GIAC GCIH — the complete study guide

GCIH is the exam people underestimate, and I know exactly why.

It is open book. Which everyone hears as "easy". It is not.

What open book actually means is that the exam becomes a test of retrieval speed under time pressure. And that changes what you should be doing with your study hours completely.

The content matters. But the index is what turns knowing the content into passing, and that is what most of this guide is about.

The exam at a glance#

The "open book" rule is narrower than people expect: printed, physical materials. No laptops, no PDFs, no phones. Whatever you want during the exam, you must have printed and bound in advance.

The index is the exam#

If you take one thing from this guide, take this.

You have roughly two minutes per question. Flipping through a stack of course books hunting for a term costs you three. An index turns a three-minute hunt into a fifteen-second lookup, and it is the difference between finishing comfortably and running out of time.

How to build one that works#

1. Work through the material once, normally. No index yet. Just understand it.
2. On the second pass, build a spreadsheet with these columns: Term | Book | Page | One-line definition | Notes.
3. Add an entry for every term, tool, command, protocol, port, acronym and technique. Aim for something in the region of 1,500–2,500 rows. Yes, really.
4. Write the one-line definition yourself. This matters more than the page number: for a good proportion of questions the definition alone answers it and you never open a book.
5. Sort alphabetically. Print it. Bind it. Tabs on each book by section.
6. Practise with it. Sit a practice test using only your index. You will immediately find the gaps — fix them and reprint.

The incident handling process#

GCIH is built around six phases. Know them cold, in order, and know what belongs in each — the exam repeatedly asks which phase an action belongs to.

1. Preparation      Policies, jump kit, communications plan, training,
                    baselines, warning banners, contact lists.
 
2. Identification   Detection and validation. Is this actually an incident?
                    Scope it. Assign a handler. Start the chain of custody.
 
3. Containment      Stop the bleeding. Short-term containment, system backup
                    (bit-for-bit image BEFORE changes), long-term containment.
 
4. Eradication      Remove the cause. Remove malware, close the vector,
                    improve defences. Determine root cause.
 
5. Recovery         Restore to production, validate, monitor closely for
                    re-infection. The system owner decides when to return
                    to service — not the handler.
 
6. Lessons Learned  Report within a defined window, meeting with all parties,
                    consensus on the report, actionable improvements.

Two details the exam loves:

• Back up the system before you change anything during containment. Evidence first, remediation second.
• The system owner makes the return-to-production decision, not the incident handler. Handlers recommend; owners decide.

Attack techniques you must know#

GCIH covers the attacker's playbook because you cannot handle an incident you cannot recognise. Expect questions on the mechanics, the tooling and the detection.

Reconnaissance#

• Open-source intelligence, WHOIS, DNS interrogation (zone transfers with dig axfr), search engine reconnaissance, social media, job postings, Shodan, Recon-ng, theHarvester.
• Defensive angle: what you leak publicly, and how to reduce it.

Scanning#

• Host discovery, port scanning, OS fingerprinting, version detection.
• Nmap in depth — this is heavily tested. Know the scan types and what each looks like on the wire.

# TCP connect — completes the handshake, loud, no privileges needed
nmap -sT target
 
# SYN "half-open" — sends SYN, RST on SYN-ACK, quieter, needs root
nmap -sS target
 
# UDP — slow, unreliable, but where the interesting services hide
nmap -sU target
 
# Version and default scripts
nmap -sC -sV -p- target
 
# Timing templates T0 (paranoid) .. T5 (insane)
nmap -T2 target

• Vulnerability scanning, network mapping, and the detection signatures each scan type produces in IDS logs.

Exploitation#

• Password attacks: guessing, spraying, brute force, dictionary, pass-the-hash, rainbow tables, and why salting defeats the last one.
• Buffer overflows: stack layout, the role of the instruction pointer, NOP sleds, shellcode, and the mitigations (ASLR, DEP/NX, stack canaries).
• Web application attacks: SQL injection, cross-site scripting, cross-site request forgery, command injection, file inclusion, directory traversal.
• Network attacks: sniffing, ARP cache poisoning, DNS spoofing, session hijacking, man-in-the-middle.
• Client-side attacks and social engineering: phishing, malicious documents, drive-by downloads.
• Denial of service: volumetric, protocol, application layer, amplification and reflection.
• Metasploit fundamentals — payloads, encoders, Meterpreter, and what each one leaves behind.

