The Altered Security Certified Red Team Professional (CRTP) exam is a practical certification for people who work with Active Directory security at an operator level. It is not a broad theory test. It checks whether you can move through a Windows domain, abuse common misconfigurations, escalate privileges, and think like an attacker inside a real enterprise-style lab. This guide is for candidates who already know basic penetration testing, Windows fundamentals, and command-line work, but want a clear 30-day plan that turns scattered knowledge into exam-ready skill. The goal is simple: build repeatable habits, not just short-term memory.
Who should use this CRTP study guide
This plan fits you if you are one of the following:
- Red teamers who want stronger Active Directory tradecraft.
- Penetration testers moving from web or network testing into internal operations.
- Blue team or detection engineers who want to understand realistic AD attack paths.
- Azure and hybrid identity professionals who need stronger on-prem domain attack knowledge.
- Operators preparing for practical exams who learn best through structured repetition.
If you are brand new to Windows internals, PowerShell, or Active Directory, this guide will still help, but you may need extra time. Thirty days is enough for review and focused practice. It is usually not enough for learning every topic from zero.
What the CRTP exam is really testing
The CRTP exam is less about recalling definitions and more about chaining actions together. You need to understand how trust, privilege, delegation, credentials, and domain services interact. In practice, that means questions like these matter:
- Can you enumerate a domain in a quiet, methodical way?
- Can you identify where privilege boundaries are weak?
- Can you move from one foothold to the next without getting lost?
- Can you explain why a technique works instead of just pasting a command?
That last point is important. Candidates often fail because they memorize command syntax without understanding the underlying access model. For example, if you know what Kerberoasting does but do not understand service accounts, SPNs, and ticket abuse, you will struggle when the environment is slightly different from your notes.
Prerequisite knowledge and tools
Before starting a 30-day sprint, check your baseline. You do not need to be an expert in everything below, but you should be comfortable enough that the terms are familiar and the tools do not slow you down.
Knowledge you should have:
- Basic Windows administration: users, groups, services, shares, scheduled tasks, RDP, WinRM.
- Core Active Directory concepts: domain, forest, OU, GPO, trusts, Kerberos, LDAP, ACLs.
- Privilege escalation basics in Windows.
- PowerShell usage and command-line navigation.
- General penetration testing workflow: enumerate, validate, escalate, pivot, document.
Tools you should be ready to use:
- PowerShell-based AD enumeration tools.
- BloodHound and SharpHound for graph-based path analysis.
- Common Windows post-exploitation tools and loaders used in labs.
- RDP, Evil-WinRM, SMB tooling, and remote command execution methods.
- Ticket and credential abuse tooling for Kerberos-related attacks.
Create one workspace before Day 1. Keep:
- A command cheat sheet you write yourself.
- A note file for errors and fixes.
- A map of attack paths you discover.
- A report template for documenting findings and steps.
This matters because exam performance often breaks down due to poor note discipline, not lack of knowledge. If you lose track of where credentials came from, which host you accessed, or why a user mattered, you waste time reconstructing your chain.
30-day CRTP preparation plan
This plan is broken into five stages: foundation, domain review, practice, weak-area repair, and final revision. The sequence is intentional. You first build the model, then review the techniques, then pressure-test your ability to apply them.
Days 1–6: Foundation and environment setup
- Day 1: Read the exam objectives. Write down every topic you already know, partly know, and do not know. This gives you a real baseline instead of a guess.
- Day 2: Review Active Directory basics: authentication flow, Kerberos ticket types, common objects, ACL concepts, and privilege boundaries.
- Day 3: Set up your tools. Test each one in a lab. Make sure your command history, terminal setup, and note format work well.
- Day 4: Practice domain enumeration only. Focus on users, groups, computers, sessions, local admin rights, shares, and GPOs.
- Day 5: Build your BloodHound workflow. Ingest data, interpret shortest paths, and validate at least two attack paths manually.
- Day 6: Review what you learned. Rewrite your notes in a cleaner format. Remove copied commands you do not understand.
