If you are preparing for a Red Team Lead exam such as RTO II or CRTO II, the hard part is usually not finding material. It is knowing what matters, what needs hands-on practice, and what only needs light review. These exams do not reward broad but shallow reading. They reward operator judgment. You need to understand how Active Directory works, how Azure changes attack paths, how lateral movement really happens, and how to think like someone running an operation instead of just executing a checklist. This guide breaks the main domains into study priorities, explains what to memorize versus what to practice, and gives you a practical order for review.
What these exams are really testing
At a high level, Red Team Lead-style exams test whether you can move through a realistic enterprise environment with control and purpose. That means more than running tools. You need to recognize attack paths, choose low-noise actions, recover when a path fails, and explain your decisions clearly.
Most candidates lose time because they study by tool category. They memorize commands for enumeration, Kerberoasting, pivoting, and C2 management, but they do not study the environment as a system. The exam domains make more sense if you group them into four practical questions:
- What does the environment look like? Active Directory, Azure, hosts, users, trusts, permissions.
- Where can access expand? Misconfigurations, delegated rights, token abuse, credential exposure, cloud role paths.
- How do you operate safely? C2 choices, OPSEC, process migration, lateral movement, persistence tradeoffs.
- How do you prove value? Documentation, reporting, evidence, and remediation context.
That is why pure memorization is never enough. The exam expects you to connect technical facts into decisions.
Active Directory: the core domain you cannot afford to be weak in
For most candidates, Active Directory is still the center of gravity. Even if Azure or hybrid identity appears in the exam, the logic of privilege and trust usually starts with AD concepts. If your AD understanding is weak, everything else feels random.
Focus on these areas first:
- AD structure: domains, forests, OUs, users, groups, computers, GPOs, trusts.
- Authentication basics: Kerberos flow, NTLM fallback, tickets, SPNs, constrained and unconstrained delegation.
- Authorization and privilege: ACLs, ACEs, group nesting, delegated permissions, local admin rights.
- Attack path logic: how a low-privileged user becomes local admin, then server admin, then domain-level access.
- Common abuse cases: Kerberoasting, AS-REP roasting, DCSync rights, RBCD, GPO abuse, ADCS-related escalation if in scope.
Do not study these as separate tricks. Study them as cause and effect. For example, resource-based constrained delegation matters because it turns write access over one computer object into code execution or impersonation opportunities on another system. If you only memorize the abuse steps, you will get stuck when the lab setup is slightly different.
A good test of readiness is this: can you look at a set of users, groups, permissions, and machines and explain three likely escalation paths without touching a tool? If not, you need more AD modeling practice.
Azure and hybrid identity: study the relationships, not just the services
Many candidates overcomplicate Azure. They try to learn every service. That is not necessary. What matters more is identity, access, and control relationships.
Prioritize these topics:
- Azure AD or Entra ID basics: users, groups, roles, service principals, app registrations, managed identities.
- Role assignments: subscription, resource group, resource-level permissions.
- Privilege escalation paths: role misassignments, app consent abuse, credential theft from automation accounts or service principals.
- Hybrid attack paths: sync relationships, password reuse, privileged identity overlap between cloud and on-prem.
- Storage and secrets exposure: Key Vault access, storage account keys, automation variables, deployment artifacts.
The why here is simple. In cloud environments, compromise often comes from identity misuse rather than host exploitation. A user with limited Azure rights may still control a script, app, or secret that opens the door to larger access. Learn to ask, “What can this identity manage, impersonate, read, or deploy?”
Hybrid identity deserves extra attention because it creates hidden bridges. An operator who can compromise a synchronized identity, a cloud admin account with reused credentials, or an automation process tied to on-prem resources may move faster than someone trying to exploit systems one by one.
Lateral movement: understand preconditions and tradeoffs
Lateral movement is not just a list of remote execution methods. It is about knowing what conditions make each method possible and what noise each method creates.
