- The Plain Answer: What a GRTP Is
- Identity Check: Which GRTP This Is
- Who Issues It and How It Is Delivered
- What the Exam Looks Like
- The Ten Objective Areas
- Where SEC565 Fits In
- Fees, Rules and Retake Mechanics
- Who Should Sit It, and Who Hires for It
- GRTP Compared With CRTP, CRTO and OSEP
- Sequencing Your Preparation Around GRTP Content
- Validity and Renewal
- Frequently Asked Questions
- GRTP here means GIAC Red Team Professional, a proctored GIAC exam covering red team operations and adversary emulation.
- The exam has 82 questions, a 3-hour limit and a 76% minimum passing score, with CyberLive virtual-machine testing.
- GIAC publishes ten objective headings but no percentage weights, so do not trust any site quoting domain percentages.
- The exam fee is USD 999 before tax, and the certification stays valid for 4 years.
The Plain Answer: What a GRTP Is
If you searched "What is a GRTP?" and landed here, the short version is this: GRTP is the acronym for GIAC Red Team Professional, a hands-on-oriented certification from GIAC Certifications that validates a practitioner's ability to plan, build and run a red team engagement and to emulate real adversaries against an enterprise environment.
It is not a general security awareness credential and it is not an entry-level exam. It targets people who already understand offensive security fundamentals and want to demonstrate that they can operate at the level of a coordinated red team: standing up attack infrastructure, running command and control, moving through Active Directory, persisting, exfiltrating and then reporting the engagement in a way a client can act on.
This article explains what the credential is, how the exam is structured, what it costs, what you are expected to know, and how it compares with the other red team credentials candidates tend to weigh it against. For a broader family of definitional pages, you can also read What Is GRTP Certification? and What Does GRTP Stand For?.
Identity Check: Which GRTP This Is
The acronym is used elsewhere in the technology and certification world, and that causes real confusion in search results. Question counts, fees, pass rates and salary numbers from unrelated credentials sometimes get attached to this one. To keep things clean, everything on this site refers to a single credential:
Even among sources that do discuss the GIAC credential, details conflict. Some third-party listings still show 75 questions, 120 minutes or a USD 979 fee. Others show passing thresholds in the high 60s or around 70%. Those figures do not match GIAC's current published numbers for this exam. When you plan, rely on the issuer's own pages and on the certification information page attached to your purchased attempt, which is the authority for that attempt's specifications.
Who Issues It and How It Is Delivered
GIAC Certifications, formerly Global Information Assurance Certification, is the certifying body. It is closely affiliated with the SANS Institute, which offers the associated training course, though you do not have to take that course to sit the exam. GIAC states that there is no mandatory education, experience-hour, training-hour or reference requirement to attempt the exam, although preparation is strongly recommended. If you want the eligibility picture in more detail, see GRTP Requirements: Eligibility, Prerequisites and How to Qualify.
The exam is proctored. You can test onsite through Pearson VUE or remotely through ProctorU, subject to modality restrictions that can apply to a particular attempt. Check your attempt's details after purchase rather than assuming both options are open to you.
What the Exam Looks Like
The published parameters are straightforward:
| Attribute | GRTP (GIAC Red Team Professional) |
|---|---|
| Number of questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | One proctored, web-based practitioner exam with CyberLive virtual-machine testing |
| Open-book policy | Paper books, notes and index permitted; electronic or internet references prohibited |
| Proctoring | Pearson VUE onsite or ProctorU remote |
| Certification validity | 4 years |
Understanding CyberLive
CyberLive is GIAC's performance-based testing approach, in which candidates work against actual virtual machines rather than only answering abstract recall questions. GIAC's GRTP page describes CyberLive as replacing traditional multiple-choice testing, while GIAC's broader explanation of practitioner exams says they combine multiple-choice and practical challenges. That difference in wording does not tell us the exact mixture of item types, and GIAC does not publicly specify scored versus unscored counts. So treat any claim like "the exam is X% hands-on" as unverified.
What you can reasonably infer is the preparation implication: you should be comfortable doing the work, not just describing it. You also need to be able to look things up quickly in your own paper materials, because the three-hour limit covers the whole exam and no separate public practical timer has been verified.
Rules that affect strategy
- No revising after submission: once you submit an answer, you cannot go back and change it.
- Limited skips: GIAC provides a limited skip allowance, so triage matters.
- Break time: 15 minutes of break time is provided.
- Reference restrictions: electronic devices, internet access and exam or practice-question references are prohibited. Only paper books, notes and an index are allowed.
Whether a calculator is available or whether this exam uses adaptive testing has not been verified for this specific exam, so confirm on your attempt page rather than assuming.
