The Red Team Lead (RTO II / CRTO II) exam is not a memory test. It checks whether you can think like an operator, make good decisions under pressure, and move through a realistic attack path without wasting time. This guide is for candidates who already work in red teaming, penetration testing, Active Directory security, or Azure-focused offensive work and want a practical 30-day plan. If you know the basics but need structure, this will help you study with purpose instead of jumping between labs, notes, and random practice questions.
Who should use this guide
This guide fits candidates who already have some hands-on experience and need a focused preparation roadmap.
-
Red team operators who want a tighter exam routine and better coverage of weak areas.
-
Penetration testers who know exploitation but need deeper comfort with post-exploitation, lateral movement, and operational decision-making.
-
Active Directory attackers who understand common abuse paths but need faster recall and cleaner execution.
-
Azure or hybrid environment testers who need to review identity, privilege paths, and attack chaining across environments.
If you are still learning basic enumeration, privilege escalation, Kerberos, or command-line tradecraft, spend more time building foundations before using a 30-day sprint. A short plan works best when you are refining existing skill, not building it from zero.
What the exam is really testing
The exam goal is simple: prove that you can operate effectively in a red team context. That means more than running tools. You need to know why you are using a technique, what evidence supports the next step, and when a method is too noisy, too slow, or too risky.
Expect the exam mindset to reward:
-
Methodical enumeration so you do not miss the one clue that unlocks the rest of the path.
-
Active Directory reasoning including identity relationships, delegation, privileges, trust paths, and credential opportunities.
-
Azure or cloud-aware thinking where identity, roles, tokens, and access paths matter as much as hosts.
-
Operator discipline such as keeping notes, validating assumptions, and avoiding unnecessary actions.
-
Time management because the biggest exam failure is often not lack of knowledge, but getting stuck too long in one branch.
That is why your study plan should not revolve around memorizing commands. Commands change. Reasoning does not.
Prerequisite knowledge and tools
Before starting the 30-day plan, make sure your baseline is solid. You do not need mastery in every area, but you should be able to work without stopping to relearn core concepts.
Core knowledge to review first:
-
Windows internals at a practical level: services, scheduled tasks, users, groups, tokens, processes, and common logon artifacts.
-
Active Directory basics: domains, OUs, trusts, SPNs, Kerberos flow, ACL abuse concepts, delegation, and common escalation paths.
-
Command-line comfort in PowerShell and a Linux shell.
-
Credential access and usage: hashes, tickets, tokens, password reuse, local admin reuse, and service accounts.
-
Privilege escalation concepts on Windows.
-
Basic Azure identity and role concepts if the exam scope includes cloud or hybrid elements.
Tools you should be comfortable with:
-
Enumeration tools for AD and Windows environments
-
Remote execution methods and session management
-
Credential and ticket-related tooling
-
BloodHound-style graph reasoning, even if the exact tool varies
-
Basic note-taking system for commands, findings, and hypotheses
Your note-taking setup matters more than most candidates realize. During preparation, build a simple structure:
-
Host findings
-
User and group relationships
-
Credentials and access material
-
Potential privilege paths
-
Failed attempts and why they failed
This reduces repeated mistakes. It also trains the exact discipline you need in the exam.
30-day study plan
This plan assumes you can study about 1.5 to 3 hours on weekdays and more on weekends. Adjust the hours, but keep the sequence. The order matters because each phase builds on the last one.
Days 1–6: Foundation reset
The first week is about cleaning up gaps. Do not rush into mixed labs yet. Focus on recall, structure, and core flows.
What to study:
-
AD authentication basics, especially Kerberos-related attack logic
-
User, group, and privilege relationships in a domain
-
Common Windows privilege escalation paths
-
Credential handling concepts: where credentials live, how they are abused, and what each credential type allows
-
Azure roles, service principals, tokens, and identity pathways if relevant
What to do each day:
-
Spend 45 minutes reviewing one domain deeply.
-
Spend 45 minutes reproducing commands or workflows in a lab.
-
Spend 20 minutes writing your own short summary from memory.
The memory summary is important. It shows what you actually understand. If you cannot explain why constrained delegation matters, or when a token gives value, you are not ready to depend on that topic in an exam.
Days 7–13: Domain review by attack path
Now switch from isolated concepts to full attack paths. The goal is to think in chains, not fragments.
Break the week into themes:
-
Day 7: Initial foothold to local privilege escalation
-
Day 8: Local privilege to credential access
-
Day 9: Credential access to lateral movement
-
Day 10: Lateral movement to domain situational awareness
-
Day 11: AD object abuse and permission-driven escalation
-
Day 12: Kerberos abuse paths and ticket logic
-
Day 13: Azure or hybrid identity escalation chains
For each theme, ask three questions:
-
What evidence tells me this path is possible?
-
What is the least noisy way to test it?
-
If this fails, what is the next most likely branch?
This is the difference between a tool user and a lead-level operator. The exam is more manageable when you think in branches and contingencies.
Days 14–19: Practice questions and scenario drills
This phase is where many candidates make a mistake. They do practice questions only to score well. That is the wrong use. Practice questions should expose weak reasoning, not just reward recognition.
Use scenario-based review where possible. After each question or mini-case, do not just check whether the answer is right. Write down:
-
Why the correct answer is correct
-
What clue in the wording or scenario points to it
-
Why the other choices are weaker or wrong
-
What command, check, or concept you would use in real work
This turns a question bank into a reasoning tool.
