If you are preparing for the Red Team Operator exam, or the CRTO path more broadly, you do not need another vague list of “study hard” tips. You need a plan that tells you what to study, when to study it, and how to tell if you are actually getting better. This guide is built for that purpose. It is for candidates with some hands-on security background who want a practical 30-day roadmap focused on red team tradecraft, Active Directory abuse, operational thinking, and exam readiness. The goal is not just to pass. The goal is to build habits that help you perform under pressure in a live lab or operator-style exam.
Who should use this study guide
This guide fits best if you are already working in, or moving toward, one of these roles:
- Penetration tester who wants stronger Active Directory attack skills
- Red team operator who needs a structured review before the exam
- Security consultant who understands general exploitation but needs better post-exploitation and lateral movement discipline
- Blue teamer or detection engineer who wants to understand operator behavior from the attacker side
It is less useful if you are brand new to Windows internals, networking, or command-line work. The exam rewards execution, not just recognition. That means you need enough baseline skill to move through a domain, troubleshoot access issues, and make decisions when the obvious path fails.
What the exam is really testing
At a high level, the exam tests whether you can operate inside a Windows domain like a capable attacker. That includes enumeration, privilege escalation, lateral movement, credential abuse, and using common operator tooling with intent. The technical steps matter, but the deeper test is this: can you chain findings together without getting lost?
Many candidates fail because they study isolated techniques and never practice transitions. For example, they know how to run a tool that lists Kerberoastable accounts, but they do not know what to do after recovering a password. Or they understand token abuse in theory, but they cannot decide when it is the best next step. A good study plan fixes that by connecting each skill to a decision point.
Prerequisite knowledge and tools
Before you start a 30-day plan, make sure you are not spending your first week learning basics that should already be familiar. You do not need to be an expert in all of these, but you should be comfortable enough to work without constant hand-holding.
Core knowledge to have first:
- Windows and Active Directory basics: domains, users, groups, Kerberos, NTLM, SMB, WinRM, LDAP
- Networking fundamentals: ports, name resolution, routing, pivoting basics
- Linux and Windows command line: file movement, process handling, remote execution basics
- Privilege escalation concepts: local admin, service abuse, scheduled tasks, tokens, credentials in memory
- Operational discipline: note-taking, command logging, testing assumptions before acting
Tools you should be able to use with confidence:
- Command and Control framework used in your training path
- BloodHound for relationship mapping
- Mimikatz or equivalent credential access tooling
- Rubeus or equivalent Kerberos abuse tooling
- PowerView or native domain enumeration methods
- SMB, PSExec-style, WMI, or WinRM remote access methods
- Basic scripting or command chaining for repeatable tasks
If any of these feel weak, do not ignore that. Weak basics slow everything later. The exam clock punishes confusion.
The 30-day study plan
This plan assumes you can study at least 1 to 2 focused hours on weekdays and more on weekends. If you have less time, keep the order the same and stretch the schedule. Do not compress it by skipping review days. Review is where scattered knowledge becomes usable skill.
Days 1–6: Build the foundation
The first phase is about orientation and workflow. You are not chasing difficult paths yet. You are making sure your environment, notes, and basic operator actions are clean and repeatable.
What to do:
- Set up your lab, VM snapshots, note template, and command reference sheet
- Review AD structure: domain users, groups, computers, trusts, GPO basics
- Practice host and domain enumeration from a low-privileged starting point
- Map common lateral movement methods and the conditions needed for each
- Review how Kerberos works in practical attack terms, not only theory
Your goal by day 6: You should be able to enter a domain context, enumerate key objects, identify attack surface, and document next actions without guessing.
Why this phase matters: Many candidates waste time because their process is messy. They run commands without tracking output, repeat work, and lose access paths they already found. The exam is easier when your workflow is stable.
Days 7–12: Domain abuse and operator techniques
This is the core of the month. Focus on domain-centric attack paths that appear often in labs and real engagements.
Study areas:
- User and group enumeration that leads to action, not just visibility
- Kerberoasting and AS-REP roasting
- Delegation abuse concepts and common misconfigurations
- Local admin reuse and password spraying logic
- Credential dumping and safe handling of recovered secrets
- Lateral movement using the access methods available to you
- Privilege escalation from local foothold to more useful domain position
Daily routine:
- Pick one technique
- Execute it in a lab from memory first
- Write down what conditions made it work
- List one sign that tells you the technique will probably fail
- Practice one fallback option
This “condition and fallback” habit matters because operator exams rarely fail on knowledge alone. They fail when a candidate cannot adapt.
Days 13–18: Azure and hybrid review if included in your path
Some candidates over-focus on traditional AD and treat Azure as an afterthought. That is a mistake if your training or target role includes hybrid identity thinking. Even when the exam is mainly AD-focused, understanding cloud-connected identity flows sharpens your reasoning.
Focus on:
- Azure AD object roles and privilege relationships
- Differences between on-prem AD abuse and cloud identity abuse
- Service principals, application permissions, and role assignments
- Token and consent-related attack ideas at a conceptual level
- Hybrid identity misconfigurations that create operator opportunities
Your goal: You should be able to explain how identity control shifts between on-prem and cloud systems, and how that changes your attack path.
If your specific exam version or training path is not Azure-heavy, keep this section shorter and use the extra time on AD lateral movement and privilege escalation.
Days 19–22: Practice questions and scenario review
Now switch from pure study to exam-style thinking. This is where you test whether you can identify the best next move quickly.
Use practice in three ways:
- Recall practice: Can you explain a technique without notes?
- Scenario practice: Given a foothold and some findings, what comes next?
- Error review: Why did your choice fail, and what clue did you miss?
