- What You Are Actually Preparing For
- Verified Exam Facts at a Glance
- Preparing for the CyberLive Format
- Working Through the Ten Objectives
- Mapping Objectives to SEC565
- Building a Paper Index That Earns Its Weight
- A Domain-Ordered Study Schedule
- Registration, Fees and Attempt Windows
- Exam-Day Rules That Affect Your Strategy
- How GRTP Sits Beside CRTP, CRTO and OSEP
- Frequently Asked Questions
- GRTP is GIAC Red Team Professional: 82 questions, 3 hours, 76% minimum passing score, with CyberLive virtual-machine testing.
- GIAC publishes ten objective headings but no percentage weights, so study all ten rather than guessing a favorite.
- Paper books, notes and an index are allowed; electronic references and practice-question materials are prohibited.
- Answers cannot be revised after submission, so build skip-and-return discipline into your practice sessions.
What You Are Actually Preparing For
GIAC Red Team Professional (GRTP) is a GIAC Certifications credential covering red team operations and adversary emulation. It is administered by GIAC, LLC, and the affiliated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. Before you build a study plan, be clear about what this exam is not. The acronym is shared by other credentials, and several third-party sites mix up their details. Everything in this guide refers only to the GIAC exam. If you want the broader background first, start with What Is GRTP Certification? and then come back here.
The most useful mindset shift for a first attempt is this: GRTP rewards operational understanding, not memorized trivia. The exam objectives read like the phases of a real engagement, from planning and infrastructure through access, privilege abuse, domain takeover, persistence and reporting. Your preparation should follow the same arc.
Verified Exam Facts at a Glance
Candidate forums and question-bank sites often quote outdated numbers. The table below uses only the figures published by GIAC. Where GIAC does not publish a value, the table says so rather than guessing.
| Item | What GIAC publishes |
|---|---|
| Number of questions | 82 |
| Time limit | 3 hours for the single exam |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | One proctored web-based exam with CyberLive performance-based virtual-machine testing |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt-specific restrictions |
| Prerequisites | None mandatory; preparation is recommended |
| Exam fee | USD 999 before tax |
| Objective weights | Not published |
| Exact item-type counts | Not publicly specified |
Some third-party listings still show 75 questions, 120 minutes, a USD 979 fee or lower pass thresholds. Treat those as stale. For the numbers behind the threshold, see GRTP Passing Score 2026: Exactly What You Need to Pass, and for eligibility details see GRTP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Preparing for the CyberLive Format
GIAC identifies GRTP as using CyberLive, its performance-based testing in virtual machines. GIAC's page for the certification describes CyberLive as replacing traditional multiple-choice testing, while its general article on practitioner exams describes a combination of multiple-choice and practical challenges. GIAC has not published an exact numerical mix of item types, and no separate practical timer was verified. So the honest preparation advice is to avoid betting on any one ratio and to be ready for hands-on work inside the 3-hour limit.
What that means for how you practice
- Practice operating, not just recognizing. Marketplace practice tests often ask you to interpret command-and-control output in a static scenario. That is useful for concepts, but it is different from working in a live virtual machine. Do both.
- Time your lab work. With 82 questions in 3 hours, you have roughly two minutes per question on average. Hands-on tasks will not fit that average, so you must move quickly through the items you know and bank time for the slower ones.
- Rehearse commands without notes first. Then rehearse with your index. The goal is to know which tasks you can do from memory and which you need to look up.
For a candid look at what makes the exam demanding, see How Hard Is the GRTP Exam? Complete Difficulty Guide 2026.
Working Through the Ten Objectives
GIAC lists ten sequential exam-objective headings. They are not an issuer-numbered, weighted domain system, and GIAC has not published percentage weights or identified a highest-weight objective. Do not trust any source that assigns percentages. Instead, give every objective real attention. The detailed breakdown lives in GRTP Exam Domains 2026: Complete Guide to All 10 Content Areas; here is how to think about each one as a candidate.
Red Team Engagement Planning and Reporting
The bookends of the whole discipline. Expect scoping, rules of engagement, objectives, and how findings are communicated.
- Know how an engagement is scoped and what authorization documents establish.
- Understand how to translate technical activity into findings a defender can act on.