Practice with the relevant page only: Red Team Lead (RTO II / CRTO II) Practice Test
Also start building a simple red team engagement checklist for yourself. This is useful both for exam prep and real operations. Keep sections for:
-
Initial triage
-
Host enumeration
-
Identity mapping
-
Privilege hypotheses
-
Credential opportunities
-
Lateral movement options
-
Domain escalation checks
-
Cloud identity checks
-
Cleanup and evidence notes
A checklist prevents missed basics when you are tired. In exams, stress makes people skip obvious checks.
Days 20–24: Weak-area repair
By now, patterns should be clear. You will know where you are slow, where you guess too much, and where your understanding is thin.
Common weak areas include:
-
Kerberos flow and when different ticket attacks apply
-
AD permissions and ACL abuse logic
-
Delegation edge cases
-
Azure role inheritance and identity abuse paths
-
Session hunting and practical lateral movement choices
-
Windows privilege escalation triage
Pick no more than two weak areas per day. Go deep. Read your notes, reproduce a lab task, then explain the path out loud in plain language. If you cannot explain a path simply, you probably still rely on memorized steps.
Example: do not just remember that a certain delegation setting can be abused. Explain what trust is being granted, what credential or service condition is required, and what result the attacker gets. That level of clarity is what survives exam pressure.
Days 25–27: Timed revision and exam simulation
These three days are about pacing and decision-making.
Run one or two timed sessions where you simulate exam conditions:
-
No distractions
-
Notes allowed only if they match the real exam rules
-
Time-boxed problem solving
-
Forced decision points when stuck
Use a simple timing rule: if one line of attack gives no new signal after a reasonable amount of testing, mark it, step away, and pivot. Many candidates fail because they keep forcing one idea long after the evidence stopped supporting it.
After each timed session, review not just errors but wasted time. Ask:
-
Where did I chase assumptions?
-
Which checks should have happened earlier?
-
What notes would have helped me pivot faster?
Days 28–30: Final revision
Do not cram new topics in the last three days. Tighten recall and reduce mental noise.
Focus on:
-
Your personal weak-topic summaries
-
Your red team engagement checklist
-
Short command recall for things you already know
-
Common decision trees for AD and Azure attack paths
-
Rest, sleep, and exam-day logistics
A tired candidate with good knowledge often performs worse than a rested candidate with slightly less knowledge. The exam rewards clarity.
How to review explanations without memorizing answers
This is one of the most important parts of preparation. Memorizing answers creates false confidence. It helps on repeat questions, but not on new scenarios.
Use this method for every missed question:
-
Step 1: Cover the answer and restate the problem in your own words.
-
Step 2: Identify the key clue. For example, a privilege, a protocol behavior, a token type, or a role assignment.
-
Step 3: Name the decision rule. Example: “If I have this level of object control, I should test whether it enables this escalation path.”
-
Step 4: Write one variant of the scenario that would change the answer.
That final step is powerful. It forces flexible understanding. If one changed condition breaks the attack path, you learn what really matters.
Example: if a question depends on a specific AD permission, ask yourself what happens if that permission is absent but group membership changes. Now you are learning structure, not trivia.
Final-week readiness routine
In the last week, keep your days predictable. Last-minute chaos hurts performance.
Use this simple routine:
-
Start with 20 minutes of note review from memory.
-
Do one focused practice block on a weak area.
-
Do one short scenario or question set.
-
Review mistakes immediately.
-
End by updating your checklist and summary notes.
The night before the exam, stop early. Check your environment, system access, allowed materials, and timing plan. Then rest.
FAQ
How many hours a day should I study?
For a 30-day plan, most candidates do well with 1.5 to 3 hours on weekdays and longer weekend sessions. The key is not raw hours. It is whether the study is active. Two focused hours of lab work and explanation review is better than four passive hours of reading.
Should I focus more on labs or practice questions?
Use both, but for different reasons. Labs build execution skill. Practice questions expose reasoning gaps and help with recognition of patterns. If you only do labs, you may miss conceptual weak areas. If you only do questions, you may know the idea but fail to execute.
When should I book the exam?
Book it when your timed practice shows stable performance, not when you feel vaguely motivated. A good sign is that you can work through scenarios without panic, recover from dead ends, and explain your choices clearly.
What if I get stuck often in practice?
That usually means one of three things: weak fundamentals, poor note structure, or weak pivoting discipline. First check whether you are missing core knowledge. Then improve your checklist. Finally, set a time limit for each attack branch so you stop digging in the wrong place.
How should I think about retakes?
If you need a retake, do not restart from zero. Audit the failure honestly. Did you miss concepts, waste time, or freeze under pressure? Build the next plan around that exact problem. Most retake improvements come from better process, not just more reading.
Is memorizing commands enough?
No. Commands help only when you understand the condition that makes them useful. The exam is about choosing the right action based on evidence. A candidate who understands attack logic can recover even if they forget a minor syntax detail. A candidate who memorized syntax but not strategy usually stalls.
Final checklist before exam day
-
I can explain common AD attack paths in plain language.
-
I know how to move from enumeration to hypothesis to validation.
-
I have reviewed Windows privilege escalation basics recently.
-
I can reason through Kerberos and delegation scenarios.
-
I have a working checklist for host, identity, and domain review.
-
I have practiced timed scenarios and learned when to pivot.
-
I review explanations for decision rules, not just right answers.
-
I know my weakest area and have a repair plan for it.
-
I have handled exam-day logistics ahead of time.
A strong RTO II / CRTO II preparation plan is not about doing everything. It is about covering the right material in the right order, then testing whether you can think clearly with it. If you spend 30 days building attack-path reasoning, disciplined notes, and calm execution, you give yourself a much better chance of passing and becoming better at the work itself.
