- What GRTP Means (and What It Does Not)
- Who Issues It and Who It Targets
- The Exam at a Glance
- How CyberLive Changes the Exam Experience
- The Ten Exam Objectives
- SEC565 and Other Preparation Routes
- Fees, Retakes and Exam-Day Rules
- Validity and Renewal
- GRTP Compared With CRTP, CRTO and OSEP
- Career Value and Hiring Context
- Sequencing Your Preparation
- Frequently Asked Questions
- GRTP is GIAC Red Team Professional: 82 questions, three hours, 76% minimum passing score, proctored through Pearson VUE or ProctorU.
- The exam uses CyberLive virtual-machine testing, but GIAC does not publish an exact count of practical versus other items.
- Ten published objective headings define scope; GIAC publishes no percentage weights, so never trust a weight chart.
- The exam fee is USD 999, a failed-exam retake is USD 899, and the certification is valid for four years.
What GRTP Means (and What It Does Not)
On this site, GRTP means one thing: the GIAC Red Team Professional certification. It is a performance-oriented credential from GIAC Certifications that tests whether a candidate understands how to plan, run and report an adversary-emulation engagement. If you arrived here from a search for "GRTP," note that the acronym is shared by other credentials from other organizations. Everything below describes the GIAC exam only, so fees, question counts, timing and scope from any similarly abbreviated credential do not apply.
If you want the short version of the name question, our companion pages on what GRTP stands for and GRTP meaning cover the terminology, while this article focuses on what the certification actually is and how it works.
Who Issues It and Who It Targets
GIAC Certifications (formerly Global Information Assurance Certification, administered by GIAC, LLC) issues GRTP. GIAC is the certification body closely associated with SANS Institute training, and GRTP's affiliated preparation course is SANS SEC565: Red Team Operations and Adversary Emulation. Taking that course is a common route, but it is not a requirement to sit the exam.
The certification targets practitioners who work on, or want to move into, offensive security roles where the goal is not merely finding vulnerabilities but emulating a realistic adversary across an entire attack chain. That includes:
- Red team operators and adversary-emulation specialists
- Penetration testers expanding from point-in-time testing into campaign-style engagements
- Purple team members who need to understand offensive tradecraft well enough to validate detections
- Security engineers who build or defend against command-and-control and Active Directory attack paths
For a closer look at how employers use the credential, see our page on GRTP jobs.
The Exam at a Glance
The following figures come from GIAC's published specifications. The certification-information page tied to your purchased attempt is the final authority for that attempt, so check it before test day.
| Attribute | GRTP Detail |
|---|---|
| Issuer | GIAC Certifications |
| Number of questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 76% (exam versions released on or after January 20, 2024) |
| Format | Proctored, web-based, with CyberLive virtual-machine testing |
| Proctoring | Pearson VUE onsite or ProctorU remote, subject to attempt-specific restrictions |
| Prerequisites | None mandatory; preparation recommended |
| Validity | 4 years |
| Open materials | Paper books, notes and index permitted; electronic and practice-question references prohibited |
Be careful with third-party listings. Some sites still show 75 questions, 120 minutes, different passing thresholds or older fees. Those do not match GIAC's current published specifications of 82 questions, three hours and 76%. Our GRTP passing score article explains why the minimum score is a different quantity from a population pass rate.
How CyberLive Changes the Exam Experience
GRTP is identified by GIAC as a CyberLive exam. CyberLive is GIAC's performance-based testing approach: instead of only selecting an answer from a list, you interact with virtual machines and demonstrate that you can perform or interpret real tasks. For an offensive-security credential, that is a meaningful design choice, because it rewards candidates who have actually operated tooling rather than only memorized concepts.
Practically, this means you should prepare for both interpretation and operation. Be ready to read command-and-control output, reason about an attack path from tool results, and work inside a live environment under a single three-hour clock. No separate practical timer has been verified; the three-hour limit covers the exam as a whole.
Marketplace practice tests that present scenario-style multiple-choice questions can help you rehearse reasoning about C2 output, but they are not the same as operating GIAC's own virtual-machine environment. Hands-on lab time remains the safest preparation for the live component. Our guide on how hard the GRTP exam is discusses what that means for difficulty.
The Ten Exam Objectives
GIAC publishes ten exam-objective headings for GRTP. They are sequential headings rather than an issuer-numbered, weighted domain system. GIAC does not publish percentage weights in the sources reviewed, so there is no verified "highest-weight" domain, and you should not assume equal question counts per objective either. For the full breakdown, see the GRTP exam domains guide. Here is how to think about each one.
