The Altered Security Certified Red Team Professional (CRTP) exam tests whether you can operate in a Windows Active Directory environment with confidence, not whether you can memorize a long list of tools. That is why many candidates feel unsure near the end of their prep. They may know the course material, but they are not sure if they can apply it under time pressure. This checklist is meant to fix that. It will help you judge if you are actually ready, where your weak spots are, and how to spend the final week before the exam in a way that improves performance instead of adding stress.
What exam readiness really looks like for CRTP
Being “ready” for CRTP does not mean you remember every command from your notes. It means you can move through a likely attack path in Active Directory without getting stuck on basic execution. The exam rewards method, not panic.
A ready candidate can usually do these things without heavy reference checking:
- Enumerate an Active Directory environment in a structured way. You know what to check first, what matters, and how to turn raw information into an attack plan.
- Recognize privilege escalation opportunities. You can spot misconfigurations, weak delegation, dangerous group memberships, credential exposure, and trust issues.
- Use common Windows and AD attack tools correctly. Not just one-liners copied from a cheat sheet, but with an understanding of what each command does and why.
- Work through access problems calmly. If a command fails, you can troubleshoot permissions, execution context, architecture issues, path problems, or OPSEC-related choices.
- Document findings clearly. Even in an offensive exam, your notes matter. Good notes reduce repeated work and help you recover when you lose your place.
If you still need to pause often and ask, “What should I do next?” after basic enumeration, you are not quite ready. The CRTP exam is less about isolated tricks and more about chaining actions together.
Core skills you should verify before booking or sitting the exam
Use this section as a true pre-exam checklist. If one of these areas feels shaky, that is a sign to focus your revision there.
- Active Directory basics. You should understand domains, forests, trusts, users, groups, OUs, ACLs, Kerberos, SPNs, delegation, and common privilege boundaries. This matters because many attack paths only make sense if you understand how AD is structured.
- Windows privilege context. You should know the difference between local admin, domain user, service account, and domain admin rights. Many candidates fail not because they lack a tool, but because they misunderstand what their current access actually allows.
- Host and domain enumeration. You should be able to gather information from the current host, identify logged-in users, inspect group memberships, locate interesting shares, and map out high-value systems. Enumeration drives everything that follows.
- PowerShell and command-line comfort. You do not need to be a developer, but you should be comfortable running, editing, and troubleshooting commands in Windows environments. If small syntax issues slow you down, exam pressure will make that worse.
- Credential abuse techniques. You should be able to identify where credentials may be exposed and understand common methods for using them safely and effectively. This includes password reuse, service account abuse, and token or ticket-related opportunities.
- Kerberos attack concepts. You should know when and why techniques like Kerberoasting matter, what signals to look for, and how to follow up when you obtain useful material. Kerberos is not just a topic area. It is often central to progress.
- Lateral movement logic. You should know how to decide where to pivot and why. Jumping randomly between hosts wastes time. A good operator moves based on user context, admin rights, sessions, and target value.
- Privilege escalation in AD. You should be able to identify dangerous permissions, over-privileged accounts, and delegation issues that can move you closer to high-value access.
- Tool discipline. You should know the tools taught in the CRTP path well enough to use them with purpose. Tool switching every time something fails is usually a sign of weak understanding.
Topic areas that deserve a final pass
In the last stage of revision, focus on topics that often cause hesitation. These are the areas where candidates commonly know “about” the concept but cannot execute fast enough in the exam.
- AD enumeration workflow. Can you start from limited access and build a useful map of users, systems, privileges, and possible attack routes?
- Kerberos-focused attacks. Can you identify roastable accounts, understand ticket abuse in context, and decide whether a result is worth pursuing?
- Delegation abuse. This topic often confuses candidates because the theory feels abstract until you see it in practice. Make sure you understand what the misconfiguration allows and what prerequisites you need.
- ACL abuse and object control. If you find that an account can modify another object, do you know how to turn that into advantage? This is a common gap between theory and application.
- Trust relationships. If the environment includes trusts, can you read the relationship correctly and understand what it changes operationally?
- Session hunting and privilege targeting. Do you know how to identify where privileged users have active sessions and why that matters for movement?
- Post-exploitation note-taking. This sounds basic, but it matters. You should be able to track credentials, rights, hosts, and next steps cleanly. Messy notes create duplicate work and missed paths.
Red flags that mean you need more practice
Many candidates ask if they should just “go for it.” A better question is whether they are still making the kind of mistakes that the exam will punish. These are common warning signs.
- You rely on copy-paste without understanding. If a command fails and you cannot explain why, you need more hands-on repetition.
- You forget what your current access level is. This causes bad decisions. You try actions that your context does not support, then waste time debugging the wrong problem.
- You enumerate too little or too late. Candidates sometimes rush into exploitation because it feels productive. In AD, poor enumeration usually creates dead ends.
- You miss easy privilege clues. For example, you overlook group memberships, local admin rights, writable shares, or service account exposure.
- You cannot explain your attack path. If someone asked why you moved from Host A to Host B, your answer should be specific. “I was trying things” is not enough.
- You keep repeating the same mistakes in labs. Repeated errors matter more than one bad day. They show a process problem, not a memory problem.
- You have never done a timed practice run. Knowledge changes under pressure. If you have only practiced with unlimited time, your readiness is still untested.
