GIAC GCIH Study Roadmap

Domain 1: Incident handling process — PICERL, IR teams, communication, triage

Domain 1: Containment & recovery — Evidence preservation, eradication, validation, lessons learned

Domain 2: Reconnaissance — OSINT detection, scanning signatures, countermeasures

Domain 3: Exploitation tools — Metasploit, exploit analysis, payload detection

Domain 3: Malware — Trojans, rootkits, ransomware, fileless malware, LOTL techniques

Domain 4: Network attacks — ARP spoofing, DNS poisoning, session hijacking, MITM

Domain 4: DoS/DDoS — SYN floods, amplification attacks, mitigation strategies

Domain 5: Password attacks — Brute force, spraying, hash cracking, Kerberoasting

Domain 6: Web attacks — SQLi, XSS, command injection, web shell detection

Index Building: Create open-book index for exam day, organize notes by topic

Full Review: Practice exams, Weak areas, Index refinement

Final Review: Timed practice exams, Exam logistics, Last-minute review