- Which GRTP This Cheat Sheet Covers
- The Exam Numbers at a Glance
- Fees, Retakes and Access Windows
- The Ten Objectives in One Pass
- How SEC565 Groups the Objectives
- CyberLive: What Is and Isn't Known
- Building a Paper Index That Works
- Exam-Day Rules to Memorize
- Validity and Renewal Math
- GRTP vs CRTP, CRTO and OSEP
- Stale Numbers You Will See Online
- A Domain-Ordered Prep Schedule
- Frequently Asked Questions
- GRTP is GIAC Red Team Professional: 82 questions, 3 hours, 76% minimum passing score, with CyberLive virtual-machine testing.
- The exam fee is USD 999 before tax; a failed-exam retake is USD 899.
- Paper books, notes and an index are allowed; electronic references and practice-question material are prohibited.
- GIAC publishes ten objective headings but no percentage weights, so do not trust any weighted-domain pie chart.
Which GRTP This Cheat Sheet Covers
Several credentials share the GRTP acronym. This page covers one: GIAC Red Team Professional (GRTP), issued by GIAC Certifications (GIAC, LLC administers it). Nothing here applies to any other credential that happens to abbreviate the same way, so if a number on another site disagrees with the figures below, check which certification that site is actually describing. For the broader orientation, see What Is GRTP Certification? and What Does GRTP Stand For?.
Everything on this sheet comes from GIAC's published pages and policies, which were last verified in October 2026. One rule outranks this article: the certification-information page attached to your purchased attempt is the authority for that attempt's specifications. If it ever differs from a summary like this one, believe the attempt page.
The Exam Numbers at a Glance
| Item | GRTP Fact |
|---|---|
| Issuer | GIAC Certifications (GIAC, LLC) |
| Questions | 82 |
| Time limit | 3 hours (single exam; no separate public practical timer verified) |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | One proctored, web-based practitioner exam with CyberLive virtual-machine testing |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt-specific modality restrictions |
| Prerequisites | None mandatory; preparation recommended |
| Validity | 4 years |
| Objective headings | 10, with no published percentage weights |
Two arithmetic notes help with pacing. Three hours across 82 questions averages a little over two minutes per question, but performance-based items do not all cost the same time, so treat that average as a ceiling for quick items rather than a budget for every item. And because GIAC does not publish the scored/unscored split, do not compute "I can miss exactly N questions" from the 76% figure. Read the details in GRTP Passing Score 2026 for how to interpret a minimum score without overreading it.
Fees, Retakes and Access Windows
| Item | Amount / Rule |
|---|---|
| Exam fee | USD 999 before tax (no member/non-member tiers published) |
| Failed-exam retake | USD 899 |
| 45-day extension | USD 479 |
| Practice test | USD 399 |
| SANS-associated exam add-on | USD 999 (course tuition is separate) |
| Standalone attempt window | 120 days from activation |
| Bundled-training window | 120 days from the end of the event and/or matching the OnDemand course deadline |
Retake and extension rules
- A failed-exam retake normally requires a 30-day wait.
- The 60-day extension option includes that wait.
- Three failures trigger a one-year wait.
- Extensions add 45 days each, within a 570-day total-access limit.
The 120-day window is an access period, not an exam duration. It determines how long you have to sit the exam, not how long the exam runs. Budgeting details, including what is and is not included, are in GRTP Certification Cost 2026, and scheduling mechanics are in GRTP Exam Dates 2026.
The Ten Objectives in One Pass
GIAC lists ten sequential objective headings. They are headings, not an issuer-numbered weighted-domain system, so the order below is the order of the list and implies nothing about weight or importance. Here is what each demands in practical terms. For deeper treatment of each, use the complete guide to all 10 GRTP content areas.
Adversary Emulation Fundamentals
The conceptual frame for everything else: why red teams emulate specific adversaries rather than run generic scans.
- Know how adversary behavior is modeled, mapped and turned into an emulation plan.
- Be able to explain how this differs from a vulnerability assessment or conventional penetration test.
Red Team Engagement Planning and Reporting
The professional wrapper around the technical work.
- Rules of engagement, scoping, objectives and deconfliction.
- Reporting for both technical and executive audiences, including how findings tie back to emulated behaviors.
Creating the Attack infrastructure
Standing up the external-facing pieces an operation depends on.
- Redirectors, hosting, domains and the reasoning behind separating components.
- Operational security tradeoffs when building and tearing down infrastructure.
Command and Control infrastructure
How operators communicate with implants and manage sessions.