Adversary Emulation Fundamentals
The conceptual foundation: emulating a specific adversary's behavior rather than running a generic penetration test.
- Understand how threat intelligence shapes an emulation plan.
- Be comfortable with technique-oriented thinking and how activities map to adversary behavior.
Creating the Attack infrastructure and Command and Control infrastructure
Two adjacent objectives that reward practical familiarity with how operator infrastructure is built and how implants communicate.
- Understand the purpose of separating infrastructure roles and why resilience matters.
- Be able to reason about C2 behavior, callbacks and operator workflow.
Gaining Access and Discovery and Enumeration
Initial entry, then learning the environment. These are high-frequency real-world skills and natural candidates for hands-on tasks.
- Know common access paths and what each demands from the operator.
- Practice enumerating hosts, users, shares and trust relationships methodically.
Enumerating and Attacking Privileges and Attacking Active Directory
Moving from a foothold to meaningful control. Active Directory is central to most enterprise engagements.
- Understand privilege paths, misconfigurations and how to identify them.
- Know the major Active Directory attack concepts well enough to explain why they work, not just which command runs them.
Leveraging the Domain and Persistence and Exfiltration
The late-stage objectives: using domain-level access toward engagement goals, maintaining access, and moving data out.
- Understand how domain compromise supports objective completion.
- Know persistence options and their detection trade-offs, and the considerations around controlled data exfiltration.
Mapping Objectives to SEC565
SANS groups the ten GIAC objectives into six practical course sections in its SEC565 preparation material. The current course page lists 28 labs, six instructor-led days and 36 self-paced hours. Those are training features, not exam task counts or exam duration. SEC565 also ends with a capstone Capture the Flag, which is preparation rather than a separate certification requirement. Newer curriculum topics highlighted in the course flyer, such as AI-assisted intelligence analysis, tooling and MCP-based C2, are part of the training and do not establish additional GIAC objective headings or a separate 2026 exam version.
If you are weighing training versus self-study, GRTP Training covers the options in more depth.
Building a Paper Index That Earns Its Weight
GIAC permits paper books, notes and an index. It prohibits electronic and internet references, and it prohibits exam and practice-question references. That makes your index one of the few levers entirely under your control, and the strongest indexes are built from your own lab work rather than copied from a course book's table of contents.
A three-part structure that works
- Theory entries. Concepts, definitions and the reasoning behind techniques, indexed by the plain-language term you would think of under time pressure.
- Command entries. Syntax you cannot afford to reconstruct, with a one-line note on when to use it and what output to expect.
- Lab entries. A short pointer to where you practiced each task and the gotcha you hit, since hands-on items punish small mistakes.
Index by objective heading first, then alphabetically within each. Because the objectives mirror engagement phases, you will find entries faster if your index follows the same flow. For a compact companion, see GRTP Cheat Sheet 2026: One-Page Review of Must-Know Facts.
Key Takeaway
Build the index while you do labs, not afterward. Every time a command trips you up, write the corrected version and the symptom. Those entries are the ones that save minutes on exam day.
A Domain-Ordered Study Schedule
Because GIAC publishes no weights, an even spread across all ten objectives is the defensible default. The ordering below follows the engagement lifecycle so that each week builds on the last. Adjust the length to your starting experience; the timeline is a template, not a guarantee.
Foundations and Planning
- Adversary Emulation Fundamentals
- Red Team Engagement Planning and Reporting
- Start the index skeleton by objective heading
Infrastructure
- Creating the Attack infrastructure
- Command and Control infrastructure
- Hands-on: stand up and operate a small test setup
Entry and Reconnaissance
- Gaining Access
- Discovery and Enumeration
- Timed enumeration drills
Privileges and Active Directory
- Enumerating and Attacking Privileges
- Attacking Active Directory
- Explain each attack path aloud before running it
Domain Control and Endgame
- Leveraging the Domain
- Persistence and Exfiltration
- Finish and tighten the index
Integration
- Full end-to-end engagement run-through
- Timed sessions with skip-and-return practice
- Review weak objectives and trim the index
This single scheduling approach is deliberate. Spaced repetition and active recall help, but for GRTP the bigger win is rehearsing a whole engagement chain so the objectives feel connected rather than isolated.
