GCIH: GIAC Certified Incident Handler

The GCIH covers the "process" of incident handling as well as the hands-on technical skills to detect and respond to attacks. It covers common attack techniques (exploits, pivoting, drive-by downloads) and the corresponding defensive responses, ensuring the handler understands the attacker's perspective. The exam includes "CyberLive" questions where candidates must perform tasks in a virtual machine to answer the question, validating practical skills. It is a primary certification for Incident Response (IR) team members, bridging the gap between policy (the steps of IR) and technical reality (killing the connection).