GIAC GCIH Practice Test

GCIH practice test: what's covered

• Certified Incident Handler
• SANS GIAC

Free GCIH sample questions

1. During a ransomware incident, your SOC manager wants the team to immediately reimage all 200 infected endpoints. You are the lead incident handler. According to the SANS PICERL model, what is the BEST objection?

   • A. Reimaging is the Eradication step but the team has not yet completed Identification (scope) and Containment (stopping spread). Reimaging too early destroys forensic evidence and may miss persistence on uninfected hosts.
   • B. Reimaging requires legal approval first
   • C. Reimaging is part of Recovery, not Eradication
   • D. Reimaging should always be the first action to minimise downtime
   Show answer

   Correct: A. PICERL is sequential for a reason — Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Eradication (reimage/remove) before full Identification (scope) and Containment (network isolation) means you lose evidence AND may leave persistence on hosts you did not catalogue. Reimaging IS Eradication (not Recovery — Recovery is restoring services after eradication).

2. You are building the Preparation phase for your IH team. Which THREE artifacts are MOST critical to have BEFORE an incident occurs? (Choose 3)

   • A. A documented incident classification matrix (severity 1-4) with response SLAs
   • B. A signed warrant from local law enforcement
   • C. A "jump bag" with forensic tools (FTK Imager, KAPE, write-blockers, sterile media)
   • D. Out-of-band communications (Signal group, PSTN bridge) for when corp email/Slack is compromised
   • E. A copy of last quarter's pen-test report
   Show answer

   Correct: A and C and D. Preparation focuses on what must exist before "boom" — classification matrix (so analysts know what triggers what), jump bag (so you can image quickly), and OOB comms (because attackers monitor corp Slack/email). Warrants are obtained during the incident with legal counsel; pen-test reports are nice-to-have, not critical for IH readiness.

3. A user reports a suspicious email with an attachment. Which PICERL phase are you in when you triage the email, validate the indicator, and decide whether it qualifies as an incident vs an event?

   • A. Preparation
   • B. Identification
   • C. Containment
   • D. Eradication
   Show answer

   Correct: B. Identification = "is this an event (occurrence) or an incident (adverse occurrence)?". You triage the indicator, validate against your detection sources (mail gateway logs, EDR), assign severity, and declare. Many candidates mistakenly call this Containment because they "took action" — but no containment action has occurred yet.

4. Mid-incident, your legal team asks why you did not pull the network cable on the compromised file server. You replied that you needed evidence first. Which IH principle BEST defends your action?

   • A. Preserve order of volatility — collect volatile evidence (RAM, network connections, running processes) BEFORE actions that destroy it (powering off / pulling cable)
   • B. Chain of custody applies only after powering off
   • C. Hashing must be done before any RAM acquisition
   • D. Containment always comes before Identification
   Show answer

   Correct: A. RFC 3227 order of volatility: CPU registers/cache → RAM → routing/ARP/process tables → temp files → disk → remote logs → archival media. Pulling the cable kills active connections (you lose attacker source IPs in netstat); powering off wipes RAM (you lose injected malware, encryption keys, decrypted C2). Acquire volatile first, then contain.

5. You discover an attacker has been in the network for 47 days. The CFO asks "when do we tell our auditors?". Per a typical CSIRT charter and most regulations, who decides the EXTERNAL notification timing?

   • A. The lead incident handler
   • B. A predefined decision tree, but the final external-notification decision rests with executive leadership (CISO/CEO/General Counsel) — IH advises on technical facts
   • C. The SOC analyst who first triaged the alert
   • D. The MSP's account manager
   Show answer

   Correct: B. IH provides facts (what was accessed, what data, what timeframe). Notification timing is a legal/business decision (GDPR 72h, HIPAA 60d, PCI per-acquirer). Pre-incident decision trees codify who approves which level of disclosure. Lead IH never unilaterally notifies regulators or customers.

Last updated: 2026-10-19

GCIH practice test FAQ

Related practice tests

• GIAC GCFA practice test
• GIAC GCIA practice test
• GIAC GPEN practice test