If you are preparing for a Red Team Operator exam such as RTO or CRTO, the hardest part is often not the tooling. It is knowing what to study, why it matters, and how to turn broad domains into hands-on practice. These exams reward operator thinking. You need to move through an environment, make decisions under limits, and understand how one weakness leads to the next. This guide breaks the major domains into practical study areas, shows which topics are mostly memorization and which are scenario-based, and gives you a review order that makes sense if you want to build real exam readiness.
What these exams are really testing
RTO and CRTO-style exams are not just asking whether you know attack names or can repeat command syntax. They test whether you can operate in a Windows-heavy environment, usually centered on Active Directory, and turn access into progress. That means you need three layers of skill:
- Core knowledge: understanding domains, users, groups, trusts, Kerberos, tokens, sessions, and common attack paths.
- Tool use: being able to run enumeration, credential access, lateral movement, and command-and-control workflows without getting stuck on basics.
- Decision-making: choosing the next step based on what you found, not based on a memorized checklist.
This matters because many candidates over-focus on commands and under-focus on environment logic. In the exam, if you do not understand why a host matters, why a group membership is dangerous, or why a service account is valuable, your tool output will not help much.
Active Directory fundamentals you must know first
Active Directory is usually the center of the exam. If your AD basics are weak, everything else gets harder. Start here before you spend too much time on advanced payloads or niche bypasses.
Focus on these areas:
- Domain structure: forests, domains, domain controllers, OUs, users, groups, computers, GPOs.
- Authentication: Kerberos basics, NTLM basics, tickets, hashes, service tickets, delegation concepts.
- Authorization: local admin rights, domain admin rights, nested groups, ACL abuse.
- Common AD services: SMB, LDAP, WinRM, RDP, RPC, DNS.
Why this matters: almost every meaningful action in a red team exam depends on identity and trust. For example, if you find a user with local admin on several systems, that is not just a fact to record. It may become your lateral movement path. If a service account has constrained delegation or weak permissions, that may be your privilege escalation path.
A beginner-friendly way to think about AD is this: the environment is a map of who can authenticate where, who can administer what, and what objects can be abused to gain stronger privileges. If you can read that map, you are in good shape.
Enumeration and attack path discovery
Strong operators spend a lot of time enumerating because good enumeration reduces guessing. This domain is often underestimated by candidates who want to jump straight into exploitation.
You should be able to enumerate:
- Users and groups
- Logged-on users and active sessions
- Local admin access across hosts
- Shares, files, scripts, and configuration data
- Domain relationships and privilege edges
- Misconfigurations in GPOs, services, scheduled tasks, and ACLs
This is where graph thinking helps. You are not just collecting data. You are building possible chains such as:
- low-privileged user → access to share → recover password → local admin on workstation → dump credentials → access server → abuse AD permissions
Study advice: practice explaining each finding in plain language. If you see “GenericAll” or “WriteDacl,” do not stop at the term. Ask yourself what action that permission allows and what privilege it could lead to.
Credential access and privilege escalation
This is one of the most important domains because credentials are often the bridge between foothold and control. You should know both host-level and domain-level opportunities.
Important topics include:
- Password hunting: files, scripts, notes, config files, unattended installs, saved sessions.
- Credential dumping concepts: LSASS access, SAM, LSA secrets, DPAPI awareness.
- Kerberos abuse basics: kerberoasting, AS-REP roasting, ticket reuse concepts.
- Token and session abuse: using available logons and delegated rights.
- Privilege escalation on Windows: service misconfigurations, weak file permissions, scheduled tasks, dangerous group memberships.
Why this domain matters: many exam paths are built on “small wins.” A reused password, a service account ticket, or a misconfigured service may not look dramatic on its own, but in AD environments these small issues often combine into a full compromise path.
Separate this domain into two study buckets:
- Memorization-heavy: common privilege escalation checks, Kerberos ticket terms, hash and credential types, built-in groups and what they imply.
- Scenario-heavy: deciding whether to dump creds, roast a service, pivot using a session, or abuse a specific permission based on the host and your current rights.
Lateral movement and remote operations
Lateral movement is where many candidates lose time. They know multiple remote execution methods but do not know when each one is appropriate. Study this as an access-and-constraints problem.
You should understand common movement options such as:
- SMB-based execution
- WMI-based execution
- WinRM and PowerShell remoting
- Scheduled tasks and service creation
- RDP usage and OPSEC tradeoffs
The “why” matters here. For example, WinRM may be clean and convenient if enabled and allowed. SMB-based methods may work well if you have admin rights but can be noisier. RDP can be useful for validation but may create visible user activity. The exam may not heavily score stealth in the way a real operation would, but operator judgment still matters because bad choices create confusion and waste time.
Practice answering these questions:
- What rights do I need for this movement method?
- What ports and services must be available?
- What artifacts or logs might this create?
- What is the simplest reliable method in this situation?
Command and control operations
You do not need to treat C2 as magic. In these exams, C2 is mainly your way to manage access, run post-exploitation actions, and pivot. What matters is that you can use it smoothly.
Study these areas:
- Listener and beacon basics
- Session management
- Payload selection for the host and the task
- In-memory execution concepts
- Pivoting and SOCKS/proxy concepts
- File transfer and tooling hygiene
Why this matters: a lot of failures come from poor session handling, not poor technical knowledge. If you lose track of which host has which access, or you cannot route traffic through a foothold correctly, you may miss an easy path.
