- The Honest Difficulty Verdict
- What You Are Actually Sitting: Format and Rules
- Where the Difficulty Really Comes From
- The Ten Objectives Ranked by Candidate Friction
- CyberLive: Why It Changes the Prep Equation
- Open Book, Paper Only: Building an Index That Works
- How Your Background Changes the Difficulty
- GRTP Against CRTP, CRTO and OSEP
- Sequencing Your Preparation
- The Cost and Rules of a Miss
- Frequently Asked Questions
- The GRTP exam has 82 questions, a 3-hour limit and a 76% minimum passing score for current exam versions.
- Difficulty comes from breadth: ten objectives spanning attack infrastructure, Active Directory, C2, persistence and engagement reporting.
- CyberLive virtual-machine testing means you must perform and interpret tasks, not just recall definitions.
- Paper books and indexes are allowed; electronic references are prohibited, so index quality directly affects your score.
The Honest Difficulty Verdict
The GIAC Red Team Professional (GRTP) exam is hard in a specific way: it is broad rather than brutally deep. A candidate who has operated Cobalt Strike-style or open-source C2 frameworks, attacked Active Directory in a lab and written an engagement report will find most objectives familiar. A candidate who knows exploitation well but has never planned an operation, built redirectors or written a threat-informed report will find whole sections unfamiliar.
Three numbers frame the challenge: 82 questions, 3 hours, and a 76% minimum passing score. That works out to roughly two minutes per question, which sounds comfortable until some of those questions require you to work inside a virtual machine rather than pick an answer from a list. The passing bar is also high. You can miss roughly one question in four, and that is the entire margin for the objectives you are weakest in.
GIAC does not publish a population pass rate, and you should be skeptical of any site that quotes one without a source. For a deeper look at what is and is not known, see our breakdown of the GRTP pass rate. For the exact scoring threshold and how it applies, see GRTP passing score.
What You Are Actually Sitting: Format and Rules
Before judging difficulty, get the mechanics right, because several third-party sites list stale or wrong specifications. Per GIAC's published information, the current exam is a single proctored, web-based practitioner exam with 82 questions and a three-hour limit, delivered through Pearson VUE onsite or ProctorU remote, subject to attempt-specific modality restrictions. The 76% minimum passing score applies to exam versions released on or after January 20, 2024.
Some commercial listings still show 75 questions, 120 minutes or different passing thresholds. Those do not match GIAC's current figures. The certification-information page attached to your purchased attempt is the authority for your specific exam, so check it when you register. Our GRTP exam dates and scheduling guide covers the activation and access windows in detail.
| Exam Detail | GRTP (GIAC) |
|---|---|
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (versions released on or after January 20, 2024) |
| Delivery | Pearson VUE onsite or ProctorU remote |
| Format | Proctored web-based practitioner exam with CyberLive virtual-machine testing |
| Reference materials | Paper books, notes and index permitted; electronic and internet references prohibited |
| Answer changes | Cannot revise answers after submission; limited skip allowance |
| Breaks | 15 minutes of break time |
| Certification validity | 4 years |
One detail deserves caution. GIAC's page describes CyberLive as replacing traditional multiple-choice testing, while its broader explanation of practitioner exams describes a combination of multiple-choice and practical challenges. The exact mix of item types, and the split between scored and unscored questions, is not publicly specified. Do not trust anyone who tells you precisely how many questions are hands-on.
Where the Difficulty Really Comes From
Breadth across an entire operation
The ten objective headings run from Red Team Engagement Planning and Reporting at one end to Persistence and Exfiltration at the other, with infrastructure, access, privilege abuse and domain attacks between. Most offensive certifications emphasize the exploitation and post-exploitation middle. GRTP asks you to reason about the whole lifecycle, including the parts that happen before the first payload and after the last.
Time pressure on practical items
Three hours for 82 questions is manageable for recall, but practical tasks consume more time per item. If you spend ten minutes stuck in a virtual machine on one task, you pay for it elsewhere. Pacing discipline matters more here than on a purely multiple-choice exam.
The 76% bar
A high passing threshold removes the option of writing off an objective. If you are weak in Command and Control infrastructure and also soft on Gaining Access, the arithmetic gets uncomfortable fast. Note also that GIAC does not publish objective weights, so you cannot safely skip anything on the assumption it counts for little.
Key Takeaway
Do not infer weights. GIAC publishes ten objective headings without percentage weights or per-objective question counts. Any site claiming "Domain 5 is 15% of the exam" is guessing. Prepare all ten objectives to a passing standard.
