/cyber-security-certifications/certified-incident-handler-gcih
- GIAC — Certification pricing and fees (renewals, reseating): https://www.giac.org/pricing