This course contains two testswith detailed explanations of correct answers and incorrect options to allow you to efficiently prepare for the GCIH exam.It can also be really beneficial to security managers performing technical interviews to incident handlers and SOC analysts in addition to anyone looking for a role in incident handling and wants to prepare for very demanding technical interviews.

Exam Details

Passing score: 70%

Total questions: 100-150

Duration: 4 hours

Objectives:

1. Incident Handling: Overview and Preparation

2. Incident Handling: Identification

3. Incident Handling: Containment

4. Incident Handling: Eradication, Recovery, and Lessons Learned

5. Reconnaissance

6. Scanning: Discovery and Mapping

7. Scanning: Techniques and Defense

8. Client Attacks

9. Password Attacks

10. Overflow Attacks

11. Network Attacks

12. Session Hijacking and Cache Poisoning

13. Denial of Service Attacks

14. Web Application Attacks

15. Techniques for maintaining access

16. Covering Tracks: Networks

17. Covering Tracks: Systems

18. Worms, Bots & Botnets

Recommendation

The GCIH exam includes a few questions requiring exam takers to perform specific actions to get a result. The best method to prepare for this is to create a lab that will allow you to practice any questions that have practical elements in them. Those will be explicitly noted in the questions and detailed instructions will be provided on how to get an answer using a lab. The simplest setup can include a few virtual (or physical) machines. An example collection can include:

• Machine running Kali Linux

• Machine running Metasploitable2 or Metasploitable3 (to be used as a target machine for attacks)

• Machine running Windows (any latest versions of Windows Server or personal editions that you might have licenses for)