The Ten Objectives Ranked by Candidate Friction
The ranking below is editorial judgment based on the nature of each topic and the kinds of questions candidates tend to raise, not an official difficulty measure. For a full objective-by-objective walkthrough, see our GRTP exam domains guide.
Higher friction: Attacking Active Directory and Leveraging the Domain
These objectives punish shallow lab experience. You need to understand why an attack path works, not just which command launches it.
- Trust relationships, delegation and credential material in a domain context
- Moving from a foothold to broader domain influence while staying within scope
- Interpreting enumeration output to choose the next step
Higher friction: Command and Control infrastructure and Creating the Attack infrastructure
Candidates with strong exploitation backgrounds often find infrastructure design the unfamiliar part. These objectives reward operational thinking.
- How operators structure C2 and supporting infrastructure for resilience and separation
- Reading C2 framework output and deciding what it means for the operation
- The trade-offs between convenience and detectability
Moderate friction: Gaining Access, Enumerating and Attacking Privileges, Discovery and Enumeration
Familiar territory for anyone with penetration-testing experience, but the red-team framing changes priorities toward stealth and objective-driven action.
- Initial access reasoning in an adversary emulation context
- Methodical discovery rather than noisy sweeping
- Privilege enumeration and abuse paths
Often underestimated: Adversary Emulation Fundamentals, Persistence and Exfiltration, Engagement Planning and Reporting
These are the objectives technical candidates skim. Because the passing score is 76%, skimming them is a mistake.
- Threat-informed planning, scoping and rules of engagement
- Persistence and data-handling decisions made deliberately
- Reporting that connects activity to defensive improvement
CyberLive: Why It Changes the Prep Equation
CyberLive is GIAC's performance-based testing approach, in which you work with virtual machines during the exam. For GRTP, the practical consequence is that reading about a technique is not enough preparation. You need to have done it, ideally repeatedly, in an environment where you must interpret real output.
Be careful about two common misreadings. First, the existence of CyberLive does not mean the exam is entirely practical; GIAC has not published an exact item mix. Second, marketplace practice tests that show you screenshots of C2 output and ask what happened are testing interpretation, which is one useful skill, but they are not the same as operating GIAC's live virtual-machine environment. We have not inspected paid third-party material, so treat equivalence claims with caution.
A reasonable approach is to prepare for both: be able to recognize and explain concepts when asked, and be able to perform the task when given a machine. If you prepare only for recall, a practical item will cost you time and points. If you prepare only hands-on, you may stumble on conceptual questions about planning, reporting or infrastructure design.
Open Book, Paper Only: Building an Index That Works
The exam permits paper books, notes and an index, and prohibits electronic and internet references as well as exam or practice-question references. For many candidates this is the single biggest lever on difficulty, because a good index turns a two-minute lookup into a ten-second one.
Candidate discussions in public forums repeatedly raise the idea of a theory, command and lab index for GRTP. That interest makes sense, but anecdotes do not establish a validated passing method. Build the index around how you actually think, not how someone else organized theirs.
- Index by situation, not alphabet alone. Entries like "persistence options after privileged access" are more useful than a bare tool name.
- Separate theory, commands and lab notes. Different question types send you to different sections.
- Map entries to the ten objectives. If a question touches Leveraging the Domain, you want one place to start.
- Record what you got wrong in practice labs. Your own mistakes are the highest-value index entries.
- Test it under time. If you cannot find an entry in under a minute, rewrite it.
Our GRTP cheat sheet can help you decide what belongs on the page versus in your head.
How Your Background Changes the Difficulty
GRTP has no mandatory education, experience-hour, training-hour or reference prerequisites, and preparation is recommended rather than required. See GRTP requirements for the full eligibility picture. In practice, that means the barrier to sitting the exam is low while the barrier to passing depends on your background.
| Candidate Profile | Likely Strengths | Likely Gaps |
|---|---|---|
| Penetration tester moving to red team | Gaining Access, Discovery and Enumeration, privilege attacks | Attack infrastructure, C2 design, engagement planning and reporting framing |
| Active Directory specialist | Attacking Active Directory, Leveraging the Domain | Infrastructure, persistence and exfiltration decisions, adversary emulation planning |
| Blue team or SOC analyst | Understanding detection, reporting value | Hands-on offensive execution across most objectives |
| Experienced operator with C2 time | C2 infrastructure, persistence, operational thinking | Formal reporting and planning vocabulary |
Candidates coming from a SANS SEC565 course have the advantage of structured exposure. The current course page lists 28 labs, six instructor-led days and 36 self-paced hours. Those are training features, not exam task counts or exam duration, and the course's capstone capture-the-flag is preparation rather than a certification requirement. Training is also a cost consideration, covered in GRTP certification cost.