How to use timed practice sets the right way
Timed practice is not only about speed. It teaches pacing, focus, and recovery. That is why it should be part of your final review.
Use practice in blocks, not endless sessions. For example:
- Set a fixed objective. Example: complete initial enumeration and identify three viable attack paths in 45 minutes.
- Work without notes for the first pass. This shows what you truly know.
- Review only after the timer ends. If you look up every small issue immediately, you are training dependence, not recall.
- Track stalls. Write down where you lost time. Was it syntax, decision-making, tool selection, or lack of understanding?
- Repeat weak segments. Do not always restart from the beginning. If ACL abuse or delegation slows you down, isolate that skill and drill it directly.
A good timed set should leave you with two outputs: your technical result and your process mistakes. Both matter. A candidate who gets the answer slowly and chaotically is still at risk in the exam.
A practical 7-day final review plan
The last week should sharpen your judgment, not flood you with new material. Keep the plan realistic.
- Day 7: Full readiness check. Review the full exam blueprint from memory. List every major topic and rate your confidence as strong, usable, or weak. Be honest. This becomes your study map.
- Day 6: AD enumeration day. Practice host and domain enumeration from a low-privileged position. Focus on speed, note quality, and identifying attack paths.
- Day 5: Kerberos and credential abuse day. Revisit roastable accounts, ticket-related logic, credential usage, and follow-on actions. The goal is not just running commands, but knowing when the technique is worth using.
- Day 4: Privilege escalation day. Focus on ACLs, delegation, misconfigurations, and rights abuse. Try to explain each path out loud in simple terms. If you cannot explain it simply, your understanding is still shallow.
- Day 3: Lateral movement and chaining day. Practice moving from one foothold to the next with a reason for each step. Build a full chain from initial access to high-value access.
- Day 2: Timed mini-mock. Simulate pressure. Work within a strict time box. Afterward, review where you stalled and tighten your checklist.
- Day 1: Light review only. Read your notes, your common mistakes list, and your command references. Do not start difficult new labs. Protect your energy and sleep.
Exam-day checklist: sleep, time management, and review discipline
Some candidates lose points before the exam even starts. They stay up late, panic-review, or begin with no time plan. Treat exam-day performance as part of your technical preparation.
- Sleep enough the night before. Fatigue reduces pattern recognition and increases careless mistakes. AD exams require judgment, not just effort.
- Start with a rough time plan. Decide how long you will spend on initial enumeration, first attack path validation, and deeper exploitation before reassessing.
- Do not stay stuck too long. If a path is not progressing, document it, mark what blocked you, and move to the next lead. The exam rewards breadth of thought and smart persistence.
- Keep notes live and organized. Track hosts, users, rights, credentials, and confirmed findings as you go. This reduces confusion later.
- Review assumptions. Before you blame a tool, check your current user context, privileges, hostname, domain, and exact syntax.
- Use a calm review loop. Every so often, pause and ask: What do I know? What access do I have? What are the best next two options? This prevents random action.
A simple final readiness checklist
Before the exam, you should be able to answer yes to most of these:
- I can enumerate an AD environment from low privilege without guesswork.
- I can identify at least two or three realistic privilege escalation paths from gathered data.
- I understand Kerberos-related attacks well enough to use them in context.
- I can explain delegation and ACL abuse in simple words and execute the related steps.
- I know how to decide where to move laterally and why.
- I keep clear notes during practice and can recover quickly after a mistake.
- I have done timed practice and know where I tend to lose time.
- I am no longer making the same avoidable mistakes in repeated labs.
If several of these are still “no,” delay the exam if you can. More importantly, fix the exact gaps instead of studying everything again from the start.
FAQ
What if my practice scores are low, but I understand the material?
Low scores matter if they reflect execution problems. In CRTP, understanding without usable speed is risky. Look at why the score is low. If you know what to do but lose time to syntax, poor notes, or bad sequencing, that can be fixed. If you still cannot identify the right path, your understanding is not exam-ready yet.
I keep making repeated mistakes. What should I do?
Make a mistake log. Keep it short and specific. For example: “Forgot to check group memberships early,” or “Misread current user context before attempting lateral movement.” Review that list before every practice session. Repeated mistakes often stop when you build a deliberate pre-action checklist.
Should I do heavy practice in the final week?
Yes, but not endless practice. Use focused sessions with clear objectives. The final week should strengthen known skills and improve decision-making under time pressure. It is not the time to chase every advanced edge case.
What if I feel ready in some areas and weak in others?
That is normal. Few candidates feel equally strong everywhere. The key is whether your weak areas are central to likely exam paths. If your weak spots include AD enumeration, privilege escalation logic, or Kerberos fundamentals, they need attention now. If the weakness is a narrower topic, structured review may be enough.
Should I take a final practice test before the exam?
Yes, if you use it correctly. A final practice test is useful when it is timed, reviewed carefully, and used to find process errors. If you want a focused last check, try this CRTP practice test near the end of your revision and use the results to tighten your final checklist.
Final thought
CRTP readiness is not about feeling perfect. It is about being reliable. Can you enumerate well, think clearly, spot realistic attack paths, and recover when something fails? That is the standard to aim for. If your final review improves those abilities, you are using your time well. If it only adds more notes and more anxiety, change your approach. In the last stretch, sharp process beats more material.