Post-exploitation, persistence and covering tracks#

• Privilege escalation on Windows and Linux: unquoted service paths, weak permissions, kernel exploits, SUID binaries, sudo misconfiguration, scheduled tasks and cron.
• Pivoting and lateral movement: port forwarding, tunnelling, SSH tunnels, pass-the-hash, PsExec, WMI, remote services.
• Persistence: registry run keys, services, scheduled tasks, startup folders, cron, systemd units, WMI event subscriptions, web shells, accounts.
• Covering tracks: log manipulation and clearing, timestomping, hidden files and alternate data streams, rootkits (user-mode vs kernel-mode), steganography.
• Command and control: beaconing, jitter, domain fronting, DNS tunnelling, encrypted channels.

Windows and Linux artefacts worth indexing#

Windows
  Security log            4624 logon, 4625 failed logon, 4672 special privileges
  Sysmon                  1 process create, 3 network connect, 11 file create
  Registry run keys       HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Prefetch                C:\Windows\Prefetch
  Scheduled tasks         schtasks /query /fo LIST /v
  Alternate data streams  dir /r
 
Linux
  Auth                    /var/log/auth.log or /var/log/secure
  Persistence             crontab -l, /etc/cron.*, systemd units, ~/.bashrc
  SUID hunt               find / -perm -4000 -type f 2>/dev/null
  Recent files            find / -mmin -60 -type f 2>/dev/null
  Network                 ss -tulpn, lsof -i

How I would plan ten weeks#

The index phase is the heaviest part and the one people try to shorten. Do not shorten it — it is the phase that passes the exam.

Weeks 1–4 — Content, first pass. Work through the material without building the index. The goal is comprehension. Take a lab break every session and actually run the tools: Nmap, Wireshark, Metasploit against your own targets.

Weeks 5–7 — The index. Second pass, building the spreadsheet as you go. This is the heaviest phase and it is the one that passes the exam. Do not shorten it.

Week 8 — Practice test one. Use your printed index and nothing else, under real time pressure. Score it, then spend the rest of the week fixing every gap the test exposed. Add the missing rows.

Week 9 — Labs and weak areas. Whatever the practice test said you were bad at, that is the week's syllabus. Reprint the index.

Week 10 — Practice test two, then sit the exam. If practice test two is comfortably above the passing mark with time to spare, you are ready.

Exam-day mechanics#

• Two minutes per question, maximum. If a lookup is taking longer, flag it and move on. Unanswered questions from running out of time are the most common failure mode.
• Answer from memory first. Only open the index when you are genuinely unsure. The index is a safety net, not a workflow.
• Read the question for the phase. Many questions are really asking "which incident handling phase is this?" wearing a technical costume.
• Bring your printed materials, tabbed and bound. Check GIAC's current rules on what is permitted before the day.

Resources#

• SANS SEC504 if your employer will fund it. It is expensive and it is the intended path.
• The two included practice tests — they are the best available signal of readiness.
• A lab you can attack: a vulnerable VM, a local Metasploitable, or a TryHackMe/Hack The Box subscription for the offensive techniques.
• Your own index. Nothing you buy will beat one you built.

What did we learn?#

1. Open book does not mean easy. It means fast.
2. The index is the work. Two thousand rows, with your own one-line definitions.
3. Write those definitions yourself — a good chunk of questions never need the book.
4. Two minutes per question, maximum. Flag and move on.
5. Answer from memory first. The index is a safety net, not a workflow.
6. Learn the six incident handling phases in order, and be able to name which phase a scenario is in.
7. For every attack technique, learn its detection. Half the questions come from the defender's chair.

GCIH is not conceptually hard. It is broad, and it is fast. The people who pass are the ones who accepted early that building the index is the studying, and then did it.

Sitting this one soon? I would like to know how the index goes — it is the part everyone wants to negotiate their way out of.

Keep going!