Why this phase matters: Many candidates rush to exploitation. That is a mistake. In AD operations, clean enumeration is the skill that drives everything else. If you miss local admin rights or a delegated group, no exploitation trick will save you.
Days 7–14: Domain attack technique review
- Day 7: User and group enumeration. Look for nested group abuse and delegated rights.
- Day 8: Kerberoasting and service account review. Practice identifying roastable targets and understanding why some accounts are more valuable than others.
- Day 9: AS-REP roasting and account settings abuse. Review the conditions that make the attack possible.
- Day 10: ACL abuse and object control. Practice reading permissions and mapping them to action.
- Day 11: GPO and OU abuse paths. Study how policy scope and admin delegation create opportunities.
- Day 12: Local privilege escalation and credential access review on Windows hosts.
- Day 13: Lateral movement methods: WinRM, SMB, scheduled tasks, PS remoting, RDP. Compare when each method is practical.
- Day 14: Ticket abuse and trust review. Focus on understanding the access logic, not just the tool syntax.
Why this phase matters: The exam environment may not hand you a single obvious exploit. You may need to spot a weaker path, such as delegated permissions on a group or indirect control over a service account. Broad technique coverage helps you avoid tunnel vision.
Days 15–21: Practice questions and lab execution
- Day 15: Run one full attack chain in a lab from initial foothold to meaningful privilege.
- Day 16: Do timed practice questions or scenario-based review. Limit yourself so you learn to think under pressure.
- Day 17: Repeat enumeration from scratch in a different lab or reset state. The goal is speed with accuracy.
- Day 18: Practice weak-point identification. Given a set of users, groups, and sessions, decide which path is most promising and why.
- Day 19: Do another timed practice block. Review every wrong answer in depth.
- Day 20: Rebuild one complete path without notes. Then compare your workflow to your written process.
- Day 21: Simulate exam conditions for several hours. No distractions, no random searching, no jumping between topics.
Why this phase matters: Recognition is not the same as execution. A candidate may “know” ACL abuse, but freeze when deciding what to check first on a live host. Practice turns recognition into workflow.
Practice with the relevant page only: Altered Security Certified Red Team Professional (CRTP) practice test
Days 22–26: Weak-area repair
- Day 22: List your three weakest topics. Pick them based on mistakes, not feelings.
- Day 23: Re-study weak topic one. Explain it in your own words, then perform it in a lab.
- Day 24: Re-study weak topic two. Build a mini checklist for identification and execution.
- Day 25: Re-study weak topic three. Focus on edge cases and failure conditions.
- Day 26: Mixed review. Switch between all three weak areas so you can recognize them in context.
Why this phase matters: Most candidates spend too much time reviewing strengths because it feels productive. Real improvement comes from fixing the things that repeatedly slow you down.
Days 27–30: Final revision and exam readiness
- Day 27: Review your notes and condense them into one short operational checklist.
- Day 28: Run a short practical simulation and document it cleanly.
- Day 29: Light review only. Focus on process, not volume. Sleep well.
- Day 30: Exam day routine. Start calm, enumerate carefully, and track every action.
How to review explanations without memorizing answers
This is one of the biggest differences between useful study and false confidence. If you use practice questions, do not ask only, “What was the right answer?” Ask these instead:
- What clue in the scenario pointed to the answer?
- Why were the other choices wrong in this environment?
- What condition must exist for this technique to work?
- How would I verify this on a real host or domain?
For example, if a question involves Kerberoasting, do not stop at the concept. Write down:
- How you identify service accounts.
- Why SPNs matter.
- What output confirms a valid target.
- What to do if the account is not crackable or not useful.
This method prevents answer memorization because it forces you to understand the decision path. In the exam, the wording and environment will change. The logic will not.
A practical red team engagement checklist for CRTP-style work
A simple checklist helps you avoid skipping steps during practice and on exam day. This is also the kind of practical resource other operators often reference because it reflects real workflow.
