The Certified Azure Red Team Professional, or CARTP, is not a memorization exam dressed up as a cloud cert. It tests whether you can think like an operator inside a hybrid Microsoft environment. That means you need more than a list of tools or attack names. You need to understand how Active Directory and Azure Active Directory connect, how trust and identity are abused, how access expands after the first foothold, and how to turn technical actions into a clear attack story. If you are trying to figure out what to study before taking practice tests, the best approach is to break the exam into domains, decide which topics require memorization and which require hands-on skill, and then review them in an order that matches how real attacks unfold.
What the CARTP domains are really testing
CARTP focuses on Azure red team operations in environments where on-premises Active Directory and cloud identity often overlap. The exam domains usually sit around a few major skill areas:
- Active Directory fundamentals and abuse paths
- Azure and Azure AD identity concepts
- Enumeration and attack path discovery
- Privilege escalation and lateral movement
- Command and control and operator tradecraft
- Persistence, post-exploitation, and access maintenance
- Reporting and documentation
The exam is practical in spirit, even when delivered through questions. It wants to know whether you can recognize what matters in a scenario. For example, knowing that Kerberoasting exists is not enough. You should know when to look for service accounts, what permissions make them useful targets, what output tells you the attack worked, and what the next step would be after you crack a ticket.
That is why your study plan should mirror operator workflow. Start with identity and trust. Then move to enumeration. Then abuse paths. Then movement and escalation. End with reporting. This order makes review easier because each domain builds on the one before it.
Active Directory: the base layer you cannot skip
Many CARTP candidates want to jump straight into Azure attack paths. That is a mistake. A lot of cloud compromise in Microsoft environments still depends on old AD concepts. If your AD fundamentals are weak, cloud abuse chains will feel random.
Focus on these areas:
- Domain structure: domains, forests, trusts, organizational units, domain controllers
- Authentication: Kerberos, NTLM, tickets, hashes, SPNs
- Privilege groups: Domain Admins, Enterprise Admins, Account Operators, Backup Operators, local admin relationships
- Delegation and permissions: ACLs, inheritance, GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember
- Common attack paths: Kerberoasting, AS-REP roasting, unconstrained delegation, constrained delegation abuse, password spraying, DCSync
Why this matters: Azure red team work often starts from one weak identity and then follows privilege relationships across hybrid infrastructure. AD teaches you how permissions actually work. If you do not understand ACL abuse or delegated rights in on-prem AD, you will struggle to understand similar privilege paths in Azure.
Study advice: separate the protocol concepts from the abuse actions. Memorize what Kerberos tickets are and what SPNs do. Practice identifying which users are roastable, which ACLs are dangerous, and how graph-based relationships reveal privilege escalation routes.
Azure and cloud identity: know the objects, roles, and sync points
This domain is often where candidates feel least comfortable, because cloud identity uses familiar words in slightly different ways. You need to know not just the names of Azure objects, but also how those objects become attack surfaces.
Core topics to review:
- Azure tenants, subscriptions, resource groups, and management groups
- Azure AD identities: users, groups, service principals, managed identities, applications
- Authentication methods: password auth, MFA, tokens, refresh tokens, OAuth concepts
- Hybrid identity: Azure AD Connect, password hash sync, pass-through authentication, federation basics
- Role models: Azure AD roles versus Azure RBAC roles
- Privileged roles: Global Administrator, Privileged Role Administrator, Application Administrator, Owner, Contributor, User Access Administrator
Why this matters: most mistakes in this domain come from confusing control planes. An Azure AD role might let you control identities, while Azure RBAC might let you control resources. Those are different paths. If a question gives you a service principal with resource permissions, you should think about VM abuse, secret extraction, automation accounts, and stored credentials. If it gives you directory permissions, you should think about app consent, role assignment, or user modification.
Study advice: make a side-by-side sheet that compares Azure AD roles, Azure RBAC roles, and AD group privileges. This helps you stop treating all “admin” rights as equal. They are not equal, and the exam often relies on that difference.
Enumeration and cloud attack path discovery
Enumeration is one of the most important exam domains because every later action depends on it. Good operators do not guess. They collect enough detail to see what is possible and what is noisy or pointless.
You should be able to enumerate:
- Users, groups, and memberships
- Applications, enterprise apps, and service principals
- Role assignments and inherited permissions
- Key Vault access, storage permissions, and VM roles
- Synchronization and hybrid identity details
- Conditional access or security controls that may affect access
Why this matters: cloud attack paths are rarely obvious from one command output. You often need to combine separate facts. For example, a low-privileged user may be able to register an application, that application may get consent, and that consent may expose data or mailboxes. Or a user may have no direct admin rights but be able to add themselves to a group through a writable object. Enumeration is how you spot these chained conditions.
Study advice: practice reading raw output and translating it into an attack decision. Ask yourself three questions every time you enumerate an object:
- What does this object control?
- What controls this object?
- What can I change right now with my current rights?
This habit turns passive reading into active path analysis.
Privilege escalation and lateral movement
This is the heart of operator-level thinking. Once you have a foothold, how do you turn it into something more valuable?
In CARTP terms, you should review escalation and movement in both on-prem and Azure-connected contexts:
- Role abuse: escalating through Azure AD or Azure RBAC role assignment weaknesses
- Credential access: dumped secrets, stored credentials, token abuse, service principal secrets, managed identity abuse
- Application abuse: adding credentials to apps, abusing consent, taking over service principals
- VM-based movement: abusing Run Command, extensions, local admin access, or reachable management interfaces
- Hybrid movement: using cloud access to reach synced identities, management hosts, or administrative workflows that touch on-prem AD
Why this matters: the exam does not only test whether you know an attack name. It tests whether you can spot the shortest path to privilege. For example, if you can reset a password for a user who is not an admin, that may still be the best move if that user owns an app registration or has contributor access to a subscription. Always think in terms of reachable control, not title alone.