Do not treat practice questions as trivia. A useful question is one that forces you to compare options. For example, if you have valid domain credentials but no local admin rights, should you dump creds, enumerate sessions, look for delegation, or check group memberships first? The value is in the reasoning.
Practice with the relevant page only: https://securitypracticetest.com/red-team-operator-rto-crto-practice-test/
Days 23–26: Repair weak areas
By this point, patterns should be clear. Maybe you are strong on enumeration but slow with Kerberos abuse. Maybe you understand privilege escalation but miss the signs of delegation exposure. This phase is for targeted repair, not broad review.
How to identify weak areas honestly:
- Track tasks that require notes every time
- Mark commands you often mistype or misuse
- Notice where you lose time during troubleshooting
- Review failed lab chains, not just failed individual commands
Then fix them with short loops:
- Rebuild the attack path from scratch
- Repeat it until you can do it cleanly
- Explain why each step is used
- Add one variation, such as different credentials or access level
This matters because the exam does not care whether you once completed a technique. It cares whether you can do it again under pressure.
Days 27–30: Final revision and simulation
The last four days should feel calm, not chaotic. If you are still trying to learn major new topics here, your earlier phases were too shallow. Final revision is about confidence, speed, and decision-making.
What to do:
- Run one or two timed mini-scenarios
- Review your note structure and quick-reference commands
- Practice starting from a fresh foothold and building a path upward
- Review common failure points: DNS, permissions, context, wrong target assumptions
- Sleep properly and reduce context switching
Your final checkpoint:
- Can you enumerate without relying on a walkthrough?
- Can you recognize likely privilege paths from group and session data?
- Can you move laterally using more than one method?
- Can you recover from a dead end without panic?
- Can you explain your own chain clearly in notes?
How to review explanations without memorizing answers
This is one of the most important parts of exam prep. Memorizing answers feels efficient, but it creates fragile confidence. The exam will change the surface details. If all you learned was the exact answer to one pattern, you will freeze when the pattern is slightly different.
Use this review method instead:
- Ask what clue triggered the right answer. Example: Was it a service ticket opportunity, local admin reuse, or delegated privilege clue?
- Ask what assumptions were required. Did the action depend on network reachability, valid creds, local admin rights, or a specific protocol?
- Ask what the nearest wrong answer missed. This helps you separate similar techniques.
- Rephrase the explanation in your own words. If you cannot explain it simply, you probably do not own it yet.
- Redo the problem with one changed variable. For example, same user rights but a different host access method.
A simple test works well: hide the original answer and write your own action plan in two or three sentences. If your reasoning is sound, you are learning. If you only remember the command, you are not ready.
Final-week readiness routine
The final week should not be about panic study. It should be about preserving clarity. Operator exams reward steady thinking more than frantic energy.
A good final-week routine looks like this:
- Spend 60 to 90 minutes per day on focused review, not endless browsing
- Run one short lab chain each day from low privilege to meaningful access
- Review your personal checklist for enumeration, credentials, sessions, groups, and movement options
- Clean up your notes so they are easy to scan during practice
- Stop heavy study the night before and get proper sleep
This is also a good time to prepare a simple red team engagement checklist for yourself. Include initial enumeration, credential opportunities, privilege path review, lateral movement options, opsec notes, and documentation steps. That kind of checklist is useful far beyond the exam. It helps practitioners keep structure during real internal operations, which is why it is something others may also want to reference and share.
Practical checklist for exam prep
Use this as a final pass before exam day:
- I can explain the exam scope and likely task flow in plain language
- I know my main enumeration commands and when to use them
- I understand Kerberos attacks well enough to choose the right one
- I can identify and use common lateral movement paths
- I can document findings and keep a clean attack chain
- I have reviewed my weak areas at least twice
- I have practiced under time pressure
- I can recover from failed commands without losing momentum
- I am studying explanations, not memorizing answer keys
- I have a calm routine for the final 48 hours
FAQ
How many hours do I need each day?
For a 30-day plan, 1 to 2 focused hours on weekdays and 3 to 4 hours on weekends is realistic for many working professionals. More is not always better. Focus matters more than sitting at your desk for long periods while distracted.
What if I fail a practice set badly?
That is useful data, not proof that you are not ready. Look for patterns. Did you miss AD relationships, choose the wrong post-exploitation step, or get stuck on tool syntax? Fix the category, not just the missed question.
Should I retake the same questions?
Yes, but only after reviewing the reasoning and letting some time pass. The purpose of a retake is to test whether you learned the logic. If you retake too soon, you may only remember the answer shape.
How do I know if I am ready?
You are close when you can start from a modest foothold, enumerate with purpose, identify likely paths, and adapt when the first option fails. Readiness is less about perfect recall and more about consistent problem-solving.
Should I prioritize labs or practice questions?
You need both, but labs should lead. Labs build execution skill. Practice questions sharpen recognition and decision-making. If you can answer questions but cannot perform the chain in a lab, that is a warning sign.
What is the best way to use my notes?
Keep them short, structured, and action-focused. Organize them by phase: enumeration, credentials, privilege escalation, lateral movement, and troubleshooting. Notes should help you decide, not bury you in copied commands.
Closing advice
The strongest RTO or CRTO candidates are not the ones who memorized the most commands. They are the ones who understand how domain abuse works as a system. They know why a path matters, what conditions it depends on, and what to try next when it breaks. If you follow a 30-day plan with that mindset, your prep will be more useful, your practice will be more honest, and your exam performance will be more stable.
Study like an operator. That means staying organized, thinking in chains, and learning from every missed step. That approach helps you pass the exam, but more importantly, it makes you better at the work itself.
