The Altered Security Certified Red Team Professional (CRTP) exam is not just a checklist of tools or commands. It tests whether you can work through a realistic Active Directory attack path, think like an operator, and move from low privilege to meaningful control. That is why many candidates feel stuck when they ask, “What exactly should I study?” The right answer is not a random list of techniques. You need a domain-based plan: what to understand, what to memorize, what to practice hands-on, and what to review in the final stretch. This guide breaks the CRTP knowledge areas into practical study blocks so you can turn the syllabus into action.
What CRTP is really testing
CRTP is centered on attacking and abusing Active Directory in an operator-driven way. That means the exam expects more than theory. You need to recognize attack paths, choose the right technique for the situation, and work carefully inside a Windows domain environment.
At a high level, most candidates need to be ready for these major areas:
- Active Directory fundamentals
- Enumeration and situational awareness
- Credential abuse and privilege escalation
- Lateral movement
- Domain persistence and control
- Command and control workflow
- Basic cloud and hybrid identity awareness
- Documentation, notes, and reporting discipline
The exact exam path can vary, but these categories keep showing up because they reflect how real AD attacks work. You rarely win by one trick. You win by chaining small findings into a larger path.
Active Directory fundamentals: the base layer you cannot skip
This is the domain many people rush through, and it often becomes their weak point later. If you do not understand how Active Directory is structured, advanced techniques feel like memorized magic. That breaks down under exam pressure.
You should be comfortable with:
- Domains, forests, trusts, and organizational units
- Users, groups, computers, service accounts, and group policy
- Kerberos and NTLM at a practical level
- Authentication vs authorization
- Privileged groups and delegated rights
- How AD objects relate to attack surface
Why this matters: most privilege escalation in AD is really an abuse of relationships. For example, if one account can modify another object, reset a password, write to a service principal name, or manage group membership, that can become a full attack path. If you only memorize the exploit command and do not understand the underlying permission, you will miss alternate routes.
Study advice:
- Learn the common privileged groups and what they actually allow.
- Understand Kerberos terms like TGT, TGS, SPN, delegation, and ticket reuse.
- Practice reading AD object relationships as a graph, not as isolated entries.
This is partly a memorization domain, but mostly a comprehension domain. You do need to know terminology, but the goal is to explain why a permission or object matters.
Enumeration: finding the path before you touch it
Good CRTP performance depends on clean enumeration. In many AD labs, the attack path is visible if your enumeration is complete and organized. Candidates often fail not because they lack the exploit, but because they missed a clue early on.
Focus on these enumeration goals:
- Identify domain structure and trust relationships
- Map users, groups, computers, sessions, and shares
- Find service accounts, SPNs, and delegation settings
- Spot local admin rights, logged-on users, and remote access options
- Identify weak ACLs and object control paths
- Collect host-level context without making noise or losing track
Why this matters: enumeration drives decision-making. For example, if you see that a user is local admin on one server and that server has a privileged session, your next move changes. If you find a service account with an SPN, Kerberoasting may be worth trying. If you find write access over a user object, that can be stronger than password spraying.
Study advice:
- Practice enum in stages: domain-wide, host-level, user-focused, privilege-focused.
- Write down findings in a simple structure: asset, access, relevance, next action.
- Train yourself to stop and ask, “What does this finding enable?”
This is mostly scenario-based. Memorization helps with tool syntax, but success depends on interpretation.
Credential abuse and privilege escalation: the heart of AD attacks
This is one of the most important CRTP domains. You need to know how credentials appear, how they can be abused, and how privilege escalation happens through both misconfigurations and intended AD features.
Core topics to study include:
- Password attacks and account targeting
- Kerberoasting and AS-REP roasting
- Token and ticket abuse concepts
- ACL abuse and object control
- Local privilege escalation on Windows hosts
- Delegation abuse concepts
- Credential dumping awareness and safe handling of obtained secrets
Why this matters: CRTP paths often reward the candidate who understands which escalation route is lowest risk and most direct. A weak ACL on a user account may be more useful than a noisy host action. A service ticket path may be more reliable than trying broad authentication attacks.