Do not over-study exotic payload theory if your basics are shaky. It is more valuable to cleanly move from one host to another, run your enumeration, and maintain access than to know ten niche C2 features you never use.
Azure and cloud attack path basics
Some operator tracks now expect at least some awareness of Azure or hybrid identity. Even when cloud content is lighter than AD content, you should still understand the main risk areas.
Focus on:
- Identity as the control plane: users, roles, service principals, managed identities, application permissions.
- Hybrid relationships: how on-prem AD and Azure AD style identity can influence each other.
- Privilege paths: role assignments, key vault access, automation accounts, secrets exposure.
- Persistence concepts: apps, credentials, role abuse, and token-related access.
The reason cloud attack paths matter is simple: in hybrid environments, privilege does not stay in one place. A weakly controlled identity in Azure can open a path back into on-prem resources, or vice versa. You do not need to memorize every Azure service. You do need to understand how identity, permissions, and secrets create abuse paths.
Reporting and documentation
Reporting is often ignored until the end, which is a mistake. Even if the exam is heavily practical, your notes are part of your performance. Good documentation helps you recover your path, justify your findings, and avoid repeating work.
Track these items as you go:
- Hostnames, IPs, and user context
- Credentials found and where they came from
- Privileges confirmed on each host
- Commands used and key outputs
- Attack path decisions and why they worked
Why this matters: if you later need to explain how a low-privileged user became a higher-privileged operator, your notes should tell that story clearly. This also helps you identify weak domains during study. If your notes show lots of trial and error in one area, that area needs more practice.
How to separate memorization topics from scenario-based topics
Not all study topics deserve the same method. Some need flashcards or repetition. Others need labs and time under pressure.
Mostly memorization topics:
- Kerberos terms and ticket types
- Windows built-in groups and privileges
- Common ports and protocols
- AD object permission names and what they allow
- Remote execution prerequisites
- Basic C2 commands and workflow steps
Mostly scenario-based topics:
- Choosing the best enumeration path
- Turning graph findings into action
- Selecting a privilege escalation route
- Choosing a lateral movement method under constraints
- Deciding when to dump credentials versus use existing access
- Building a full compromise chain from small findings
A useful rule: if the topic answers “what is this?” it is often memorization-heavy. If it answers “what should I do next?” it is scenario-heavy.
How to convert each domain into practice sessions
Do not study domains as reading topics only. Convert each one into a short, focused practice block.
- AD fundamentals session: explain the environment structure from memory, then enumerate users, groups, and computers in a lab.
- Enumeration session: start with one low-privileged account and identify three possible attack paths.
- Credential access session: practice finding credentials in files, memory, tickets, or service accounts, then explain when each method is appropriate.
- Privilege escalation session: audit one host for local escalation paths and rank them by reliability.
- Lateral movement session: use at least two different remote execution methods to reach another system with the same credentials.
- C2 session: set up, manage, and pivot through sessions without losing track of context.
- Reporting session: write a one-page attack narrative from initial access to objective.
If you want to test whether your review is translating into exam-style readiness, use timed practice that forces you to move between domains instead of staying in one comfort zone. A focused resource for that is the Red Team Operator RTO/CRTO practice test. The value of timed practice is not just score checking. It shows whether you can shift from recall to action when the path is not obvious.
Recommended review order
A good review order reduces frustration because each domain supports the next one.
- Active Directory fundamentals — learn the map first.
- Basic enumeration — learn how to read the map in a live environment.
- Credential access and Kerberos abuse basics — learn common ways to gain stronger identity.
- Local privilege escalation — learn how to improve position on a host.
- Lateral movement — learn how to turn rights into reach.
- C2 and pivoting — learn how to operate efficiently across hosts.
- Azure and hybrid identity basics — add cloud-related privilege path awareness.
- Reporting and review drills — make your work repeatable and explainable.
This order works because it mirrors how attacks usually unfold. You first understand the environment, then gather paths, then improve access, then move, then manage the operation.
How to track weak areas without guessing
Weak-area tracking should be evidence-based. Do not just say “I feel weak on AD.” Be more precise.
Create a simple review log with these columns:
- Domain
- Task attempted
- Result
- Time taken
- Why you got stuck
- Fix for next session
For example, “Lateral movement” is too broad. “Could not use WinRM because I forgot prerequisites and failed to verify group membership” is useful. That tells you exactly what to review.
Mini FAQ
Which domains matter most?
Usually Active Directory, enumeration, credential access, privilege escalation, and lateral movement carry the most practical weight. They form the main attack chain.
Is tool memorization enough?
No. Tool familiarity helps, but exams reward understanding. If one method fails, you need another path. That requires concepts, not just syntax.
How much Azure should I study?
Enough to understand identity, permissions, and secret exposure in a hybrid environment. Go deeper if your exam track or lab material clearly includes cloud-heavy content.
What if I keep forgetting commands?
Build small operator cheat sheets by task, not by tool. Group commands under goals like enumerate users, check local admin, dump credentials, move laterally, or pivot.
How do I know I am exam-ready?
You are close when you can start with limited access, identify multiple attack paths, execute one cleanly, document it, and recover if your first plan fails.
Final study takeaway
The best way to prepare for a Red Team Operator exam is to study domains as parts of one operating model, not as isolated chapters. Active Directory gives you the structure. Enumeration shows you the paths. Credential access and privilege escalation give you leverage. Lateral movement and C2 let you act on that leverage. Reporting proves you understood what happened. If you review in that order and turn each domain into repeatable hands-on sessions, your preparation will be much closer to what the exam actually demands.
