- What "GRTP Training" Actually Covers
- The SANS SEC565 Route
- Building a Self-Directed Training Plan
- Mapping the Ten Objectives to Training Blocks
- Training for CyberLive Without Guessing the Format
- Building a Paper Index That Works
- Sequencing the Ten Objectives Across Your Weeks
- Cost and Access Windows That Shape Your Training
- Training Overlap With CRTP, CRTO and OSEP
- Frequently Asked Questions
- GRTP is GIAC Red Team Professional: 82 questions, 3 hours, 76% minimum passing score, with CyberLive virtual-machine testing.
- No prerequisites are required to sit the exam, but GIAC recommends preparation; SANS SEC565 is the affiliated course.
- Ten published objectives carry no public weights, so train every area rather than betting on a "heavy" domain.
- Paper books, notes and an index are allowed; electronic and practice-question references are prohibited.
What "GRTP Training" Actually Covers
When candidates search for GRTP training, they usually mean one of two things: the official SANS course that maps to the certification, or a self-built curriculum assembled from labs, books and tooling practice. Both are legitimate routes, because GIAC does not mandate any specific training, experience hours or references to sit the exam. What GIAC does publish is a list of ten exam objectives, and your training has to cover all of them.
If you are still orienting yourself, start with What Is GRTP Certification? for the credential's identity and purpose. This article assumes you have decided to pursue it and want to know how to train effectively. The credential here is the GIAC Red Team Professional (GRTP), issued by GIAC Certifications, and everything below applies to that credential only.
The SANS SEC565 Route
The affiliated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. According to the current course page, it includes 28 labs, six instructor-led days and 36 self-paced hours. SANS groups the GRTP objectives into six practical course domains and finishes with a capstone Capture the Flag. Those figures describe the training product. They are not exam task counts, and the exam duration is the three hours covered below.
What the course gives you
- A structured progression from engagement planning through attack infrastructure, access, privilege abuse, domain leverage and persistence.
- Hands-on lab time against the kind of Active Directory and command-and-control scenarios the objectives describe.
- Course books that you can legitimately take into the exam as paper references, provided you index them well.
- Recent curriculum topics, including AI-assisted intelligence analysis and MCP-based C2 tooling, which appear in the course flyer.
What the course does not guarantee
The flyer's newer topics are preparation material. They do not establish additional GIAC objective headings or a separately versioned 2026 exam outline, and the public objectives carry no edition identifier. Likewise, the capstone Capture the Flag is part of training, not a certification requirement. Use the course to build skill, then verify your actual attempt's specifications on the certification-information page for your purchased attempt.
Exam fee versus tuition
The SANS-associated exam add-on is USD 999, the same as the standalone exam fee, and tuition is separate. Budget for both if you choose the course route. The full breakdown is in GRTP Certification Cost 2026.
Building a Self-Directed Training Plan
Many candidates arrive from other red team certifications and already own relevant skills. If that is you, a self-directed plan can work, but only if it is anchored to the ten published objectives rather than to whatever tooling you happen to enjoy. The public sources suggest strong candidate interest in a theory, command and lab index, and in moving to GRTP after another red team credential. Anecdotes like these show interest, not a validated passing method, so treat them as context rather than a recipe.
A workable self-study plan has four components:
- A lab environment where you can build and break an Active Directory domain, stand up redirectors and run a C2 framework end to end.
- A reference library of books and printed notes that you will actually be allowed to bring into the exam.
- A running index that grows as you study, rather than one compiled in the last week.
- A gap log where each failed lab step or forgotten command is recorded against the objective it belongs to.
Mapping the Ten Objectives to Training Blocks
GIAC publishes ten exam-objective headings without percentage weights, and none is identified as highest-weighted. Do not infer weights or assume equal question counts per objective. Instead, make sure your training touches each one with both theory and hands-on practice. For a deeper walk through each area, see GRTP Exam Domains 2026: Complete Guide to All 10 Content Areas.
