GIAC GCIH Full-Length Practice Test
Ten 106-question practice tests on a 240-minute clock, scored as a raw percentage against the 69% pass line. Every set covers all 15 current GCIH objective headings. The questions are selected-response only, so they train the knowledge, investigation and pacing side of GCIH without pretending to reproduce CyberLive virtual-machine tasks.
- 106 questions / 240 min
- 69% pass line
- 15 current objectives
- Single-answer only
- Explanation on every question
Choose one test, five, or the complete set
Every option uses the same 106-question format and 240-minute clock. Buy the amount of repetition you need.
One test
106 questions
One complete timed practice test
- 106 questions in 240 minutes
- All 15 current objective headings covered
- Raw-percentage score against 69%
- Explanation on every question
All 10 tests
1,060 questions
Ten complete four-hour practice tests
- 1,060 independently written questions
- Same objective allocation across every set
- Repeat the full four-hour pacing problem
- Enough fresh material to compare scores without memorising one paper
Five tests
530 questions
Five complete four-hour practice tests
- 530 questions across the current objectives
- Five timed attempts for pacing work
- Same scoring and explanation format
- A smaller pack if ten tests is more than you need
What GIAC currently sets for GCIH
GCIH includes CyberLive hands-on testing within its current 106-question, four-hour exam format.
| Certification | GIAC Certified Incident Handler (GCIH) |
| Exam | 1 proctored exam |
| Questions | 106 |
| Time limit | 4 hours |
| Minimum passing score | 69% |
| Hands-on testing | CyberLive virtual-machine challenges |
| Exam format | Open book with printed books, notes and study guides permitted |
| Delivery | Proctored remotely through ProctorU or on-site through Pearson VUE |
| Attempt access | 120 days from activation |
| Certification attempt | $999 USD |
| Exam retake | $899 USD |
| Renewal | Every 4 years · 36 CPEs or retake the exam |
Written to the current objective set
GIAC currently lists 15 GCIH objective headings, including incident response, network and log investigations, endpoint pivoting, password attacks, cloud credentials, SMB security, web API attacks, injection attacks and two AI-focused objectives.
These ten practice tests use those same headings as their content map. They do not reproduce live or recalled GIAC questions.
The selected-response format is deliberate. It lets you practise investigation logic, attacker tradecraft, defensive decisions and four-hour pacing. CyberLive is hands-on work inside virtual machines, so practise that part with real labs rather than pretending a text question is equivalent.
Four hours changes how a question bank feels
A short quiz tells you whether you recognise a technique. A 106-question run shows whether you can keep making clean incident-response decisions after three hours of logs, web evidence, credentials and attacker behaviour.
How it is built
- 106 single-answer questions with four options each
- All 15 current GCIH objective headings in every set
- Evidence-led scenarios built from logs, packet clues, identity events, endpoints, APIs and cloud activity
- Difficulty mix locked across the ten-test series
- No fake CyberLive lab questions
Under the clock
- 240-minute countdown
- Flag questions and come back before submitting
- Final review before you commit
- Automatic submission when the clock reaches zero
- Use hardcopy notes beside you if you want to rehearse GIAC's open-book workflow
What comes back
- Raw percentage and pass/fail against 69%
- Your answer beside the correct answer
- An explanation on every question
- Reasoning that calls out the tempting distractor
- A repeatable result you can compare across fresh sets
The useful part is why the tempting answer fails
GCIH questions reward evidence and sequence. The explanation should show what in the scenario makes one response better than the other plausible choices.
A webhook receiver accepts signed requests but never checks whether a valid signed message has already been processed. Captured requests can therefore be resent and trigger duplicate financial actions. Which defense is MOST direct?
- AAccept every replay as long as the source IP is unchanged
- BRemove signature validation because it does not stop replay by itself
- CReject already processed event IDs or nonces
- DPlace the request body in a URL query string
Why C
Signature validation proves message integrity and source possession of the signing secret, but it does not inherently guarantee freshness. Tracking unique event identifiers or nonces addresses replay directly; removing signatures would discard an existing protection without solving replay.
All 15 current GCIH objectives in every test
GIAC publishes objective headings, not objective percentages. These practice tests do not invent official weights. Fourteen objectives get seven questions each; Incident Response and Cyber Investigation gets eight, giving each set 106 questions.
| Current GCIH objective | Questions per practice test |
|---|---|
| Attacking Passwords | 7 |
| Detecting Evasive and Post-Exploitation Techniques | 7 |
| Detecting Exploitation and Covert Communications Tools | 7 |
| Endpoint Attack and Pivoting | 7 |
| Exploiting Insecure Web Application References | 7 |
| Incident Response and Cyber Investigation | 8 |
| Integrating LLMs with Offensive Operations | 7 |
| Malware and AI Assisted Investigations | 7 |
| Network and Log Investigations | 7 |
| Scanning and Mapping | 7 |
| Securing Credentials and Data in the Cloud | 7 |
| SMB Security | 7 |
| Understanding Passwords | 7 |
| Web Application API Attacks | 7 |
| Web Application Injection Attacks | 7 |
The question allocation above is this site's internal practice-test blueprint. GIAC does not publish objective weights for GCIH.
All 10 GCIH full-length practice tests
Each test is complete on its own: 106 questions, 240 minutes, the same objective allocation and the same price.
About GCIH, and about these practice tests
The GCIH exam
How many questions are on the GCIH exam, and how long do you get?
What score do you need to pass GCIH?
Is the GCIH exam open book?
Does GCIH include CyberLive hands-on testing?
How much does the GCIH certification attempt cost?
What happens if you fail GCIH?
How long is the GCIH certification valid?
These practice tests
Do these practice tests reproduce CyberLive?
Are there choose-TWO questions?
How are these practice tests scored?
Where do the questions come from?
Are all ten tests the same difficulty?
Is this a subscription?
What currency will I pay in?
Ten GCIH practice tests. 1,060 questions.
$14.99₹499£11.99€13.99
GIAC lists a certification attempt at $999 and a retake at $899. Use the cheaper four-hour rehearsal to find the weak decisions before exam day.
