GCIH certification: cost, exam format and training

What is the GCIH certification?

The GIAC Certified Incident Handler (GCIH) certification shows, in GIAC’s words, readiness to manage real threats from detection to remediation: effective incident handling skills and insight into the techniques attackers use. The GIAC GCIH certification is a practitioner credential, focused on what a responder does during an incident rather than on management.

GIAC lists who the GCIH cert is for: incident handlers and incident handling team leads, system administrators, security practitioners, security architects and any security personnel who act as first responders. GIAC lists no prerequisites, so you can register for an attempt without an earlier certification.

Source: GIAC — GIAC Certified Incident Handler (GCIH). Checked 10 October 2026.

GCIH certification cost

GIAC prices the GCIH certification attempt at US$999 when you buy it on its own. That attempt gives you access for 120 days from activation. If you buy the attempt together with SANS training, GIAC calls it an affiliate bundle and refers to SANS’s own pricing; GIAC does not show a bundle price on its pricing page.

Everything else is priced per item. A GCIH practice test costs US$399, an exam retake US$899 and an attempt extension US$479. If you miss a proctored appointment, GIAC charges a US$175 reseating fee and adds a seven-day extension. Renewal every four years costs US$499, or US$249 for additional renewals within two years of a full-price renewal.

So the GCIH cert cost for a first-time pass is the US$999 attempt, plus whatever training and practice tests you choose. GIAC does not separate exam and certification fees: the attempt is the certification fee.

• Certification attempt: US$999
• Exam retake: US$899
• Attempt extension: US$479
• Practice test: US$399
• Missed proctored appointment: US$175 reseating fee
• Renewal: US$499 (US$249 for additional renewals within two years)

Source: GIAC — Certification pricing and fees. Checked 10 October 2026.

GCIH exam format and passing score

The GCIH exam is one proctored exam with 106 questions and a 4-hour limit — about 2 minutes 15 seconds per question. The minimum passing score is 69%. GIAC set that figure through a psychometric standard-setting study, and it applies to exam versions released on or after 10 May 2025.

GIAC’s GCIH page also has a section on CyberLive, GIAC’s hands-on format that uses virtual machines, real security tools and authentic code instead of traditional multiple-choice items. GIAC does not state on the page how many CyberLive tasks appear in a GCIH exam, so prepare to work in a live environment as well as answer questions.

You can sit the exam remotely with ProctorU or on site at a Pearson VUE test centre. GIAC notes that both options may not be available for every attempt, so check when you schedule.

Source: GIAC — GIAC Certified Incident Handler (GCIH). Checked 10 October 2026.

Is the GCIH exam open book?

Yes, for paper. GIAC states that its exams are open book: printed books, notes and study guides are allowed, but no digital items. GIAC exams are not open internet or open computer, so you cannot open stored PDFs or documents, and phones, tablets, second computers and smart watches are prohibited. Printed material that looks like practice or exam questions with answers is banned.

GIAC recommends building an index — a systematic, colour-coded guide you create yourself — to find material quickly during the exam. GIAC’s point is that making the index is part of learning the material; borrowing someone else’s defeats the purpose.

Source: GIAC — Proctor program overview. Checked 10 October 2026.

What is on the GCIH exam? The certification objectives

GIAC publishes the GCIH exam certification objectives as 15 outcome areas. They are the closest thing to a GCIH syllabus. GIAC gives no weighting for them, so treat them as equally important.

The spread is broad: incident response and investigation, attacker reconnaissance, password attacks, exploitation and post-exploitation, web application attacks, cloud credentials and newer topics such as AI-assisted investigations and the use of LLMs in offensive operations.

• Incident Response and Cyber Investigation
• Network and Log Investigations
• Malware and AI Assisted Investigations
• Scanning and Mapping
• Understanding Passwords
• Attacking Passwords
• SMB Security
• Endpoint Attack and Pivoting
• Detecting Exploitation and Covert Communications Tools
• Detecting Evasive and Post-Exploitation Techniques
• Web Application Injection Attacks
• Exploiting Insecure Web Application References
• Web Application API Attacks
• Securing Credentials and Data in the Cloud
• Integrating LLMs with Offensive Operations

Source: GIAC — GIAC Certified Incident Handler (GCIH). Checked 10 October 2026.