Study these layers:
- Access requirements: credentials, local admin, token presence, remote management rights.
- Execution methods: SMB-based execution, WMI, WinRM, RDP, scheduled tasks, service creation, PowerShell remoting.
- Credential sources: LSASS access, cached creds, browser stores, password managers, config files, scripts, shares.
- Host context: workstation versus server, admin jump box versus user desktop, domain controller sensitivity.
- Detection and OPSEC: logs, parent-child process patterns, service creation artifacts, interactive logons.
The key habit to build is matching technique to environment. For example, if WinRM is available and you already have rights, it may be cleaner than dropping a service binary. If you are on a user workstation with many active sessions, token opportunities may matter more than credential dumping. If a server is likely monitored closely, a noisy method may be the wrong call even if it works.
Practice explaining not just how to move laterally, but why this method now.
Privilege escalation: think in paths, not isolated findings
Privilege escalation is where many scenario-based questions get their depth. The exam may present several weak signals that only make sense when chained together.
Break escalation into these buckets:
- Local privilege escalation: weak service permissions, unquoted paths, token privileges, software misconfigurations, scheduled tasks.
- Domain privilege escalation: delegated rights, ACL abuse, group membership control, replication rights, delegation abuse.
- Cloud privilege escalation: role inheritance, overprivileged identities, app permissions, exposed secrets.
- Credential-based escalation: password reuse, harvested hashes, tickets, tokens, vault access.
The reason path thinking matters is that real escalation usually combines two or three low-level issues. A single user may not be privileged, but that user may control a script on a management server. That server may hold a service account secret. That account may have rights over a GPO or computer object. If you only train on one-step escalations, you will miss these chains.
When reviewing this domain, force yourself to draw attack graphs. Even rough notes help. Write the current identity, what assets it can reach, what objects it can modify, and what new identity that might produce.
C2 operations: know enough to operate with discipline
You do not need to become a malware developer to do well here. But you do need to show operator discipline. C2 topics often separate candidates who can get access from candidates who can sustain an operation.
Study these areas:
- Beacon or agent management: sessions, callbacks, listener choices, staging versus stageless decisions.
- Operational security: process choice, injection tradeoffs, sleep and jitter, command frequency, artifact awareness.
- Pivoting and tunneling: SOCKS, port forwards, reverse forwards, routing through compromised hosts.
- File transfer and tooling hygiene: what to upload, what to avoid, how to reduce footprint.
- Contingency handling: lost sessions, broken pivots, blocked egress, alternate paths.
The exam angle here is usually judgment. Can you keep access stable? Can you avoid turning a workable foothold into a dead end? Can you pivot without exposing every host in the path? Those choices matter more than memorizing every menu option in a framework.
If possible, practice with constraints. For example, limit yourself to one initial foothold, one pivot host, and minimal file drops. Constraints teach discipline faster than unrestricted lab work.
Reporting and evidence: this domain is often underestimated
Technical candidates often leave reporting until the end. That is a mistake. A red team lead is expected to document clearly, justify actions, and explain risk in a way defenders and managers can use.
Review these skills:
- Attack narrative: initial access, escalation, movement, objective, impact.
- Evidence handling: screenshots, command output, timestamps, affected systems, proof of access.
- Finding quality: root cause, exploitation path, business risk, practical remediation.
- Prioritization: what matters most, what enabled later compromise, what should be fixed first.
The why is straightforward. A finding without context is hard to act on. “User had local admin” is weaker than “Local admin on the deployment server exposed service account credentials, which enabled domain-wide policy control.” The second version explains the path and the impact.
Good reporting also improves your exam performance. When you write clean notes during practice, you spot gaps in logic sooner. Weak notes often hide weak understanding.
What to memorize versus what to practice
This is one of the most important distinctions in your study plan.