Registration, Fees and Attempt Windows
Knowing the money and calendar rules prevents avoidable stress. These figures come from GIAC's published pricing and policies.
| Item | Published detail |
|---|---|
| Exam fee | USD 999 before tax; no member/non-member tiers published |
| Failed-exam retake | USD 899 |
| 45-day extension | USD 479 |
| Practice test | USD 399 |
| SANS-associated exam add-on | USD 999; course tuition is separate |
| Standalone attempt window | 120 days from activation |
| Bundled training window | 120 days from the end of the event and/or matching the OnDemand deadline |
| Extension limits | 45 days each, within a 570-day total-access limit |
The 120-day figure is an access window for taking the exam, not an exam duration. If you do not pass, a retake normally requires a 30-day wait, and three failures trigger a one-year wait. The full cost picture, including renewal, is in GRTP Certification Cost 2026: Complete Pricing Breakdown, and scheduling specifics are in GRTP Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Once certified, the credential is valid for 4 years. Renewal requires 36 qualifying CPEs within the cycle or passing the renewal exam, and the renewal fee is USD 499. GIAC states that CPE documentation and payment are due before expiry.
Exam-Day Rules That Affect Your Strategy
Several published policies should shape how you practice:
- No revisions after submission. Once you submit an answer, you cannot change it. Practice committing to answers rather than endlessly second-guessing.
- Limited skip allowance. GIAC provides a limited number of skips, so use them on genuinely time-consuming items, not as a way to avoid thinking.
- 15 minutes of break time. Plan when you would use it so it does not catch you off guard.
- Materials. Paper books, notes and your index only. Anything electronic, and any exam or practice-question reference, is off limits.
- Calculator and adaptive-testing status are unverified for this exact exam, so do not build your plan around either.
Whether you test at a Pearson VUE site or remotely through ProctorU depends on attempt-specific restrictions. Check your attempt page, and for remote delivery review GIAC's proctoring requirements well before test day.
How GRTP Sits Beside CRTP, CRTO and OSEP
Many candidates arrive after another red team credential. Keep the identities separate, because their formats and issuers are entirely different, and none of their details apply to GRTP.
| Credential | Issuer and focus |
|---|---|
| GRTP | GIAC Red Team Professional; proctored CyberLive exam, 82 questions in 3 hours |
| CRTP | Altered Security's separate Certified Red Team Professional credential |
| CRTO | Zero-Point Security's Red Team Operator credential, from its Red Team Operations course |
| OSEP | OffSec's credential, with a long assessment plus a separate documentation-upload window |
Candidate discussion shows real interest in taking GRTP after CRTO, but anecdotes are not a validated route or a pass rate. Prior hands-on Active Directory and C2 experience from another course will help with the practical objectives; it will not substitute for learning GIAC's ten headings and building your index.
Setting Realistic Expectations
It is tempting to chase a salary number, but no representative GRTP-specific salary dataset or verified causal uplift exists, and red-team job pay should not be read as certification-holder evidence. Likewise, a seller's claim about customer success is not a population pass rate, and a minimum passing score is not a pass rate either. For honest treatment of these, read GRTP Pass Rate 2026: What the Data Shows, GRTP Salary Guide 2026: Complete Earnings Analysis, and Is the GRTP Certification Worth It? Complete ROI Analysis 2026. For the hiring side, see GRTP Jobs.
When you are ready to test yourself under realistic conditions, use the GRTP practice test site to check your recall across all ten objectives, then return to your weak areas in the lab. Practice questions measure readiness, but they do not replace hands-on repetition inside a virtual machine.
Frequently Asked Questions
GIAC lists 82 questions with a 3-hour time limit. Older third-party pages quoting 75 questions or 120 minutes are outdated. Confirm the specifications on your own attempt's certification-information page.
The minimum passing score is 76% for exam versions released on or after January 20, 2024. Some third-party sites list lower thresholds, which conflict with GIAC's published figure.
Yes, paper books, notes and an index are permitted. Electronic and internet references are prohibited, as are exam and practice-question references. See the full study guide approach to building a useful index.
No mandatory education, experience hours, training hours or references are required. Preparation is recommended, though, and the exam is hands-on enough that real lab experience matters.
A retake costs USD 899 and normally requires a 30-day wait. Three failures trigger a one-year wait. Extensions add 45 days within a 570-day total-access limit.