1. Adversary Emulation Fundamentals
The conceptual foundation: what emulating a threat actor means, how it differs from a standard penetration test, and how frameworks guide realistic behavior.
- Threat-informed operations versus generic testing
- Mapping behaviors to adversary techniques
- Setting objectives that reflect a real intrusion scenario
2. Attacking Active Directory
Active Directory is the center of most enterprise red team engagements, so expect this area to reward real lab experience.
- Understanding trust, authentication and delegation weaknesses
- Credential abuse paths and their detection footprints
- Reading enumeration output to choose the next move
3. Command and Control infrastructure
How operators communicate with implants, manage sessions and keep traffic resilient and believable.
- C2 channel design and operational tradeoffs
- Interpreting C2 framework output
- Session management during a long-running engagement
4. Creating the Attack infrastructure
Building the supporting environment: redirectors, hosting, payload delivery and the separation that protects an engagement.
- Segmenting infrastructure by function
- Reducing attribution and takedown risk
- Aligning infrastructure choices with the emulated adversary
5. Discovery and Enumeration
Learning the environment after access: hosts, users, shares, services and relationships that reveal attack paths.
- Choosing enumeration methods that balance depth and noise
- Interpreting results to prioritize targets
6. Enumerating and Attacking Privileges
Identifying where privilege can be gained or abused on endpoints and in the domain.
- Local and domain privilege escalation paths
- Recognizing misconfigurations that enable escalation
7. Gaining Access
Initial access techniques and the planning that makes them viable against a defended target.
- Delivery and execution considerations
- Matching access methods to the target's defenses
8. Leveraging the Domain
Turning domain-level access into objectives: lateral movement and use of the domain's own mechanisms to reach crown-jewel targets.
- Lateral movement choices and their trade-offs
- Using trust relationships to expand reach
9. Persistence and Exfiltration
Maintaining access across the engagement and moving data out in ways that demonstrate impact without causing harm.
- Persistence mechanisms and their detection implications
- Controlled, authorized exfiltration scenarios
10. Red Team Engagement Planning and Reporting
The professional wrapper: scoping, rules of engagement, communication and producing reporting that helps defenders improve.
- Defining objectives and boundaries
- Translating technical findings into actionable reporting
SEC565 and Other Preparation Routes
GIAC's affiliated preparation source is SANS SEC565, Red Team Operations and Adversary Emulation. SANS groups the material into six practical course domains and presents it through six instructor-led days, 36 self-paced hours and 28 labs. It also includes a capstone Capture the Flag. Important distinctions:
- Those course features describe the training, not the exam. The 28 labs are not 28 exam tasks, and the course length is not the exam duration.
- The capstone CTF is part of the course, not a certification requirement.
- The course flyer mentions newer topics such as AI-assisted intelligence analysis and MCP-based C2. These belong to the training curriculum and do not establish extra GIAC objective headings or a separate 2026 exam outline.
The ten objectives map onto SANS's six course groupings, which is useful for building a study plan, but the SEC565 syllabus is a preparation curriculum, not proof of exhaustive exam coverage. Our GRTP training page covers course options, and the GRTP study guide turns the objectives into a plan.
Fees, Retakes and Exam-Day Rules
What the exam costs
GIAC lists the exam attempt at USD 999 before tax, with no separate member and non-member tiers published. The SANS-associated exam add-on is also USD 999, with tuition separate. Other published fees include:
| Item | Fee (USD) |
|---|---|
| Exam attempt | 999 (before tax) |
| Failed-exam retake | 899 |
| 45-day extension | 479 |
| Practice test (GIAC) | 399 |
| Renewal (36 CPEs or renewal exam) | 499 |
For the full picture including bundles and add-ons, see the GRTP certification cost breakdown.
Attempt windows and retake rules
- A standalone attempt is available for 120 days from activation; bundled training typically runs 120 days from the end of the event or matches the OnDemand deadline. These are access windows, not exam durations.
- A failed-exam retake normally requires a 30-day wait. Its 60-day extension includes that wait.
- Three failures trigger a one-year wait.
- Extensions add 45 days within a 570-day total-access limit.
Scheduling details are covered in GRTP exam dates.