Memorization topics are facts you need quickly without much interpretation:
- Kerberos terms and ticket types
- Common AD object types and permission concepts
- Major Azure identity objects and role scopes
- Remote execution prerequisites
- Common privilege escalation categories
- Reporting structure and evidence checklist
Scenario-based topics are areas where facts are not enough:
- Choosing the best escalation path
- Deciding between lateral movement options
- Recognizing a hybrid identity bridge
- Managing OPSEC during C2 operations
- Explaining root cause and impact in reporting
A simple rule helps here. If the topic answers “what is this?” it often needs memorization. If it answers “what should I do next?” it needs practice.
How to convert each domain into practice sessions
Do not study domains only by reading notes. Turn each one into a repeatable practice block.
- Active Directory session: Start with a low-privileged user. Enumerate relationships. Write down three possible escalation paths before executing one.
- Azure session: Given one identity, map every accessible role, app, secret, and automation object. Identify one direct and one indirect escalation route.
- Lateral movement session: Pick one target host and list all possible ways to reach it. Rank them by noise, prerequisites, and speed.
- Privilege escalation session: Build one full chain from local access to higher privilege. Focus on why each step enables the next.
- C2 session: Simulate a constrained operation with limited pivots and minimal artifacts. Practice session recovery and alternate routing.
- Reporting session: Write a short narrative from notes only. If the story is unclear, your notes or your reasoning are weak.
If you want a structured way to test these skills under exam-style pressure, try a focused Red Team Lead practice test. Use it after domain review, not before. It works best when you already have a framework for judging your own mistakes.
A practical review order that saves time
The best review order is the one that reflects dependency. Some domains support all the others.
- Active Directory fundamentals and attack paths
- Privilege escalation in AD and local contexts
- Lateral movement and credential access
- Azure identity and hybrid attack paths
- C2 operations and pivoting discipline
- Reporting, evidence, and remediation language
This order works because AD and privilege logic explain most enterprise compromise paths. Lateral movement makes more sense once you understand what rights you are trying to use. Azure becomes easier when you already think in terms of identity relationships and escalation chains. Reporting should be practiced throughout, but a focused review near the end helps you package everything coherently.
How to track weak areas without guessing
Weak-area tracking should be based on failure patterns, not feelings. After each practice session, record:
- What you missed
- Why you missed it
- What type of mistake it was
Use categories such as:
- Knowledge gap: you did not know the concept
- Recognition gap: you knew it but did not spot it in the scenario
- Decision gap: you saw options but chose the wrong one
- Execution gap: you knew the plan but could not carry it out cleanly
- Documentation gap: you solved it but could not explain it clearly
This matters because each gap needs a different fix. Knowledge gaps need reading and flash review. Recognition gaps need more scenario exposure. Decision gaps need path comparison drills. Execution gaps need lab repetition. Documentation gaps need writing practice.
Mini FAQ
Which domain usually carries the most weight?
Exact weighting varies, but AD, privilege escalation, and operator decision-making usually drive the outcome. These areas connect directly to scenario success.
Do I need deep tool-specific knowledge?
You need enough to operate reliably, but the exam is usually more about choosing and sequencing actions than naming every flag of every tool.
How much Azure should I study if I come from a traditional AD background?
Study identity and role relationships first. You do not need every Azure service. You do need to understand how cloud permissions create attack paths.
How do I know if I am ready for practice tests?
You are ready when you can explain likely attack paths from a scenario before executing commands. If you rely on trial and error, do more domain review first.
What is the biggest study mistake?
Treating topics as isolated techniques. The exam rewards chaining, judgment, and explanation.
Final study advice
Think like an operator, not a command collector. Build your study around relationships: user to group, host to credential, role to secret, permission to escalation. Ask what each piece of access allows, what it depends on, and what it risks exposing. That is the mindset these domains are really measuring.
If you keep your review structured, separate fact study from scenario practice, and track mistakes honestly, the major domains become much easier to manage. You do not need to know everything. You need to know how the environment works, how to move through it with intent, and how to explain what you found.
