GIAC Certified Incident Handler GCIH Exam Practice Questions
US$39
Every question with the correct answer and why the other options are wrong.
Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.
please get the GCIH study materials and use them as a guide! I just passed my exam with the help of them today as 90% points. All the best guys!
Three of the 842 questions in this pack
Question 1
Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team.
As a demo project he asked members of the incident response team to perform the following actions:
• Remove the network cable wires.
• Isolate the system on a separate VLAN
• Use a firewall or access lists to prevent communication into or out of the system.
• Change DNS entries to direct traffic away from compromised system
Which of the following steps of the incident handling process includes the above actions?
Show answer and explanation
Correct answer: B. Containment
All four actions listed, removing network cables, isolating on a VLAN, using firewalls/access lists, and changing DNS entries, are classic containment measures designed to limit the scope and impact of a security incident. Containment is the phase where responders take steps to stop the attack from spreading and prevent further damage, while preserving evidence. Identification focuses on detecting the incident, eradication removes the threat, and recovery restores systems to normal operation.
Why the other options are wrong
- A. Identification is the detection and confirmation of a security incident, not the implementation of isolation measures.
- C. Eradication removes the attacker's tools and access, but the listed actions are preventative controls rather than removal steps.
- D. Recovery restores systems to normal operation after the threat is eliminated; it does not involve isolation or access prevention.
Question 2
Adam, a novice computer user, works primarily from home as a medical professional. He just bought a brand new Dual Core Pentium computer with over 3 GB of RAM. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to. Adam uses antivirus software, anti-spyware software, and keeps the computer up-to-date with Microsoft patches. After another month of working on the computer, Adam finds that his computer is even more noticeably slow. He also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Adam notices that his computer only has about 10 GB of free space available. Since his hard drive is a 200 GB hard drive, Adam thinks this is very odd.
Which of the following is the mostly likely the cause of the problem?
Show answer and explanation
Correct answer: A. Computer is infected with the stealth kernel level rootkit.
A stealth kernel-level rootkit operates at the system's deepest level and can hide its presence and activities from standard monitoring tools, antivirus, and anti-spyware software. The key indicator here is that the system is visibly slowing down with mysteriously disappearing windows, yet antivirus and anti-spyware software detect nothing, suggesting something hidden from these tools. The massive loss of disk space (190 GB consumed) combined with popups that vanish quickly points to rootkit activity that typical security tools cannot detect because the rootkit controls what the OS reports.
Why the other options are wrong
- B. A stealth virus typically replicates by attaching to files and would be more likely detected by antivirus software, which is running on this system.
- C. Trojan viruses are generally detected by antivirus software and don't typically cause the hidden resource consumption characteristic of rootkits.
- D. Worms cause visible file replication and network spreading; they are usually detected by antivirus and would not evade detection as effectively as a kernel-level rootkit.
Question 3
Which of the following types of attacks is only intended to make a computer resource unavailable to its users?
Show answer and explanation
Correct answer: A. Denial of Service attack
A Denial of Service (DoS) attack is specifically designed and intended solely to make a resource unavailable to legitimate users by overwhelming it with traffic or exploiting vulnerabilities to crash the service. The defining characteristic of a DoS attack is that its only goal is availability disruption, not data theft, authentication bypass, or other objectives.
Why the other options are wrong
- B. A replay attack involves capturing and resending valid data to impersonate a user or gain unauthorized access, not merely denying availability.
- C. A teardrop attack is a specific DoS technique that sends fragmented packets, but it is a type of DoS rather than the category that encompasses only availability attacks.
- D. A land attack sends spoofed packets with the target's own IP as both source and destination, designed to crash the system, but is a specific DoS variant rather than the general category.
13 reviews for GIAC Certified Incident Handler GCIH Exam Practice Questions
Only logged in customers who have purchased this product may leave a review.
How much of the GIAC Certified Incident Handler GCIH bank is free?
842 questions in the bankEach step includes the one before, so buying only adds new questions.
- You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
- 21025% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
- 421the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
- 842100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
What’s in the GIAC Certified Incident Handler GCIH pack
- 842 questions mapped to the GCIH exam objectives
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Instant delivery by email the moment you check out
- Free monthly updates for as long as the exam is live
- Pass or your money back
The GCIH costs US$999 per attempt. This pack is US$39, paid once.
What makes the GCIH hard
The GCIH covers the full incident response lifecycle from both sides of the attack. It is 106 questions in four hours, open book, with a 69% pass mark.
The exam tests how attackers operate and how defenders respond: reconnaissance, exploitation, privilege escalation and lateral movement on one side, and detection, containment, eradication and recovery on the other. Candidates who know incident response but have not studied attacker techniques consistently get caught out.
This pack has 842 practice questions, matching how much ground the GCIH covers, so it is a way to find the gaps before GIAC does.
About the exam
The GCIH validates hands-on skill in detecting, responding to, and recovering from security incidents. It covers attacker tactics and techniques alongside the defensive workflows needed to handle them, making it one of the most practical blue team certifications available. It is aligned to the SANS SEC504 course (Hacker Tools, Techniques, and Incident Handling).
Questions before you buy
How quickly do I receive it?
Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
Related products
-
GIAC Certified Enterprise Defender GCED
88 questionsUpdated Nov 20265.0 (4) US$39 -
GIAC Penetration Tester GPEN
385 questionsUpdated Nov 20264.4 (8) US$39 -
GIAC Information Security Professional GISP
654 questionsUpdated Nov 20264.8 (6) US$39 -
GIAC Security Essentials GSEC
279 questionsUpdated Nov 20264.6 (8) US$39
Samantha –
please get the GCIH study materials and use them as a guide! I just passed my exam with the help of them today as 90% points. All the best guys!
Armand –
Hi dudes! These GCIH exam braindumps are good to help me pass the exam by the first attempt. I have received my certification today! Thank you!
Hyman –
I have used CertStash GCIH pdf and found same questions in the exam. I have passed it without any issue. Fully recommended CertStashs Dumps
Julius –
The questions from your GCIH practice dump were very helpful and 90% were covered. Passed my exam today. Thanks!
Barret –
Passed GCIH exams today with high marks by help of GCIH latest study materials. It is valid enough to help me passing GCIH exam. Recommend GCIH latest study materials to all guys!
Isabel –
GCIH exam dump prepared me well for my exam. I used it and I passed. Thanks!
Brian –
Cleared my GCIH exam fially. I would say the GCIH dump is pretty much valid. Thanks so much!!!
Riva –
i got in my GCIH exam such good marks as 98%, i could not even believe the result. Thank you for your great job!
Nathaniel –
Attempted GCIH exam on my own but could not turn fruitful due to lack of time yet CertStash turned out to be an angel for me to get me through this difficult exam with distinction. GCIH exam guide from CertStash hold all the essentials
King –
I like that these GCIH practice tests are detailed. I sat for my GCIH exam and got 92% marks. This GCIH exam questions are real and valid.
Noor Herrera –
Finally passed my GCIH.
Lucy Dang –
Good resource for GCIH.
Liam Olsen –
Passed today