- The PICERL and DAIR incident handling processes
- Common incident response problems and how teams handle them
GIAC Certification Training Course
GIAC Certified Incident Handler (GCIH) Certification Training Course
Prepare for the GIAC Certified Incident Handler (GCIH) exam by learning how attackers actually work, then how to detect, respond to and clean up after them.
Course focus: Incident handling with PICERL and DAIR, scanning and mapping, password attacks, SMB, Metasploit and netcat, web and API attacks, cloud credential security, post-exploitation, malware triage and LLM threats, aligned with GIAC's published GCIH objectives.
Course Overview
What the GCIH course covers and who it's for.
Accumentum's GCIH prep course is for incident handlers, SOC analysts, system administrators and anyone who gets the call when something goes wrong. GIAC says GCIH validates the ability to detect, respond to and resolve computer security incidents, and that holders understand common attack techniques and tools like Nmap, Metasploit and netcat.
The course follows GIAC's published GCIH objectives. We start with the PICERL and DAIR incident handling processes, then work through scanning, password attacks, SMB, endpoint attacks and pivoting, web application and API attacks, cloud credential attacks, post-exploitation, and LLM attacks. GCIH includes CyberLive hands-on questions, so you'll practice with the real tools in lab.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC or the SANS Institute. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GCIH the way the exam actually tests.
01
Cover Every GCIH Objective
Work through each certification objective GIAC publishes for GCIH, in an order that builds on itself.
02
Practice Hands-On
GCIH includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GCIH is 106 questions in 4 hours with a minimum passing score of 69%, per GIAC. We pace practice to match.
Who Should Attend
- Incident handlers and incident response team leads.
- SOC analysts who triage alerts and escalate incidents.
- System administrators and security architects who act as first responders.
- CySA+, ECIH or CEH holders who want a deeper hands-on incident handling credential.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIH.
- Plan on knowing networking basics, the Windows and Linux command line, and core security concepts before you start. GSEC, Security+ or CySA+ level knowledge helps.
Pathway Map
The GCIH course in 8 modules.
Each module maps to one or more of GIAC's published GCIH certification objectives.
Course Content
- Working through network and log data during an incident
- Basic malware analysis and using AI to speed up investigations
- How attackers discover hosts, services and vulnerabilities
- Spotting scans and defending against them
- Identifying password hashes and weak spots
- Running and defending against password attacks
- Securing credentials and data in the cloud
- SMB features, share discovery and hardening
- Endpoint attacks and pivoting through an environment
- Detecting Metasploit use
- Detecting netcat and other covert channels
- Injection attacks
- Insecure direct references
- Abusing web APIs
- Persistence and hiding techniques and how to find them
- How LLM prompts are processed and attacked, and how to defend against it
Course Features
Built for the hands-on side of GCIH.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GCIH isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GCIH certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GCIH exam.
GCIH Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for GCIH the same way.
Per GIAC, the GCIH exam is one proctored exam with 106 questions, a 4 hours time limit and a minimum passing score of 69%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GCIH page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC or the SANS Institute. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Frequently Asked Questions
Common questions about Accumentum's GCIH prep course.
GIAC Certified Incident Handler (GCIH) is a practitioner certification from GIAC. Per GIAC, the exam is 106 questions, 4 hours, with a minimum passing score of 69%, and it's proctored online through ProctorU or at a Pearson VUE center.
No. SANS course names and materials belong to the SANS Institute and only SANS teaches them. This is Accumentum's own on-demand prep for the GIAC exam, built from GIAC's published certification objectives.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GCIH is listed on Air Force COOL. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIH. Plan on knowing networking basics, the Windows and Linux command line, and core security concepts before you start. GSEC, Security+ or CySA+ level knowledge helps.
Yes. GCIH includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
Enrollment
Enroll in GCIH training with Accumentum.
Enroll in Accumentum's GCIH prep course to get ready for the GIAC Certified Incident Handler (GCIH) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GCIH?
Start on your own schedule and work toward the test date you pick.