Adversary Emulation Fundamentals
The conceptual foundation: what emulating a threat actor means and how it differs from a generic penetration test.
- Practice articulating objectives, scope and threat-informed scenarios in plain language.
- Be able to connect a technique to the emulation goal it serves.
Red Team Engagement Planning and Reporting
Planning and reporting bookend the operation, and they are easy to underrate because they feel less technical.
- Rehearse how rules of engagement, deconfliction and reporting structure shape technical decisions.
- Prepare index entries for planning artifacts, not only for commands.
Creating the Attack infrastructure and Command and Control infrastructure
These two objectives cover how operators build and run the environment that supports an engagement.
- Build redirectors, staging and C2 listeners in a lab and note what each component is for.
- Practice reading C2 output and troubleshooting a broken callback.
Discovery and Enumeration, and Gaining Access
The reconnaissance and initial foothold phases.
- Drill enumeration workflows until you can choose a technique from the situation, not from a memorized list.
- Practice initial access methods in an environment where you control both sides.
Enumerating and Attacking Privileges
Moving from a foothold toward higher privilege on hosts and in the environment.
- Practice identifying privilege paths and the evidence that confirms them.
- Index command syntax separately from the reasoning behind it.
Attacking Active Directory and Leveraging the Domain
The directory-focused objectives, where most red team operations spend significant time.
- Work through domain enumeration, credential abuse and lateral movement in a lab domain.
- Understand what leveraging a domain position means for the engagement's objectives.
Persistence and Exfiltration
Maintaining access and moving data out within the rules of an engagement.
- Practice persistence mechanisms and understand their detection footprint.
- Be ready to reason about exfiltration choices, not just execute them.
Training for CyberLive Without Guessing the Format
GIAC identifies GRTP as using CyberLive, its performance-based virtual-machine testing. The GRTP page describes CyberLive as replacing traditional multiple-choice testing, while GIAC's broader category article describes practitioner exams as combining multiple-choice and practical challenges. That wording difference does not establish an all-practical exam, and the exact item types and scored versus unscored counts are not publicly specified. Anyone quoting you a precise mixture is guessing.
The sensible response is to train for both modes of thinking:
- Operating skills: be able to perform tasks in a live virtual machine without relying on a search engine, because internet and electronic references are prohibited.
- Interpretation skills: be able to read tool output, logs and C2 responses and decide what they mean.
- Time discipline: the published limit is three hours for the single exam, and no separate practical timer was verified.
Key Takeaway
Scenario questions that ask you to interpret C2 output are useful practice, but they are not the same as operating GIAC's live environment. Pair reading-based practice with real lab time, and check your attempt's certification-information page for the specifications that apply to you. Difficulty context is in How Hard Is the GRTP Exam?
Building a Paper Index That Works
GIAC permits paper books, notes and an index, and prohibits electronic and internet resources and exam or practice-question references. That makes the index one of the highest-leverage training outputs you can produce, and it should be built during training, not afterward. A quick reference version of the key facts is also covered in the GRTP Cheat Sheet.
A three-layer index
- Theory layer: concepts, definitions and the reasoning behind techniques, organized by the ten objectives.
- Command layer: tool syntax, flags and common error messages, cross-referenced to the objective where you use them.
- Lab layer: short notes on what worked, what failed and why, drawn from your own gap log.
Index habits that pay off
- Index as you study; a last-week index inherits last-week gaps.
- Record the page and book for each entry, so lookups take seconds.
- Test the index with timed lookups before exam day, since answers cannot be revised after submission and you have a limited skip allowance rather than unlimited navigation.
- Remember the 15 minutes of break time and plan your pacing around it.
Sequencing the Ten Objectives Across Your Weeks
Generic scheduling advice is less useful than ordering that follows how an engagement actually flows. The sequence below follows that dependency chain, so each week builds on skills from the previous one. Adjust the length to your background; a candidate fresh from another Active Directory credential may compress the early weeks.