Study advice: build escalation maps. Start with a simple compromised identity. List every action that identity can take. Then list what those actions unlock. This is one of the best ways to train for scenario-based questions.
Command and control, persistence, and operator tradecraft
CARTP candidates often under-review this domain because they focus on identity abuse. But practical red team work includes maintaining access, operating quietly, and choosing the right execution method.
Know the basics of:
- C2 infrastructure concepts: beacons, callbacks, tasking, staging, process context
- Execution choices: when to use remote commands, scripts, scheduled tasks, service abuse, or cloud management features
- Persistence options: new credentials, app secrets, role assignments, startup methods, scheduled execution, backdoor permissions
- OPSEC thinking: noisy versus low-noise actions, what creates logs, what changes are easy to notice
Why this matters: in an operator exam, the best answer is not always the most powerful one. It may be the option that preserves access without breaking the environment or triggering obvious review. If one technique gives admin rights but causes a visible service outage, and another achieves the same goal quietly, the quieter path is usually stronger tradecraft.
Study advice: do not just learn “how to run” techniques. Learn the cost of each technique. Ask what artifacts it leaves behind, what permissions it requires, and whether it changes identity, host, or cloud configuration.
Reporting and documentation are part of the skill set
Some candidates treat reporting as a soft skill. On CARTP, that is a weak assumption. Good reporting proves that you understand the attack path from beginning to end.
You should be able to document:
- Initial access or starting assumptions
- Enumeration findings that mattered
- Privilege escalation path and decision points
- Evidence of impact
- Clear remediation advice tied to the abused misconfiguration
Why this matters: reporting is where technical understanding becomes useful to defenders, managers, and clients. If you cannot explain why a permission was dangerous or how two weak settings combined into compromise, then you do not fully understand the attack yourself.
Study advice: after every practice lab, write a five-part summary: foothold, key findings, escalation steps, business impact, and fixes. This makes your review much stronger than simply re-running commands.
What to memorize versus what to practice
A lot of CARTP prep becomes easier when you sort topics into two buckets.
Memorization topics usually include:
- Role names and what they allow
- Core Azure object types
- Authentication concepts and token basics
- Permission names such as common AD ACL rights
- Differences between Azure AD and Azure RBAC
Scenario-based topics usually include:
- Attack path discovery
- Privilege escalation choice-making
- Lateral movement planning
- Chaining on-prem and cloud weaknesses
- Selecting stealthier persistence or execution methods
The reason this distinction matters is simple: memorization helps you understand what you are looking at. Practice teaches you what to do with it. If you only memorize, you will freeze on multi-step questions. If you only practice without learning the object model, you will misread permissions and roles.
How to convert each domain into practice sessions
The best practice sessions are short and focused. Do not try to “study Azure” in one block. Build sessions around one domain and one outcome.
Here is a practical model:
- Session 1: AD identity review
Goal: identify roastable users, delegated rights, and admin paths from a low-privileged account. - Session 2: Azure role mapping
Goal: take a set of Azure AD and Azure RBAC assignments and explain what each identity can really control. - Session 3: Application and service principal abuse
Goal: trace how app ownership, credentials, and consent can become privilege. - Session 4: Hybrid attack path chaining
Goal: connect one cloud-side weakness to on-prem impact, or the reverse. - Session 5: Operator decision drills
Goal: compare multiple escalation or persistence options and justify the best one. - Session 6: Reporting drill
Goal: write a short report from notes only, with evidence and remediation.
Once you have done a few domain-focused labs, switch to mixed practice. That is where practice tests help, because they force you to move between concepts without warning. If you are at that stage, a targeted set of CARTP questions can help you test weak spots and timing: Certified Azure Red Team Professional practice test.
Use practice questions the right way. Do not only score them. Tag each miss by domain. Was it a role confusion problem, an attack path problem, or a reporting logic problem? That is how you turn testing into review.
A smart review order before practice tests
If your time is limited, review in this order:
- Active Directory basics and ACL abuse
- Azure identity objects and role models
- Enumeration methods and attack path reading
- Privilege escalation and lateral movement
- Persistence and C2 tradecraft
- Reporting and remediation mapping
This order works because every later topic depends on understanding identity and permissions first. Candidates often reverse this and start with flashy post-exploitation topics. That creates gaps. You may know a technique, but not when it applies.
Mini FAQ: domain weighting, weak areas, and last-week review
Are all domains weighted equally?
Usually not in practical value, even if the exam blueprint does not make exact weighting obvious. Identity, enumeration, and escalation tend to matter most because they drive the rest of the attack chain. If you are weak there, other strengths will not compensate well.
How do I find my weak areas fast?
Track every miss in a simple sheet with three columns: domain, exact topic, and reason for error. “Forgot role permission” is different from “missed attack path chain.” This tells you whether to review definitions or practice reasoning.
What should I do in the last week?
Do not try to learn every edge case. Review your role comparison sheet, your common abuse paths, and your notes from failed scenarios. Then do short mixed drills. The goal is recall speed and decision quality, not volume.
Should beginners avoid CARTP-level practice until they know everything?
No. Start practice early, but keep it structured. Use small scenarios first. Waiting until you feel fully ready often delays the one thing that actually reveals weakness: applied problem solving.
Final takeaway
CARTP prep works best when you stop thinking in isolated topics and start thinking in attack chains. Learn the identity model. Understand the permissions. Enumerate with purpose. Choose escalation paths based on what they unlock, not what sounds impressive. Then document the whole path clearly. If you study each domain this way, practice tests become much more useful, because you are not just recognizing terms. You are reading scenarios like an operator.