GRTP Against CRTP, CRTO and OSEP
Candidates often ask whether GRTP is harder than other red-team credentials. These are different credentials from different issuers with different formats, so the comparison is about shape, not a ranking.
| Credential | Issuer | What Distinguishes It |
|---|---|---|
| GRTP | GIAC | Proctored exam, 82 questions, 3 hours, CyberLive, open paper reference, broad ten-objective lifecycle scope |
| CRTP (Certified Red Team Professional) | Altered Security | Separate credential with an Active Directory lab focus |
| CRTO (Red Team Operator) | Zero-Point Security | Separate credential tied to its Red Team Operations course |
| OSEP | OffSec | Separate credential with a long assessment window followed by a documentation-upload period |
The practical difference is that GRTP tests across a proctored three-hour session with paper references, while the others use different assessment structures and timings that do not apply to GRTP. Candidates on public forums discuss taking GRTP after CRTO, which is a reasonable path since hands-on operator experience carries over to the C2 and domain objectives, but those discussions are anecdotal. Do not import the timing, passing criteria or objectives of any other credential into your GRTP plan.
Sequencing Your Preparation
Generic study advice matters less than ordering the ten objectives sensibly. The schedule below assumes you already have some red-team exposure and are adapting it to GRTP's structure. Stretch or compress it to fit your background; our full GRTP study guide goes further.
Foundations and planning
- Adversary Emulation Fundamentals and Red Team Engagement Planning and Reporting, since they frame everything that follows
- Start your index skeleton, organized by the ten objectives
Infrastructure and C2
- Creating the Attack infrastructure and Command and Control infrastructure
- Hands-on time reading C2 framework output
Access and enumeration
- Gaining Access, Discovery and Enumeration, Enumerating and Attacking Privileges
- Log every mistake in your index
Domain compromise
- Attacking Active Directory and Leveraging the Domain, your likely friction points
- Repeat labs until commands feel automatic
Persistence, exfiltration and integration
- Persistence and Exfiltration, then a full cross-objective review
- Timed practice under paper-only conditions with your finished index
The logic: planning and emulation concepts come first because they shape how you read every later scenario, and the two heaviest-friction areas, infrastructure and domain attacks, get dedicated weeks rather than being squeezed in. When you reach timed practice, our GRTP practice tests can help you check pacing, though remember that practice questions are not a substitute for hands-on virtual-machine work.
The Cost and Rules of a Miss
Difficulty has a price tag. The exam fee is USD 999 before tax, with no member or non-member tiers published. A failed-exam retake is USD 899, a 45-day extension is USD 479, and an official practice test is USD 399. The SANS-associated exam add-on is also USD 999, with tuition separate.
Retake rules add a time cost. A failed-exam retake normally requires a 30-day wait, and its 60-day extension includes that wait. Three failures trigger a one-year wait. Extensions add 45 days within a 570-day total-access limit. Your attempt window is 120 days from activation for a standalone purchase, or 120 days from the end of bundled training, and these are access windows rather than exam durations.
Once you pass, the credential is valid for four years. Renewal requires 36 qualifying CPEs during the cycle or passing the renewal exam, with a USD 499 renewal fee. A reasonable question is whether the effort pays back. We do not have representative salary data for GRTP holders, so we avoid quoting numbers; see is the GRTP worth it and the GRTP salary guide for how to reason about it without invented figures, and GRTP jobs for the roles where the credential tends to be relevant.
Key Takeaway
The most expensive way to find out how hard GRTP is, is to sit it unprepared. With an USD 899 retake and a minimum 30-day wait, one honest self-assessment against all ten objectives costs far less than a failed attempt.
Frequently Asked Questions
Generally yes, because it uses CyberLive virtual-machine testing alongside a 76% minimum passing score across 82 questions in three hours. The exact mix of item types is not publicly specified, so prepare for both conceptual recall and hands-on tasks.
The minimum passing score is 76% for exam versions released on or after January 20, 2024. Some third-party sites list lower thresholds or different question counts, which conflict with GIAC's current published figures.
Paper books, notes and an index are permitted. Electronic and internet references are prohibited, as are exam and practice-question references. A well-organized paper index is one of the strongest ways to reduce difficulty.
No. GIAC lists ten objective headings but does not publish percentage weights or per-objective question counts in the sources we reviewed. Prepare all ten objectives rather than trusting a claimed weighting.
No mandatory training is required to sit the exam. SEC565 is the affiliated preparation course, but its curriculum is preparation material rather than proof of exhaustive exam coverage. Candidates with strong hands-on experience may prepare through other means.
For a plain-language introduction to the credential itself, see what GRTP certification is, and when you are ready to test your recall, head to our practice test site.