- C2 channels, listeners, profiles and how tasking and output flow.
- Interpreting what a C2 framework is showing you and choosing the right next action.
Gaining Access
Initial foothold techniques.
- Delivery and execution paths into a target environment.
- What happens right after execution: confirming the callback, establishing context, deciding the next move.
Discovery and Enumeration
Learning the environment from the inside.
- Host, network, user and domain enumeration, and which commands answer which question.
- Knowing what each enumeration step reveals and what it costs in noise.
Enumerating and Attacking Privileges
Moving from limited access toward meaningful access.
- Identifying privilege-escalation opportunities and the misconfigurations that create them.
- Understanding token, group and permission relationships well enough to reason about them, not just run tools.
Attacking Active Directory
The identity layer where most enterprise red-team paths run.
- Authentication mechanisms, credential material and the attacks that abuse them.
- Relationships between accounts, groups, delegation and trusts.
Leveraging the Domain
Turning a foothold into broad control.
- Lateral movement and using domain-level mechanisms to expand access.
- Choosing the path that reaches the engagement objective with the least unnecessary exposure.
Persistence and Exfiltration
Staying in and getting objectives out.
- Persistence mechanisms and their tradeoffs in stealth versus resilience.
- Exfiltration approaches and how they relate to the engagement's stated goals.
How SEC565 Groups the Objectives
The associated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. SANS organizes its material into six practical course domains rather than ten, and the course page lists 28 labs, six instructor-led days and 36 self-paced hours. Those are training features. They are not exam task counts, and they do not describe exam duration.
The course closes with a Capture the Flag capstone. That capstone is preparation, not a separate exam requirement, so do not confuse completing it with sitting for the certification. Likewise, the current SEC565 flyer mentions topics such as AI-assisted intelligence analysis, tooling and MCP-based C2. These are curriculum topics. They do not add objective headings to the GIAC list, and they do not establish a separately versioned 2026 exam outline. When in doubt, study to the ten GIAC headings above and treat extra course material as depth rather than scope.
CyberLive: What Is and Isn't Known
GIAC's GRTP page identifies CyberLive, its performance-based virtual-machine testing, as part of this exam. What is publicly not specified is the exact item-type mix and the scored versus unscored counts. GIAC's own wording differs slightly between pages: the GRTP page describes CyberLive as replacing traditional multiple-choice testing, while GIAC's broader article on practitioner exams describes them as combining multiple-choice and practical challenges. That wording gap does not prove the exam is entirely practical, and it does not prove any particular numerical split.
Preparing without a published item mix
- Be able to do it, not just recognize it. Practice running enumeration, privilege and Active Directory tasks hands-on until the commands and output are familiar.
- Still know the theory. Because a conceptual component cannot be ruled out, keep engagement planning, reporting and adversary-emulation fundamentals in your review.
- Practice reading output. Many red-team decisions hinge on interpreting what a tool returned. Rehearse that skill specifically.
- Watch the clock. Hands-on tasks can swallow time. Learn to cut your losses and move on.
Be careful with marketplace practice tests. Many present scenario questions in which you interpret C2 output, which is a useful skill but is not the same as operating a live virtual machine. The quality and equivalence of paid third-party material were not inspected for this article, so treat any such resource as a supplement, not a simulation of the GIAC environment. For a realistic read on difficulty, see How Hard Is the GRTP Exam?
Building a Paper Index That Works
Paper books, notes and an index are permitted. Electronic and internet resources are not, and neither are exam or practice-question references. That makes the index your single most controllable advantage, particularly for a format with a three-hour limit.
What to index for GRTP
- Theory: terms and concepts from adversary emulation, engagement planning and reporting, keyed to the objective heading they belong to.
- Commands: the syntax you actually use for enumeration, privilege checks, Active Directory operations and C2 tasking, with a one-line note on what the output means.
- Labs: the lab or exercise where you first saw the technique, so you can find the surrounding context fast.
Key Takeaway
Organize the index by task ("enumerate group membership," "check delegation") rather than only by tool name. Under time pressure you will remember what you need to accomplish before you remember which tool does it.
Do not paste exam or practice-question content into your notes. That category of reference is prohibited, and it is also a poor way to learn.
Exam-Day Rules to Memorize
- Answers cannot be revised after submission. Treat each submission as final.
- Skipping: GIAC provides a limited skip allowance. Use it for genuine time sinks, not as a habit.
- Breaks: 15 minutes of break time is provided.
- Allowed: paper books, notes and index.
- Not allowed: electronic or internet references, and exam or practice-question references.
- Calculator and adaptive-testing status: unverified for this exact exam, so do not assume either.
Choose your delivery mode early. Pearson VUE (onsite) and ProctorU (remote) are both offered, but modality can be restricted for a specific attempt, so confirm what your attempt allows before planning around a home setup. Eligibility details live in GRTP Requirements 2026; note that there are no mandatory education, experience-hour, training-hour or reference prerequisites to sit the exam.
Validity and Renewal Math
| Item | Rule |
|---|---|
| Validity | 4 years |
| CPE route | 36 qualifying CPEs during the active four-year cycle |
| Exam route | Pass the renewal exam |
| Renewal fee | USD 499 |
| Repeat renewal | USD 249 if within 2 years of a full-price renewal |
CPE documentation and payment are due before expiry, so start logging credits early in the cycle rather than in the final months. For the economics of the whole lifecycle, read Is the GRTP Certification Worth It?
GRTP vs CRTP, CRTO and OSEP
Searchers often compare these, and the acronyms invite mix-ups. Keep the identities separate.
| Credential | Issuer / Provider | What to remember |
|---|---|---|
| GRTP | GIAC | GIAC Red Team Professional: 82 questions, 3 hours, 76%, CyberLive |
| CRTP | Altered Security | Separate Certified Red Team Professional credential |
| CRTO | Zero-Point Security | Credential is Red Team Operator; the course is Red Team Operations |
| OSEP | OffSec | Distinct assessment structure, including a 47-hour-45-minute exam followed by a separate documentation-upload window |
The practical takeaway: timings, objectives and rules from one of these never carry over to another. In particular, do not apply OSEP's assessment length or reporting window to GRTP, whose published limit is a single three-hour exam. Candidates on community forums discuss moving to GRTP after CRTO, but those anecdotes do not establish a validated study path or any success rate.
Stale Numbers You Will See Online
Some third-party pages still circulate figures that do not match GIAC's current specifications. When you see them, trust GIAC.
- 75 questions: listed by some sites; GIAC's current figure is 82.
- 120 minutes: appears on some listings; GIAC's published limit is 3 hours.
- A USD 979 fee: appears in an older guide; the current fee is USD 999 before tax.
- Roughly 70% or 67% passing thresholds: conflict with GIAC's 76% minimum.
- "Version 6.0" labels: not an accepted current GIAC specification.
A Domain-Ordered Prep Schedule
The one place a schedule helps is ordering the objectives so that each builds on the last. Because no weights are published, the sequence below follows dependency, not importance. Adjust the length to your attempt window. Full strategy lives in the GRTP study guide.
Frame and Plan
- Adversary Emulation Fundamentals
- Red Team Engagement Planning and Reporting
- Start the index skeleton, one section per objective heading
Build and Command
- Creating the Attack infrastructure
- Command and Control infrastructure
- Practice reading C2 output until it is routine
Get In and Look Around
- Gaining Access
- Discovery and Enumeration
- Record every command and its meaning in the index
Escalate and Own the Domain
- Enumerating and Attacking Privileges
- Attacking Active Directory
- Leveraging the Domain
Stay, Extract, Rehearse
- Persistence and Exfiltration
- Timed hands-on run-throughs and index clean-up
- Take a practice run on the GRTP practice test site
Spend extra hands-on time on the Active Directory, privilege and domain objectives, since they chain together and punish shallow understanding. Revisit planning and reporting late as well, because it is easy to neglect when the technical material feels more urgent. When you are ready to test yourself, work through realistic questions at our main practice site, and for background reading on the fundamentals see What Is GRTP? and GRTP training options.
Frequently Asked Questions
GIAC lists 82 questions and a 3-hour limit. Some third-party sites still show 75 questions or 120 minutes; those figures do not match GIAC's current specifications.
The minimum passing score is 76% for exam versions released on or after January 20, 2024. GIAC does not publish a scored/unscored question split, so the 76% should not be converted into an exact number of allowed misses.
Yes. Paper books, notes and an index are permitted. Electronic and internet references, as well as exam or practice-question references, are prohibited.
No. GIAC publishes ten objective headings without percentage weights. Any chart assigning specific percentages to GRTP domains is not backed by the issuer sources reviewed here.
A failed-exam retake is USD 899 and normally requires a 30-day wait. Three failures trigger a one-year wait, and extensions add 45 days within a 570-day total-access limit.
Keep this sheet beside your index, confirm every detail against your own attempt's certification-information page before exam day, and use the GRTP cheat sheet as a quick refresher in the final days before your appointment.