What to memorize here:
- Common attack preconditions.
- What each technique targets.
- Key Kerberos and ACL terms.
- Common rights such as GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword.
What to practice as scenarios:
- Choosing between multiple escalation routes.
- Abusing an object control path from one user to another.
- Pivoting from a host compromise to domain-level impact.
Lateral movement: turning one foothold into broader access
Lateral movement is not just about remote execution. It is about using the access you have in the cleanest possible way to reach systems that matter. In CRTP-style workflows, that often means moving from a low-value machine to one holding better sessions, better privileges, or stronger trust relationships.
You should review:
- Common remote access methods in Windows environments
- Pass-the-hash and pass-the-ticket concepts
- Session hunting and identifying where privileged users are active
- Using local admin rights effectively
- Operational tradeoffs between movement methods
Why this matters: many candidates know several movement techniques but do not know when to use each one. For example, if you have local admin on a host but no clear reason to touch another system yet, moving too early may waste time. If you know a privileged account is active on a target, the move has a purpose.
Study advice:
- Practice building a “why this host” habit before each move.
- Tie every lateral action to a specific goal: credentials, sessions, data, or privilege.
- Review what artifacts different methods may leave, even if the exam is not heavily defense-focused.
This is strongly scenario-based. Tool syntax matters, but movement decisions matter more.
C2 operations: enough to stay effective, not flashy
CRTP is not mainly a C2 branding exam, but operator workflow still matters. You should be able to manage sessions, run post-exploitation steps in an orderly way, and avoid getting lost across multiple hosts and credentials.
Useful areas to review:
- Session management
- Loading and running post-exploitation tooling carefully
- Credential tracking and host tracking
- Privilege context awareness
- Basic OPSEC judgment
Why this matters: a surprising amount of exam time can be lost because of weak note-taking, confusion about which session belongs to which user, or rerunning the same enum on the same host. Good operators reduce their own mistakes.
Study advice:
- Use a simple notes template for every host and every identity.
- Record how you got access, what privilege you have, and what the next likely path is.
- Practice working across several compromised systems without losing the thread.
This is a workflow domain. It is less about memorizing content and more about building repeatable habits.
Cloud and hybrid identity: what to know without overstudying
Some CRTP candidates overcommit to Azure and cloud attack paths because they expect a broad red team exam. In reality, your main focus should still be Active Directory and operator fundamentals. But cloud and hybrid identity awareness matters because many modern environments connect on-prem AD with Azure identity.
That means you should understand:
- The difference between on-prem AD and Azure AD / Entra ID concepts
- How identity sync can affect attack surface
- Why hybrid accounts and permissions matter
- Basic cloud privilege relationships at a conceptual level
Why this matters: even if cloud exploitation is not the core of your exam path, hybrid identity changes how privileges can spread. An operator-level candidate should understand that identities do not stop at the domain boundary anymore.
Keep this domain light but clear. Do not let it steal time from AD abuse, lateral movement, and privilege escalation.
Reporting and documentation: the domain people ignore until it hurts
Even hands-on exams reward structured thinking. Clear notes help you finish the exam. Clear reporting helps you present the path logically. This matters because red team work is not just getting access. It is showing how access was obtained and why it matters.
Review these habits:
- Track initial access, pivots, escalations, and final impact
- Save proof of access in a consistent way
- Note failed paths so you do not repeat them
- Write short evidence-based explanations for each step
Why this matters: if you reach domain admin but cannot explain the chain cleanly, you lose value. The discipline of writing also improves your technical choices during the exam because it forces you to think in steps.
How to separate memorization topics from scenario-based topics
A smart CRTP study plan does not treat every topic the same way. Some items need fast recall. Others need repeated lab time.
