GIAC Certification Cheat Sheet 2026

The 30 highest-yield GIAC Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the TCP three-way handshake, which flag combination correctly describes the second packet sent by the server? → SYN + ACK
2. In role-based access control (RBAC), permissions are assigned to which entity? → Roles, which are then assigned to users
3. Which Kerberos ticket is issued first and used to obtain service tickets? → Ticket Granting Ticket (TGT)
4. An organization discovers that an attacker has been present in their network for 6 months. What term describes this type of intrusion? → Advanced Persistent Threat (APT)
5. A threat actor uses 'living-off-the-land' techniques. Which of the following BEST describes this approach? → Abusing legitimate system tools like PowerShell and WMI to execute malicious actions
6. An analyst uses 'tcpdump -r capture.pcap -n tcp and port 443' to filter a pcap. What does the '-n' flag do? → Disables DNS resolution so IP addresses are displayed numerically
7. Which of the following best describes the purpose of 'threshold' in a Snort rule? → To limit alert frequency so a single event does not flood logs
8. During incident response, which phase involves containing the threat to prevent further damage? → Containment
9. A penetration tester discovers a web application reflects user input directly in the page response. Which vulnerability class does this most likely represent? → Cross-Site Scripting (XSS)
10. A packet capture shows many TCP RST packets being sent immediately after SYN packets to various ports on a host. This pattern most likely indicates: → A TCP SYN scan (nmap -sS)
11. An attacker sends a crafted TCP packet with both SYN and FIN flags set. What is the likely purpose? → OS fingerprinting or firewall evasion
12. What does the Snort rule option 'content:"GET"; depth:4;' do? → Matches 'GET' only within the first 4 bytes of the payload
13. A forensic analyst examines a Linux system and finds a file with permissions '-rwsr-xr-x' owned by root. Why is this security-relevant during an investigation? → The SUID bit causes the file to execute with root privileges regardless of who runs it
14. During containment of a ransomware incident, which action should be performed FIRST? → Isolate affected systems from the network while preserving evidence
15. Which Snort rule keyword instructs Snort to match traffic flowing FROM the server BACK to the client, regardless of port numbers defined in the rule header? → flow:from_server,established
16. An organization wants to ensure that no single employee can complete a sensitive financial transaction alone. Which security principle does this implement? → Separation of duties
17. During a forensic investigation, an analyst finds evidence of a Golden Ticket attack. Which component was most likely compromised to enable this attack? → KRBTGT account password hash
18. What distinguishes a 'beaconing' behavior pattern in network traffic that would indicate C2 communication? → Periodic outbound connections at regular intervals to the same destination
19. A security analyst observes DNS queries for randomly generated domain names at high frequency. Which malware behavior does this indicate? → Domain generation algorithm (DGA) for C2 communication
20. In the context of PKI, what does a Certificate Revocation List (CRL) contain? → Serial numbers of certificates that have been revoked before expiration
21. Which hashing algorithm produces a 256-bit digest and is part of the SHA-2 family? → SHA-256
22. A web server log shows the following entry: GET /page.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1. What attack is being attempted? → SQL injection
23. Which type of malware disguises itself as legitimate software but contains hidden malicious functionality? → Trojan horse
24. Which IDS detection method identifies attacks by comparing traffic to known attack signatures? → Signature-based detection
25. When conducting network traffic analysis, which technique do attackers use to hide C2 communications within seemingly legitimate web traffic on port 80/443? → Domain fronting and HTTP/S-based C2 beaconing
26. An attacker performs DNS cache poisoning. What is the MOST likely goal of this attack? → Redirecting users to malicious servers by inserting fraudulent DNS records
27. Which NIST SP 800-61 incident response lifecycle phase directly precedes 'Containment, Eradication, and Recovery'? → Detection and Analysis
28. Which artifact would BEST help an incident responder determine the exact time a malicious executable was first run on a Windows system? → Prefetch file timestamps
29. Which Windows artifact stores evidence of USB devices that were previously connected to a system, including device serial numbers? → HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
30. During incident response, which phase involves determining the full scope and business impact of a compromise? → Identification/Scoping