The Ten Objective Areas
GIAC publishes ten sequential exam-objective headings for the credential. It does not publish percentage weights, an official highest-weight objective, or a numbered weighted-domain system, so no honest source can tell you how many questions come from each. Here is how the headings break down in practical terms. For a deeper walk-through, see GRTP Exam Domains: Complete Guide to All 10 Content Areas.
Adversary Emulation Fundamentals
The conceptual foundation: what it means to emulate a threat actor rather than simply run exploits.
- How adversary emulation differs from generic penetration testing
- Using threat intelligence to shape an engagement
- Mapping behaviors to a common adversary-technique vocabulary
Red Team Engagement Planning and Reporting
The bookends of a real engagement: scoping, rules of engagement, objectives, and the deliverable at the end.
- Defining goals, boundaries and success criteria with a client
- Documenting activity so defenders can learn from it
- Writing findings that drive remediation rather than just listing exploits
Creating the Attack Infrastructure
Building the environment you operate from.
- Staging servers, redirectors and supporting services
- Separating roles so a single burned asset does not collapse the operation
- Operational security considerations for infrastructure
Command and Control infrastructure
Running and managing the channels between your implants and your operators.
- Selecting, configuring and operating C2 frameworks
- Understanding listener, beacon and communication behavior
- Interpreting C2 output and acting on it
Gaining Access
Initial entry into the target environment.
- Delivering payloads and establishing the first foothold
- Choosing access techniques appropriate to the engagement's objectives
Discovery and Enumeration
Learning the environment after you are inside.
- Host, network and domain enumeration
- Identifying targets of value and likely paths toward them
Enumerating and Attacking Privileges
Understanding and abusing the permissions in play.
- Local and domain privilege analysis
- Escalation paths and misconfiguration abuse
Attacking Active Directory
Where most enterprise red team value is demonstrated.
- Common AD attack paths and credential-based techniques
- Trust relationships, delegation and authentication weaknesses
Leveraging the Domain
Converting access into objective-level impact.
- Lateral movement across the domain
- Reaching the systems and data the engagement targets
Persistence and Exfiltration
Staying in, and getting data out, in ways a real adversary would.
- Persistence mechanisms and their detection footprint
- Exfiltration channels and handling of sensitive data during an engagement
Where SEC565 Fits In
The training most commonly associated with this exam is SANS SEC565: Red Team Operations and Adversary Emulation. SANS groups the preparation material into six practical course domains, which map onto GIAC's ten objective headings. The current course page lists 28 labs, six instructor-led days and 36 self-paced hours, and the course ends in a capstone Capture the Flag. Those are training features. They are not exam task counts, exam duration, or a separate certification requirement.
Two cautions are worth keeping in mind. First, SEC565's published topics, including AI-assisted intelligence analysis, tooling and MCP-based C2 coverage, are curriculum content and do not establish additional GIAC objective headings or a separately versioned 2026 exam outline. Second, the public flyer carries no visible edition or date, so treat it as a preparation guide rather than proof of exhaustive exam coverage. For training specifics, see GRTP Training.
Fees, Rules and Retake Mechanics
| Item | Published amount |
|---|---|
| Exam attempt | USD 999 before tax (no member/non-member tiers published) |
| Failed-exam retake | USD 899 |
| 45-day extension | USD 479 |
| Practice test | USD 399 |
| SANS-associated exam add-on | USD 999 (tuition is separate) |
| Renewal by CPEs or exam | USD 499 |
A full breakdown lives in GRTP Certification Cost: Complete Pricing Breakdown.
Timing and access windows
- Attempt window: a standalone attempt is available for 120 days from activation. With bundled training, the 120 days start from the end of the event or match the OnDemand course deadline. These are access windows, not exam durations.
- Retake waiting period: a failed attempt normally requires a 30-day wait before retesting. A 60-day extension includes that wait.
- Repeated failure: three failures trigger a one-year wait.
- Extensions: extensions add 45 days each, within a 570-day total-access limit.
For scheduling windows and deadlines, see GRTP Exam Dates: Testing Windows, Deadlines and Scheduling.
Who Should Sit It, and Who Hires for It
The credential fits professionals whose day-to-day work involves attacking enterprise environments on behalf of an organization or client. Typical profiles include:
- Penetration testers moving toward full-scope, objective-driven engagements
- Red team operators and adversary emulation specialists
- Offensive security consultants who need to show structured operational capability
- Purple team and detection engineers who want to understand the attacker's workflow end to end
On the employer side, organizations that run or buy red team services are the natural audience: security consultancies, internal offensive security teams in larger enterprises, and defense and government-adjacent contractors that commonly value GIAC-branded credentials. Treat that as a pattern in the type of employer rather than a guarantee for any specific job posting; see GRTP Jobs for more on the role landscape.