Mostly memorization topics:
- AD and Kerberos terminology
- Privileged groups and common rights
- Attack prerequisites
- Tool syntax patterns and common command options
- Typical meanings of ACL abuse permissions
Mostly scenario-based topics:
- Choosing the next enumeration step
- Identifying the strongest attack path from noisy data
- Moving laterally with purpose
- Combining host findings with domain findings
- Recovering when one escalation path fails
A good rule is simple: if the topic answers “what is this?” it leans toward memorization. If it answers “what should I do next?” it needs scenario practice.
Recommended review order before practice tests
If your preparation feels scattered, use this order:
- 1. AD fundamentals — Build the mental model first.
- 2. Enumeration — Learn how to discover useful relationships.
- 3. Credential attacks and privilege escalation — Turn findings into leverage.
- 4. Lateral movement — Expand control with purpose.
- 5. C2 workflow and notes discipline — Improve reliability and speed.
- 6. Reporting and evidence handling — Make your work explainable.
- 7. Cloud and hybrid review — Fill conceptual gaps without losing focus.
This order works because each stage depends on the one before it. You cannot lateral move well if your enumeration is weak. You cannot escalate reliably if your AD basics are shaky.
How to convert each domain into practice sessions
Do not study CRTP only by reading notes. Convert every domain into a small drill with a clear outcome.
Here is one simple structure:
- AD fundamentals session: explain a trust, group, or Kerberos concept out loud in plain English.
- Enumeration session: start with one foothold and produce a written map of users, groups, hosts, sessions, and possible next targets.
- Privilege escalation session: take one discovered misconfiguration and list three ways it could be abused or validated.
- Lateral movement session: justify one movement step based on access and objective, not just tool availability.
- C2 session: manage multiple hosts and identities while keeping clean notes.
- Reporting session: write a short chain-of-compromise summary from memory after a lab.
If you want to test readiness under question-driven conditions, use a focused practice resource and compare your weak areas to your lab notes. A useful starting point is this CRTP practice test, especially if you need to find gaps before your final review cycle.
The key is not doing more sessions. It is making each session answer one question: What skill did I prove today?
How to track weak areas without guessing
Many candidates say, “I think lateral movement is my weakness,” when the real problem is earlier. Often the true issue is missing enumeration or poor understanding of AD permissions.
Use a simple weakness tracker with three columns:
- Topic
- What went wrong
- Fix action
Example:
- Topic: ACL abuse
- What went wrong: Found object control but did not know which right mattered
- Fix action: Review common AD rights and run two ACL abuse labs this week
This matters because weak areas are often skill-chain problems, not isolated facts. If you repeatedly choose poor targets, the issue may be attack-path reasoning, not command syntax.
Mini FAQ
Are all domains weighted equally?
No exam feels perfectly equal in practice. Active Directory fundamentals, enumeration, privilege escalation, and lateral movement usually carry the most practical value because they drive the attack chain.
Should beginners study Azure deeply for CRTP?
No. Learn hybrid identity concepts and cloud basics, but keep your main effort on AD, Kerberos, enumeration, and host-to-domain attack flow.
What should I review in the last few days?
Review your notes on AD object control, Kerberos abuse concepts, common escalation paths, lateral movement options, and mistakes you made in labs. Final review should be about pattern recognition, not new material.
How do I know if I am ready for practice tests?
You are ready when you can explain why a technique works, not just run it. If you can turn a foothold into a reasoned attack plan on paper, practice tests will be useful.
What is the biggest study mistake?
Treating CRTP like a tool exam. It is better to know fewer techniques deeply and understand when to use them than to memorize a long command list without context.
Final takeaway
The best way to prepare for CRTP is to stop thinking in terms of “topics to cram” and start thinking in terms of operator decisions. Learn the AD structure. Enumerate carefully. Understand why credentials and permissions matter. Move laterally for a reason. Keep disciplined notes. Then turn each domain into repeatable practice. If you study this way, the exam stops looking like a pile of tricks and starts looking like what it really is: a chain of solvable problems.
