GRTP Passing Score 2026: Exactly What You Need to Pass

The Number: 76% on 82 Questions

If you are searching for the GIAC Red Team Professional (GRTP) passing score, the answer is short: 76%. GIAC applies that minimum to exam versions released on or after January 20, 2024. The exam contains 82 questions, runs three hours, and is delivered as a single proctored, web-based practitioner exam with CyberLive performance-based virtual-machine testing.

That is the headline. The rest of this article is about what the number does and does not tell you, because a passing percentage is only useful when you understand the exam that produces it. If you want the broader picture first, the What Is GRTP Certification? overview covers the credential itself, and the GRTP requirements guide covers eligibility.

What 76% Actually Means for Your Preparation

On a simple 82-item exam where every item counted equally, 76% would translate to roughly 63 correct responses. But treat that arithmetic as an illustration, not a promise. GIAC has not publicly specified the exact item types, the number of scored versus unscored items, or whether every scored item carries equal weight. Because those details are unpublished, any claim that you can "miss exactly 19 questions and still pass" is an assumption, not an issuer-confirmed fact.

The practical takeaway is to prepare for a comfortable margin rather than a calculated minimum. Candidates who aim for the threshold itself tend to discover that one weak objective can pull the total below it, especially on a hands-on exam where a single misunderstood technique can cost several consecutive tasks.

What to do with an unpublished item mix

• Do not plan around a specific number of "free misses."
• Aim to be reliably competent on all ten objectives instead of excellent on a few.
• Use your own timed practice results as your margin signal: if you routinely score well above 76% under realistic conditions, you have genuine headroom.

How the CyberLive Format Complicates Score Math

GIAC identifies GRTP as using CyberLive, its performance-based testing approach in which candidates work in live virtual machines rather than only choosing from answer options. The GRTP page describes CyberLive as replacing traditional multiple-choice testing, while GIAC's broader explanation of practitioner exams describes a combination of multiple-choice and practical challenges. That wording difference matters: it does not establish that the GRTP exam is entirely practical, and it does not reveal an exact numerical mixture.

What you can safely say is this: expect hands-on, virtual-machine-based tasks to be a meaningful part of the experience, and do not assume you can pass on recall alone. The published three-hour limit covers the single exam; no separate public practical timer was verified.

For a candid look at how demanding this combination is, see How Hard Is the GRTP Exam?

Why You See Other Passing Scores Online

Search for the GRTP passing score and you may find numbers that disagree with GIAC. This is the single most common source of confusion, so it is worth being explicit.

Where a third-party listing conflicts with GIAC, trust GIAC. Several of those pages appear to carry outdated or unverified figures, and one directory even attaches a "Version 6.0" label that is not an accepted current GIAC specification. Even GIAC itself tells candidates that the certification-information page for your purchased attempt is the authority for that attempt's specifications, so check that page after you register and treat it as final.

Ten Objectives, No Published Weights

GIAC lists ten exam-objective headings for GRTP. Importantly, GIAC does not publish percentage weights for them, and it does not identify a highest-weight objective. That means you should not assume the objectives are equal in question count, and you should not trust any site that claims precise per-domain percentages without citing GIAC.

The ten headings are:

1. Adversary Emulation Fundamentals
2. Attacking Active Directory
3. Command and Control infrastructure
4. Creating the Attack infrastructure
5. Discovery and Enumeration
6. Enumerating and Attacking Privileges
7. Gaining Access
8. Leveraging the Domain
9. Persistence and Exfiltration
10. Red Team Engagement Planning and Reporting

The affiliated SANS course, SEC565: Red Team Operations and Adversary Emulation, groups these ten headings into six practical course sections. That grouping is a preparation curriculum, not proof of exhaustive exam coverage, and its capstone Capture the Flag is preparation rather than a separate exam requirement. For a full walkthrough of each area, read the GRTP exam domains guide.

Passing Score vs. Pass Rate vs. Seller Claims

These three quantities are routinely mixed up, and mixing them up leads to bad decisions.

