GIAC GCIH Study Roadmap

Domain 1: Incident handling process (PICERL, IR teams, communication, triage)

Domain 1: Containment & recovery (Evidence preservation, eradication, validation, lessons learned)

Domain 2: Reconnaissance (OSINT detection, scanning signatures, countermeasures)

Domain 3: Exploitation tools (Metasploit, exploit analysis, payload detection)

Domain 3: Malware (Trojans, rootkits, ransomware, fileless malware, LOTL techniques)

Domain 4: Network attacks (ARP spoofing, DNS poisoning, session hijacking, MITM)

Domain 4: DoS/DDoS (SYN floods, amplification attacks, mitigation strategies)

Domain 5: Password attacks (Brute force, spraying, hash cracking, Kerberoasting)

Domain 6: Web attacks (SQLi, XSS, command injection, web shell detection)

Index Building: Create open-book index for exam day, organize notes by topic

Full Review: Practice exams, Weak areas, Index refinement

Final Review: Timed practice exams, Exam logistics, Last-minute review