GIAC Certification Cheat Sheet 2026

The 30 highest-yield GIAC Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the TCP three-way handshake, which flag combination correctly describes the second packet sent by the server? → SYN + ACK
2. What does 'dwell time' measure in the context of incident response metrics? → The duration between initial compromise and detection by the organization
3. In role-based access control (RBAC), permissions are assigned to which entity? → Roles, which are then assigned to users
4. In a packet header, a TTL value of 127 arriving at a destination suggests the packet most likely originated from: → A Windows system (default TTL 128, decremented once in transit)
5. Which Windows feature uses hardware-based TPM to encrypt the entire OS volume and protect against offline attacks? → BitLocker Drive Encryption
6. Which Snort preprocessor is responsible for normalizing and tracking TCP session state to prevent stream-based evasion techniques? → stream5 (Stream5 preprocessor)
7. Which Kerberos ticket is issued first and used to obtain service tickets? → Ticket Granting Ticket (TGT)
8. An organization discovers that an attacker has been present in their network for 6 months. What term describes this type of intrusion? → Advanced Persistent Threat (APT)
9. A threat actor uses 'living-off-the-land' techniques. Which of the following BEST describes this approach? → Abusing legitimate system tools like PowerShell and WMI to execute malicious actions
10. An analyst uses 'tcpdump -r capture.pcap -n tcp and port 443' to filter a pcap. What does the '-n' flag do? → Disables DNS resolution so IP addresses are displayed numerically
11. Which of the following best describes the purpose of 'threshold' in a Snort rule? → To limit alert frequency so a single event does not flood logs
12. During incident response, which phase involves containing the threat to prevent further damage? → Containment
13. A penetration tester discovers a web application reflects user input directly in the page response. Which vulnerability class does this most likely represent? → Cross-Site Scripting (XSS)
14. A packet capture shows many TCP RST packets being sent immediately after SYN packets to various ports on a host. This pattern most likely indicates: → A TCP SYN scan (nmap -sS)
15. An attacker sends a crafted TCP packet with both SYN and FIN flags set. What is the likely purpose? → OS fingerprinting or firewall evasion
16. What does the Snort rule option 'content:"GET"; depth:4;' do? → Matches 'GET' only within the first 4 bytes of the payload
17. A forensic analyst examines a Linux system and finds a file with permissions '-rwsr-xr-x' owned by root. Why is this security-relevant during an investigation? → The SUID bit causes the file to execute with root privileges regardless of who runs it
18. During containment of a ransomware incident, which action should be performed FIRST? → Isolate affected systems from the network while preserving evidence
19. Which Snort rule keyword instructs Snort to match traffic flowing FROM the server BACK to the client, regardless of port numbers defined in the rule header? → flow:from_server,established
20. An organization wants to ensure that no single employee can complete a sensitive financial transaction alone. Which security principle does this implement? → Separation of duties
21. During an investigation, an analyst finds that a host issued a DNS query for 'wpad.domain.local'. What attack does this behavior enable? → WPAD hijacking (Web Proxy Auto-Discovery spoofing for MITM)
22. During a forensic investigation, an analyst finds evidence of a Golden Ticket attack. Which component was most likely compromised to enable this attack? → KRBTGT account password hash
23. What distinguishes a 'beaconing' behavior pattern in network traffic that would indicate C2 communication? → Periodic outbound connections at regular intervals to the same destination
24. A security analyst observes DNS queries for randomly generated domain names at high frequency. Which malware behavior does this indicate? → Domain generation algorithm (DGA) for C2 communication
25. In the context of PKI, what does a Certificate Revocation List (CRL) contain? → Serial numbers of certificates that have been revoked before expiration
26. What is the main risk of using ECB (Electronic Codebook) mode for block cipher encryption? → Identical plaintext blocks produce identical ciphertext blocks, revealing patterns
27. Which hashing algorithm produces a 256-bit digest and is part of the SHA-2 family? → SHA-256
28. A web server log shows the following entry: GET /page.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1. What attack is being attempted? → SQL injection
29. Which type of malware disguises itself as legitimate software but contains hidden malicious functionality? → Trojan horse
30. Which IDS detection method identifies attacks by comparing traffic to known attack signatures? → Signature-based detection