Foundations and Planning
- Adversary Emulation Fundamentals
- Red Team Engagement Planning and Reporting
- Start the index skeleton, organized by all ten objectives
Infrastructure
- Creating the Attack infrastructure
- Command and Control infrastructure
- Build and tear down a lab C2 setup at least twice
Reaching and Mapping the Target
- Discovery and Enumeration
- Gaining Access
Privilege and Directory Attacks
- Enumerating and Attacking Privileges
- Attacking Active Directory
Domain Leverage and Staying Power
- Leveraging the Domain
- Persistence and Exfiltration
Integration
- Run an end-to-end mock engagement from planning to report
- Time your index lookups and patch gaps from your log
- Take a practice test at our practice test site to surface weak objectives
Cost and Access Windows That Shape Your Training
Training timelines and exam logistics interact. GIAC's attempt delivery policy gives a standalone attempt 120 days from activation, and a bundled-training attempt 120 days from the end of the event or matching the OnDemand course deadline. These are access windows, not exam durations, and they are why you should finish most of your preparation before you activate. For scheduling specifics, see GRTP Exam Dates 2026.
| Item | Published figure |
|---|---|
| Exam fee | USD 999 before tax |
| Failed-exam retake | USD 899 |
| 45-day extension | USD 479 |
| Practice test | USD 399 |
| SANS-associated exam add-on | USD 999, tuition separate |
| Standalone attempt window | 120 days from activation |
| Questions and time | 82 questions, 3 hours |
| Minimum passing score | 76% (versions released on or after January 20, 2024) |
| Certification validity | 4 years |
| Renewal | 36 qualifying CPEs or the renewal exam, USD 499 fee |
If you need a second attempt
A failed-exam retake normally requires a 30-day wait, and the 60-day extension includes that wait. Three failures trigger a one-year wait, and extensions add 45 days within a 570-day total-access limit. Knowing this up front is a reason to train thoroughly the first time. The score details are in GRTP Passing Score 2026, and note that a minimum passing score is a different quantity from a population pass rate, which is discussed in GRTP Pass Rate 2026.
Training Overlap With CRTP, CRTO and OSEP
Many candidates already hold or are considering other red team credentials, and the skills overlap is real. The credentials themselves are separate, issued by different organizations with different formats, and none of their details apply to GRTP.
| Credential | Issuer | Training relevance to GRTP |
|---|---|---|
| GRTP | GIAC | The target credential; ten objectives from planning through reporting |
| CRTP | Altered Security (Certified Red Team Professional) | Strong Active Directory practice that supports the directory-focused GRTP objectives |
| CRTO | Zero-Point Security (Red Team Operator) | C2 operation practice that supports the infrastructure and C2 objectives |
| OSEP | OffSec | Advanced evasion and exploitation practice; its own assessment format is separate |
Prior experience from these programs can shorten your training, but they do not replace coverage of the GRTP objectives such as engagement planning, reporting and adversary emulation fundamentals, which are easy to skip if your background is purely technical. Compare career paths in Is the GRTP Certification Worth It?, and review role types in GRTP Jobs. No representative GRTP-specific salary dataset or verified salary uplift was found, so avoid training decisions based on promised earnings; the GRTP Salary Guide 2026 explains the evidence gap.
Frequently Asked Questions
No. GIAC lists no mandatory education, experience, training hours or references to sit the exam. SEC565 is the affiliated preparation course, but it is optional, and the exam add-on and tuition are priced separately.
Paper books, notes and an index are permitted. Electronic and internet resources are prohibited, as are exam and practice-question references. Build your index during training and test it with timed lookups.
The current SEC565 page lists 28 labs, six instructor-led days and 36 self-paced hours. These describe the course, not the exam, which is 82 questions in a three-hour limit.
GIAC identifies CyberLive virtual-machine testing but does not publish an exact item-type or scored versus unscored breakdown. Train for both live operation and output interpretation, and check your attempt's specifications.
GIAC publishes ten objectives without percentage weights, so none can be declared the heaviest. Cover all of them, and use practice results and your gap log to decide where extra hours go.