Study Guide preview
Unlock Pro for every GIAC GCIH flashcard-note lesson.
Preview the beginning of Section 1. Pro includes the complete Study Guide by section, plus Course Notes, guided course access, and Pro downloads.
Unlock with Pro
Opens the GIAC GCIH Practice Test purchase options.
Section 1
Incident Response and Cyber Investigation
Preview
Preview: Incident Response and Cyber Investigations
Preview includes- 4 of 5 lesson topics
- 1 overview segment
- 3 core concepts
- 2 exam tips
Lesson Topics
- PICERL lifecycle
- DAIR non-linear response
- Evidence-driven scoping
- Risk-based containment
Overview
GCIH expects you to manage an incident while the facts are still changing.
Core Concepts
- PICERL: Preparation establishes authority, contacts, tooling, logging, playbooks, communications, and readiness; Identification verifies that an event is an incident; Containment limits attacker capability; Eradication removes malicious artifacts/persistence/compromised access; Recovery restores dependable operations; Lessons Learned feeds detections, controls, and process improvements back into preparation.
- DAIR is intentionally non-linear. New evidence found during containment or eradication can expand scope and send the responder back to additional collection or containment.
- Validated evidence and mission/business impact drive priorities. A more destructive control is not automatically the better control.
Exam Tips
- Ask: What is validated? What can still happen? What action stops that path? What evidence will the action destroy? What operational impact will it create?
- When two answers are technically possible, prefer the one that is evidence-driven, proportionate, and defensible.
Section 1 continues in Pro.Unlock Pro to read the full Incident Response and Cyber Investigation lesson plus every remaining GIAC GCIH Study Guide section.
Unlock with Pro
Section 2
Network and Log Investigations
Pro
Network and Log Investigations unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 3
Malware and AI Assisted Investigations
Pro
Malware and AI Assisted Investigations unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 4
Scanning and Mapping
Pro
Scanning and Mapping unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 5
SMB Security
Pro
SMB Security unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 7
Understanding Passwords
Pro
Understanding Passwords unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 8
Attacking Passwords
Pro
Attacking Passwords unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 9
Securing Credentials and Data in the Cloud
Pro
Securing Credentials and Data in the Cloud unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 10
Exploiting Insecure Web Application References
Pro
Exploiting Insecure Web Application References unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 11
Web Application Injection Attacks
Pro
Web Application Injection Attacks unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 12
Web Application API Attacks
Pro
Web Application API Attacks unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 13
Detecting Evasive and Post-Exploitation Techniques
Pro
Detecting Evasive and Post-Exploitation Techniques unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 14
Endpoint Attack and Pivoting
Pro
Endpoint Attack and Pivoting unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 15
Integrating LLMs with Offensive Operations
Pro
Integrating LLMs with Offensive Operations unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro