- How GIAC Structures the GRTP Objectives
- Exam Mechanics That Shape How You Study
- Planning, Emulation and Reporting: Domains 1 and 10
- Infrastructure and C2: Domains 3 and 4
- Access and Discovery: Domains 5 and 7
- Active Directory, Privileges and the Domain: Domains 2, 6 and 8
- Persistence and Exfiltration: Domain 9
- Mapping the Ten Objectives to SEC565
- Building a Paper Index Around the Objectives
- Sequencing the Domains Across Your Prep
- Frequently Asked Questions
- GIAC publishes ten GRTP exam-objective headings but no percentage weights, so never trust a site quoting domain percentages.
- The exam has 82 questions, a 3-hour limit and a 76% minimum passing score, delivered with CyberLive virtual-machine testing.
- Paper books and notes are allowed; electronic references and practice-question materials are prohibited, so index quality matters.
- SANS SEC565 groups the ten objectives into six practical course domains; its capstone CTF is preparation, not an exam requirement.
How GIAC Structures the GRTP Objectives
The GIAC Red Team Professional (GRTP) certification lists its scope as a sequence of ten exam-objective headings on the official certification page. Those headings are what this guide calls "domains." It is worth being precise about what that word means here: GIAC does not publish an issuer-numbered, percentage-weighted domain system for GRTP. The ten headings are simply the published objective list, and the retrieved sources do not state which objective carries the most questions.
That matters because many third-party pages invent a tidy weighting table. Treat any such table with suspicion. Without official weights, the safest strategy is to prepare all ten areas to working depth rather than gambling on a guessed high-value domain. If you are new to the credential, start with What Is GRTP Certification? for the identity basics, then return here for the objective-by-objective breakdown.
Exam Mechanics That Shape How You Study
Before diving into the domains, the format determines how each topic must be learned. GRTP is a single proctored, web-based practitioner exam with 82 questions and a three-hour time limit. The minimum passing score is 76% for exam versions released on or after January 20, 2024. GIAC identifies CyberLive, its performance-based virtual-machine testing, as part of the delivery. The exact mixture of item types and the scored versus unscored counts are not publicly specified, so avoid any source that claims a precise ratio.
Two special conditions directly affect preparation. First, paper books, notes and indexes are permitted, while electronic and internet references and exam or practice-question references are prohibited. Second, answers cannot be revised after submission, GIAC provides a limited skip allowance, and you receive 15 minutes of break time. For a deeper look at the scoring threshold, see GRTP Passing Score 2026: Exactly What You Need to Pass.
| Exam Fact | GIAC Red Team Professional (GRTP) |
|---|---|
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (versions released on or after January 20, 2024) |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt-specific restrictions |
| Exam fee | USD 999 before tax |
| Retake after failure | USD 899 |
| Validity | 4 years |
Be aware that some third-party sites still list 75 questions, 120 minutes or a USD 979 fee. Those do not match GIAC's current published specifications. Full pricing mechanics are covered in GRTP Certification Cost 2026: Complete Pricing Breakdown.
Planning, Emulation and Reporting: Domains 1 and 10
The first and last objective headings bookend an engagement. They are the least tool-heavy but often the most underestimated, because candidates with strong hands-on skills assume the "soft" material will take care of itself.
Domain 1: Adversary Emulation Fundamentals
This area establishes the mindset that separates red teaming from a standard penetration test: emulating a realistic adversary against defined objectives rather than enumerating every vulnerability.
- How threat intelligence shapes an emulation plan
- Mapping adversary behaviors to a consistent technique framework
- The difference between a red team operation and a vulnerability assessment
- Defining objectives, scope and success criteria before touching a target
Domain 10: Red Team Engagement Planning and Reporting
This area covers the paperwork and communication that make an operation legitimate and useful to the customer.
- Rules of engagement, authorization and deconfliction concepts
- Structuring findings so defenders can act on them
- Communicating results to technical and non-technical audiences
- Documenting activity so detections can be validated afterward
Because these two domains are conceptual, they lend themselves well to a paper index of definitions and framework references. They are also where candidates coming from pure exploitation backgrounds tend to lose easy points.