• Minimum passing score (76%): the threshold you must reach. It is published by GIAC.
• Population pass rate: the share of all candidates who pass. GIAC has not published this for GRTP, and anecdotes from forums do not establish it. See GRTP Pass Rate: What the Data Shows for how to think about it responsibly.
• A seller's "customer success" claim: a marketing statement from a question-bank vendor. Its basis is unverified, and some dump-style sites market aggressively on this point.

A high claimed success rate from a vendor says nothing about the 76% threshold, and the 76% threshold says nothing about how many people pass. Keep them separate in your head.

Exam-Day Rules That Protect Your Score

A passing score is easier to reach when you do not lose points to avoidable rule problems. These conditions come from GIAC's published materials:

• Allowed references: paper books, notes, and an index are permitted.
• Prohibited references: electronic or internet resources and exam or practice-question references are not allowed.
• No revisions after submission: once you submit an answer, it cannot be revised.
• Skipping and breaks: GIAC provides a limited skip allowance and 15 minutes of break time.
• Delivery: Pearson VUE onsite or ProctorU remote, subject to attempt-specific modality restrictions.

The "no revisions" rule changes how you should work. Since you cannot return to fix an answer after submitting it, you need a deliberate approach: answer what you know, use the limited skips sparingly on items that would otherwise burn disproportionate time, and avoid submitting while uncertain if a skip is still available. Whether a calculator or adaptive testing applies to this exact exam is unverified, so do not assume either.

Your paper index is your strongest legal asset. A well-organized index that maps theory, commands, and lab procedures to the objectives can recover minutes on tasks where you remember the technique but not the syntax. The GRTP cheat sheet is a good starting framework for deciding what belongs in it.

If You Miss the Mark: Retake Mechanics and Costs

Knowing the downside makes the passing score less intimidating. Here is how a miss is handled, according to GIAC's published policies:

Two clarifications matter here. First, the 120-day attempt window is an access period for scheduling and sitting the exam, not an exam duration. Second, the retake's 60-day extension includes the 30-day wait, so it is not an additional stack of time. Budgeting details are laid out in the GRTP certification cost breakdown, and scheduling specifics are in GRTP exam dates and deadlines.

The financial reality is that an unprepared first attempt is expensive, which is exactly why a realistic readiness check, such as timed practice on the main practice test site, is worth doing before you commit your date.

Scheduling Your Preparation Around the Objectives

Generic study advice is not very useful for a hands-on exam. Instead, order your preparation so the foundations come before the techniques that depend on them. The timeline below is one reasonable sequencing across the ten objectives; adjust the length to your own background and your attempt window.

The logic: infrastructure and C2 come first because later lab work assumes you can stand up and operate a working environment. Active Directory and domain objectives come after access and enumeration because they build directly on them. Planning and reporting go last so you can fold the earlier technical material into how an engagement is scoped and documented. For a fuller week-by-week approach, see the GRTP study guide, and for the training pathway itself see GRTP training.

Don't Import Another Credential's Passing Rules

Many candidates arrive at GRTP after another red team credential, and it is natural to assume the rules transfer. They do not. GRTP is a GIAC credential. Altered Security's CRTP (Certified Red Team Professional), Zero-Point Security's Red Team Operator credential (searched as CRTO), and OffSec's OSEP are each issued by different organizations with their own formats and scoring. For instance, OffSec's OSEP assessment runs 47 hours and 45 minutes followed by a separate 24-hour documentation-upload window. Those timings, and any other credential's objectives or passing criteria, never apply to GRTP's three-hour, 82-question exam with a 76% minimum.

Being comfortable with one of those certifications is genuinely useful experience, but it is not a substitute for checking GIAC's specifics. Treat prior credentials as skill-building, not as a source of exam-day expectations.

Frequently Asked Questions

The passing score itself is simple: 76%. What makes it challenging is the combination of a hands-on format, ten unweighted objectives, and no room to revise submitted answers. Build breadth across every objective, test yourself under realistic conditions, and verify every number against GIAC before you trust it. When you are ready to measure where you stand, start with realistic GRTP practice questions, and use the GRTP ROI analysis and GRTP jobs overview to decide how the credential fits your career plan.