GRTP Compared With CRTP, CRTO and OSEP
Candidates frequently weigh GRTP against other red team credentials. These are separate credentials from separate issuers, and their formats and objectives must never be blended with GRTP's.
| Credential | Issuer | What distinguishes it |
|---|---|---|
| GRTP (GIAC Red Team Professional) | GIAC Certifications | 82-question, 3-hour proctored exam with CyberLive testing; ten objectives spanning planning through reporting |
| CRTP (Certified Red Team Professional) | Altered Security | A separate credential with its own lab-based format, commonly associated with Active Directory attack focus |
| CRTO (Red Team Operator) | Zero-Point Security | Tied to the Red Team Operations course; a separate credential, often discussed for its operator-focused emphasis |
| OSEP | OffSec | A long practical assessment of 47 hours 45 minutes, followed by a separate 24-hour documentation-upload window; none of those timings apply to GRTP |
A practical way to think about it: GRTP is distinctive for covering the engagement lifecycle, including planning and reporting, inside a single proctored exam with a published passing score. Candidate discussion suggests some people pursue GRTP after a lab-based credential like CRTO, but anecdotes do not establish a validated passing method or a pass rate. For difficulty perspective, see How Hard Is the GRTP Exam?, and for what the data does and does not show about outcomes, see GRTP Pass Rate: What the Data Shows.
Key Takeaway
Do not confuse the minimum passing score with a pass rate. The 76% figure is the bar an individual exam must clear; it says nothing about what share of candidates succeed. Any seller advertising a "success rate" is making an unverified claim, not quoting a GIAC statistic.
Sequencing Your Preparation Around GRTP Content
Because the exam permits paper materials, your preparation should produce a usable index, not just knowledge. One sensible ordering follows the way an engagement unfolds, front-loading the areas where hands-on repetition pays off most.
Foundations, infrastructure and C2
- Cover Adversary Emulation Fundamentals and Red Team Engagement Planning and Reporting first so later technical work has context
- Build and operate Attack infrastructure and Command and Control infrastructure in a lab; these are the areas where interpreting live output matters
Access, discovery and privileges
- Practice Gaining Access, Discovery and Enumeration, and Enumerating and Attacking Privileges as one continuous chain
- Start the paper index: commands, flags and the reason each technique is used
Active Directory, domain and persistence
- Spend the most lab time on Attacking Active Directory and Leveraging the Domain
- Finish with Persistence and Exfiltration, then do a timed run-through against your index
Adjust this to your background. A seasoned operator may compress the technical weeks and spend longer on reporting and planning concepts, while a consultant who rarely builds infrastructure may need the opposite. For a fuller plan, see the GRTP Study Guide and the one-page GRTP Cheat Sheet. When you want to check recall under time pressure, the GRTP practice test site gives you a way to rehearse without breaking the rule against bringing practice-question references into the real exam.
Building an index that works for this exam
- Organize by the ten objective headings, then by task within each
- Record the exact commands you have actually run in a lab, with the context in which they apply
- Separate theory entries from command entries from lab-procedure entries so you can find each type in seconds
- Remember the no-revision rule: index for speed on the first pass, not for second thoughts
Validity and Renewal
The certification is valid for 4 years. To renew, you either earn 36 qualifying CPEs during the active four-year cycle or pass the renewal exam, and the renewal fee is USD 499. CPE documentation and payment are due before expiry. If you renew again within two years of a full-price renewal, the cost drops to USD 249.
Frequently Asked Questions
On this site, GRTP stands for GIAC Red Team Professional, a certification issued by GIAC Certifications. Other credentials share the acronym, so confirm the issuer whenever you read a fee, pass rate or exam detail.
The exam has 82 questions and a 3-hour limit, with a minimum passing score of 76% for exam versions released on or after January 20, 2024. GIAC does not publicly specify the exact item-type or scored versus unscored breakdown.
Yes, paper books, notes and an index are permitted. Electronic devices, internet access, and exam or practice-question references are prohibited, so build a printed index that you have actually practiced using.
No. GIAC lists no mandatory education, experience or training requirement to attempt the exam. SEC565 is the affiliated preparation course, but it is a recommended route, not a prerequisite.
The exam is USD 999 before tax. A failed-exam retake is USD 899 after a normal 30-day wait, and three failures trigger a one-year wait. See the GRTP passing score and cost pages for more detail.