Infrastructure and C2: Domains 3 and 4
Domains 3 and 4 are tightly coupled. One covers the command and control layer; the other covers the broader attack infrastructure that supports it.
Domain 3: Command and Control infrastructure
Expect to understand how operators control implants and how that traffic is shaped and protected.
- Core C2 concepts: listeners, implants, tasking and callbacks
- Interpreting C2 output and operator console behavior
- Communication channels and how they affect detection risk
- Operational handling of sessions during a live engagement
Domain 4: Creating the Attack infrastructure
This area deals with building the environment an operation runs from before any target is touched.
- Layered infrastructure design and separating operational roles
- Redirection and front-end concepts that protect the team server
- Planning infrastructure for resilience and attribution control
- Pre-engagement setup decisions and their trade-offs
Access and Discovery: Domains 5 and 7
Gaining a foothold and learning the environment are the operational heart of any engagement, and they produce much of the command-line material you will want indexed.
Domain 7: Gaining Access
Initial access is about getting code execution inside the target while avoiding the defenses an organization has in place.
- Common initial access paths and the preconditions each requires
- Payload delivery considerations and why defenders catch them
- Credential-based access versus exploitation-based access
- Choosing the access path that best fits an emulated adversary
Domain 5: Discovery and Enumeration
Once inside, an operator must understand the environment quietly and efficiently.
- Host, network and user enumeration from a compromised foothold
- Balancing enumeration depth against the noise it generates
- Identifying high-value targets and likely attack paths
- Reading enumeration output quickly to decide the next move
Discovery and enumeration reward speed. In a three-hour exam with 82 questions, the ability to recall the right command syntax or recognize an output pattern without hunting through notes is a genuine advantage. Our GRTP difficulty guide discusses where candidates report time pressure.
Active Directory, Privileges and the Domain: Domains 2, 6 and 8
Three of the ten headings concern Windows enterprise environments, and together they likely represent the densest technical content on the exam. Without published weights, we cannot say they carry a particular share of questions, but their number of dedicated headings signals how central they are to red team operations.
Domain 2: Attacking Active Directory
Active Directory is the connective tissue of most enterprise networks, and attacking it is a staple of adversary emulation.
- Directory structure, trusts and the relationships operators exploit
- Authentication protocols and how attackers abuse them
- Credential material: where it lives and how it is obtained
- Enumerating and abusing directory objects and configurations
Domain 6: Enumerating and Attacking Privileges
This area is about moving from limited access to the rights needed to reach an objective.
- Local and domain privilege enumeration
- Misconfigurations that allow escalation
- Token, service and permission-based escalation concepts
- Recognizing which privilege level a given objective demands
Domain 8: Leveraging the Domain
With sufficient privilege, the domain itself becomes the platform for reaching objectives at scale.
- Lateral movement techniques across domain-joined systems
- Using domain-level trust and delegation to expand access
- Reaching objective systems while limiting detection exposure
- Chaining individual techniques into a coherent attack path
Key Takeaway
Treat Domains 2, 6 and 8 as one connected chain: understand the directory, find the privilege path, then use the domain. Studying them as isolated command lists makes scenario questions harder than they need to be.
Persistence and Exfiltration: Domain 9
Domain 9: Persistence and Exfiltration
The final operational phase covers maintaining access and moving data out, both of which carry real detection risk.
- Persistence mechanisms and the trade-off between durability and stealth
- Choosing persistence appropriate to the access level held
- Data staging and exfiltration channels
- How defenders detect persistence and exfiltration activity
Here, understanding the defender's view pays dividends. Because red team value comes from improving detection, questions in this area often reward knowing not only how a technique works but what it leaves behind.
Mapping the Ten Objectives to SEC565
SANS offers SEC565: Red Team Operations and Adversary Emulation as its affiliated preparation course. SANS groups the ten GIAC objectives into six practical course domains. The current SEC565 page lists 28 labs, six instructor-led days and 36 self-paced hours, and the course includes a capstone Capture the Flag. These are training features: they are not exam task counts, an exam duration or a certification requirement.
