GIAC Certification Study Guide 2026
Everything you need to pass the GIAC Certification exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 GIAC Certification Exam Format at a Glance
📚 GIAC Certification Topics to Study (12)
✍️ Sample GIAC Certification Questions & Answers
1. What distinguishes a 'beaconing' behavior pattern in network traffic that would indicate C2 communication?
C2 beaconing is characterized by regular, periodic outbound connections (e.g., every 60 seconds) that indicate malware checking in with its command-and-control server.
2. An analyst observes DNS queries for very long, random-looking subdomains such as 'aGVsbG8gd29ybGQ.evil.com'. What attack technique does this most likely represent?
DNS tunneling encodes data (often base64) into subdomain labels to exfiltrate information through DNS queries, which frequently bypass egress firewalls.
3. Which protocol does IPsec use in Transport Mode to provide data integrity and authentication without encryption?
AH provides data integrity and origin authentication for IP packets but does not encrypt the payload; ESP provides both confidentiality and optional authentication.
4. What is the primary purpose of a DMZ (demilitarized zone) in network architecture?
A DMZ places internet-facing servers (web, mail, DNS) in a separate segment so that if they are compromised, the internal network remains protected.
5. Which access control model is commonly used in military and government systems, enforcing access based on sensitivity labels and user clearances?
MAC uses sensitivity labels (Top Secret, Secret, Confidential) and subject clearance levels enforced by the system, preventing users from overriding access rules even on their own files.
6. An analyst sees repeated outbound HTTPS connections from one workstation to the same external IP at exactly 60-second intervals. This behavior is most consistent with:
Precisely timed, regular outbound connections are a classic indicator of malware beaconing, where the implant checks in with its C2 server on a fixed schedule.