GCIH training: the SANS GCIH course

GIAC is affiliated with SANS, and the GCIH page links to SANS training in live and OnDemand formats. The SANS GCIH course is SEC504: Hacker Tools, Techniques, and Incident Handling, which SANS lists as aligned with the GIAC Certified Incident Handler certification.

SANS runs SEC504 as a six-day instructor-led class, in person or virtual, or as 38 hours of self-paced OnDemand study over four months; both carry 38 CPEs. SANS lists the OnDemand version at US$8,780; live classes are priced per event.

GCIH training is not required. GIAC lists no prerequisites, so you can buy a standalone attempt and prepare with any GCIH course or self-study you choose — check it against the 15 objectives above.

Source: SANS Institute — SEC504: Hacker Tools, Techniques, and Incident Handling. Checked 10 October 2026.

GCIH practice tests, sample questions and exam questions

GIAC sells a GCIH practice test for US$399. GIAC says practice exams simulate the real exam so you can get used to the test engine and question style, that the question bank is limited so you may see repeats across practice tests, and that practice exams never include actual exam questions. GIAC recommends taking one after your first full pass through the material and another when you feel ready.

GIAC lists no free demo questions for GCIH — its pricing table shows “N/A” for them. So if you search for GCIH sample questions, there is no official free set; the paid GCIH practice exam is GIAC’s own source of practice questions.

GCIH exam questions from the live exam are protected. GIAC’s Exam Integrity Policy prohibits copying, disclosing, sharing, selling or posting exam content, and names the use of exam dump sites with actual or possible GIAC questions as a violation. Sanctions include revocation of certifications already issued and bans from future GIAC certifications.

Source: GIAC — Exam integrity policy. Checked 10 October 2026.

GCIH renewal

A GCIH certificate stays active for four years. To renew, GIAC asks you to collect 36 credits over the four-year cycle and pay the US$499 renewal fee. Credits can come from graduate courses, other information security training, community participation, field work experience and ISO 17024-accredited certifications and affiliated training.

Source: GIAC — Certification renewal. Checked 10 October 2026.

Is GCIH worth it?

GIAC publishes no salary figures for GCIH holders on its GCIH page, and this page does not quote anyone else’s. What you can weigh is the scope and the cost: an incident handling credential with no prerequisites, US$999 for an attempt, optional training that is a significant expense of its own, and renewal every four years.

It fits best if you are, or want to be, the person who responds when something goes wrong — the roles GIAC itself lists, from incident handlers to first-responding administrators.

Source: GIAC — GIAC Certified Incident Handler (GCIH). Checked 10 October 2026.

GCIH practice questions

Certsqill’s GCIH practice questions are expert-developed: every question explains each answer option, and a readiness score across the GCIH objectives shows which areas still need work before you spend a US$999 attempt.

GCIH questions people ask

What is the GCIH certification?

The GIAC Certified Incident Handler, GIAC’s certification for incident handlers and first responders. GIAC lists no prerequisites. Source: GIAC, checked 10 October 2026.

How much does the GCIH certification cost?

US$999 for a standalone certification attempt; a retake costs US$899 and a practice test US$399. Source: GIAC pricing, checked 10 October 2026.

How many questions are on the GCIH exam?

106 questions in one proctored exam with a 4-hour limit. Source: GIAC GCIH page, checked 10 October 2026.

What is the GCIH passing score?

69% for exam versions released on or after 10 May 2025. Source: GIAC GCIH page, checked 10 October 2026.

Is the GCIH exam open book?

Yes, for printed books and notes; no digital material, internet or stored files. Source: GIAC proctor program overview, checked 10 October 2026.

How long do I have to take the GCIH exam?

120 days from activation for a standalone attempt; extensions cost US$479. Source: GIAC, checked 10 October 2026.

Which SANS course prepares for GCIH?

SEC504: Hacker Tools, Techniques, and Incident Handling — six days instructor-led or 38 hours self-paced. Source: SANS Institute, checked 10 October 2026.

How do I renew GCIH?

Collect 36 credits over four years and pay the US$499 renewal fee. Source: GIAC, checked 10 October 2026.

Is GCIH worth it?

GIAC publishes no salary data. It is most useful if incident response is your job or your next step; weigh that against the US$999 attempt and optional training costs.