The SEC565 materials are an unweighted preparation curriculum, not proof that every exam topic is covered or that the exam has six domains. Newer curriculum topics, such as AI-assisted intelligence analysis and MCP-based C2, appear in the course flyer but do not establish additional GIAC objective headings or a 2026 exam version. For a broader view of training options, see GRTP Training.
| Concept | What It Is | What It Is Not |
|---|---|---|
| Ten GIAC objective headings | The official published exam scope | A weighted blueprint |
| Six SANS course domains | A preparation grouping of those objectives | An exam structure |
| SEC565 capstone CTF | Practice within the training course | An exam requirement |
| 28 labs / 36 self-paced hours | Training course features | Exam task counts or duration |
Taking the course is optional: GIAC lists no mandatory education, experience hours, training hours or references to sit the exam. Details are in GRTP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Building a Paper Index Around the Objectives
Because paper materials are permitted and electronic references are not, your index is effectively your only reference tool. Candidate discussions on r/GIAC show real interest in a theory, command and lab index, though those anecdotes do not validate any particular method. A sensible way to organize it is by the ten objective headings, with three layers per domain:
- Theory: definitions, protocol behavior and the reasoning behind each technique.
- Commands: syntax and flags you need to recall quickly, especially for Domains 5, 6 and 8.
- Labs: the exact steps and gotchas you hit while practicing, tagged to the objective they belong to.
Keep the index to material you personally worked through, since prohibited exam or practice-question references cannot be brought in. A compact companion sheet is described in GRTP Cheat Sheet 2026: One-Page Review of Must-Know Facts.
Sequencing the Domains Across Your Prep
Rather than study in numbered order, sequence the domains the way an operation unfolds, so each week builds context for the next. This is the one scheduling suggestion in this guide, and it is tied directly to the objectives.
Foundations and Infrastructure
- Domain 1: Adversary Emulation Fundamentals
- Domain 10: planning and reporting concepts, to frame everything else
- Domains 4 and 3: attack infrastructure, then C2
Getting In and Looking Around
- Domain 7: Gaining Access
- Domain 5: Discovery and Enumeration, with command drilling
The Active Directory Chain
- Domain 2: Attacking Active Directory
- Domain 6: Enumerating and Attacking Privileges
- Domain 8: Leveraging the Domain
Persistence, Review and Index
- Domain 9: Persistence and Exfiltration
- Finalize the paper index and rehearse live-environment tasks
Adjust the pace to your background: candidates who already operate in Windows environments daily may compress Week 3, while those newer to C2 may extend Week 1. For a fuller plan, read the GRTP Study Guide 2026: How to Pass on Your First Attempt, and use the GRTP practice test site to check your recall under timed conditions.
Registration, Windows and Renewal Context
Domain knowledge is only part of the picture. A standalone attempt is valid for 120 days from activation, while bundled training attempts run 120 days from the end of the event or match the OnDemand course deadline. A failed-exam retake normally requires a 30-day wait, and three failures trigger a one-year wait. Extensions add 45 days within a 570-day total-access limit. For scheduling details, see GRTP Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Once earned, the credential is valid for four years. Renewal requires 36 qualifying CPEs during the active cycle or passing the renewal exam, with a USD 499 renewal fee. If you are weighing the investment, our analyses of whether the GRTP certification is worth it and the pass-rate evidence explain why the available data is limited: no representative GRTP-specific pass rate or salary dataset has been verified, so be cautious with any figure you encounter.
Frequently Asked Questions
GIAC publishes ten exam-objective headings for GIAC Red Team Professional (GRTP). They are a sequential objective list rather than an issuer-numbered weighted domain system, and GIAC has not published percentage weights for them.
That is not published in the retrieved GIAC sources. Neither percentage weights nor equal per-objective question allocations should be assumed, so prepare all ten areas rather than betting on one.
No. SANS groups the ten objectives into six practical course domains for teaching purposes. The GIAC objective list remains the official scope, and the course grouping is a preparation curriculum, not an exam structure.
Paper books, notes and indexes are permitted. Electronic and internet references and exam or practice-question references are prohibited, so build your index from material you worked through yourself.
No. The SEC565 capstone Capture the Flag is part of the training course and serves as preparation. It is not a separate requirement for sitting or passing the GRTP exam.