GIAC / SANS · Full exam outline
GCIH
Certified Incident Handler
Incident handling5 domains · 15 subdomains
GIAC / SANS publishes exam objectives rather than percentage weights, so this outline lists the objective areas and the topics under each.
1
Incident Handling Process
1.1Preparation and team readiness
1.2Identification and scoping
1.3Containment, eradication, recovery and lessons learned
2
Reconnaissance and Initial Access
2.1Scanning and enumeration
2.2Password attacks
2.3Web application and social engineering attacks
3
Post-Exploitation Techniques
3.1Privilege escalation and persistence
3.2Lateral movement and pivoting
3.3Covering tracks and anti-forensics
4
Detection and Analysis
4.1Host-based investigation
4.2Network-based investigation
4.3Malware and memory analysis
5
Evidence and Reporting
5.1Evidence acquisition and handling
5.2Detection tooling and telemetry
5.3Reporting and communication
Weights are the certification body’s published values and are checked against each outline revision.