- Initial access context: What user, what host, what network position?
- Host enumeration: Local admins, sessions, processes, shares, saved creds, services.
- Domain enumeration: Users, groups, computers, trusts, GPOs, ACLs, SPNs.
- Path analysis: Which object gives control over which other object?
- Credential opportunities: Tickets, hashes, plaintext, service accounts, delegated rights.
- Lateral movement options: Which protocols and permissions are available now?
- Privilege escalation logic: What exact right lets you move upward?
- Proof and notes: What evidence confirms access and supports reporting?
Use the same checklist every time you practice. Repetition creates speed. Speed creates confidence.
Final-week readiness routine
The final week should not feel chaotic. If it does, your plan is too broad. Keep your routine tight.
- Review one-page notes daily. If your notes are long, they are not revision notes.
- Do one short practical task each day. Example: enumerate a domain, identify roastable accounts, or trace one BloodHound path.
- Stop learning brand-new tools. New tools create friction when old methods already work.
- Practice documentation. Even in a practical exam, clean notes save time and reduce mistakes.
- Sleep and timing matter. A tired candidate misses obvious paths and retries avoidable errors.
On the day before the exam, do a light review only. The goal is mental sharpness. Cramming usually hurts more than it helps because it overloads recall and raises stress.
Common mistakes that hurt CRTP candidates
- Over-focusing on tools instead of access logic. Tools change. Permissions and attack paths are the real subject.
- Skipping enumeration because a path “looks obvious.” The obvious path is not always the fastest or safest one.
- Poor note-taking. If you cannot explain how you got access, you are not in control of the engagement.
- Memorizing syntax without practice. Under pressure, memorized commands are easy to break and hard to adapt.
- Ignoring weak topics. Your weakest area is usually where the exam will slow you down most.
FAQ
How many hours a day should I study for CRTP?
For most working professionals, 2 to 3 focused hours per day is enough if the study is hands-on. On weekends, a longer 4- to 6-hour block helps for lab work. Quality matters more than raw time. Two careful hours of enumeration and validation are better than five distracted hours of copying commands.
Is 30 days enough to prepare?
Yes, if you already understand Windows and basic AD concepts. If you are starting from zero, 30 days is better treated as phase one of a longer plan. The exam rewards practical familiarity, and that takes repetition.
Should I do practice questions every day?
Not at the start. Early on, focus on concepts and lab execution. Practice questions become more useful after you have enough context to understand the explanations. In the middle and final stages, they help with recall, timing, and gap detection.
How do I know if I am ready?
You are close to ready when you can do three things consistently: enumerate a domain without hesitation, explain why an attack path works, and recover when the first method fails. Readiness is not perfect recall. It is controlled problem-solving.
What if I get questions or scenarios wrong repeatedly?
That usually means your understanding is shallow at one layer. Go back one step. If you keep missing ACL abuse, revisit object permissions and delegation. If you keep missing ticket attacks, revisit Kerberos flow. Rebuild from the underlying model instead of forcing more repetition at the surface.
What about retakes?
Policies can change, so always verify the current rules from the certification provider before planning. From a study perspective, if you need a retake, do not restart from scratch. Use your first attempt to identify workflow failures, documentation gaps, and weak topics. Then build a shorter repair cycle focused on those points.
Final checklist before the exam
- I can explain core AD concepts in plain language.
- I have a repeatable enumeration workflow.
- I can read BloodHound paths and validate them manually.
- I understand common credential and ticket abuse techniques.
- I can move laterally using more than one method.
- I know my weak areas and reviewed them recently.
- I have concise notes, not a pile of copied commands.
- I have practiced under time pressure.
- I know how to document each step clearly.
- I am going into the exam rested and organized.
The best CRTP preparation is not complicated. Learn the structure of Active Directory, practice how attackers turn permissions into access, and repeat the workflow until it feels natural. If you use these 30 days well, you will not just prepare for an exam. You will become more effective in real red team and internal penetration testing work.