Rules that shape how you prepare
Because your reference material is paper, the quality of your index is a genuine competitive advantage. A good index for GRTP covers three layers: theory (why a technique works), commands (exact syntax and flags you tend to forget) and lab notes (outputs you have seen and what they meant). Organize it by the ten objectives so you can jump straight to the right section under time pressure.
Validity and Renewal
GRTP is valid for four years. To renew, you either earn 36 qualifying CPEs during the active cycle or pass the renewal exam, with a renewal fee of USD 499. CPE documentation and payment are due before expiry. Additional renewals within two years of a full-price renewal cost USD 249. Eligibility rules are summarized in our GRTP requirements article; the short version is that no mandatory education, experience hours, training hours or references are needed to sit the exam, though preparation is strongly recommended.
GRTP Compared With CRTP, CRTO and OSEP
Candidates often weigh GRTP against other red team credentials. These are separate credentials from separate organizations, and their formats and objectives never transfer to GRTP.
| Credential | Issuer | Notes for comparison |
|---|---|---|
| GRTP (GIAC Red Team Professional) | GIAC Certifications | Proctored exam, 82 questions, three hours, CyberLive virtual-machine testing, ten published objectives |
| CRTP (Certified Red Team Professional) | Altered Security | Separate credential focused on its own Active Directory lab and course |
| CRTO (Red Team Operator) | Zero-Point Security | Credential from the Red Team Operations course; people often search for it as CRTO |
| OSEP | OffSec | Separate long-form assessment with its own timing and a distinct documentation-upload window |
Do not carry timing, scoring or objective details from those credentials into GRTP planning. A reasonable framing is that GRTP emphasizes the full engagement lifecycle, including planning and reporting as an explicit objective, while other credentials may emphasize different slices. Candidates in community discussions have described pursuing GRTP after another red team credential, but those anecdotes do not establish a validated study method or a pass rate.
Career Value and Hiring Context
Employers recruiting for red team operator, adversary-emulation and offensive-security engineer roles may recognize GIAC credentials as evidence of validated skills, and the practical CyberLive element supports the claim that a holder has worked with real tooling. That said, be disciplined about what is proven.
Likewise, a minimum passing score of 76% tells you the cut line for the exam, not how many candidates pass. A seller's claimed customer success rate is a third, separate thing. For context on that distinction, read what the data shows about GRTP pass rates.
Sequencing Your Preparation
Rather than generic study habits, sequence your preparation around how the objectives depend on each other. The domains stack: you cannot reason well about persistence or lateral movement without understanding access and enumeration first. Here is one ordering that follows that dependency chain across about six weeks.
Foundations and planning
- Adversary Emulation Fundamentals
- Red Team Engagement Planning and Reporting, since it frames every later objective
Infrastructure
- Command and Control infrastructure
- Creating the Attack infrastructure
Entry and visibility
- Gaining Access
- Discovery and Enumeration
Privilege and Active Directory
- Enumerating and Attacking Privileges
- Attacking Active Directory, the heaviest hands-on area for most candidates
Domain objectives and endurance
- Leveraging the Domain
- Persistence and Exfiltration
Index and rehearsal
- Finalize the paper index by objective
- Run timed sessions against the three-hour limit
Key Takeaway
Because GIAC publishes no objective weights, spread your effort across all ten headings and weight your extra time toward whichever areas your own lab results show are weakest. A quick reference like the GRTP cheat sheet is useful for last-minute review, and the practice test platform can help you rehearse scenario reasoning, though it does not replace hands-on lab time.
When you are ready to test your recall under realistic conditions, try the GRTP practice exams to find gaps in your command and theory knowledge before you commit to an exam date. Treat third-party question banks cautiously: authenticity claims from dump-style sellers are unverified, and using actual exam content would violate GIAC's candidate agreement.
Frequently Asked Questions
GRTP is the GIAC Red Team Professional certification from GIAC Certifications. It validates skills in planning and running adversary-emulation engagements, covering ten published objective areas from engagement planning through Active Directory attacks, C2 infrastructure, persistence and reporting. See our page on what GRTP certification is for more.
GIAC currently specifies 82 questions and a three-hour time limit, with a 76% minimum passing score for exam versions released on or after January 20, 2024. The exam uses CyberLive virtual-machine testing, but GIAC does not publish the exact item-type mix.
Paper books, notes and an index are permitted. Electronic and internet resources, and exam or practice-question references, are prohibited. This is why a well-organized paper index tied to the ten objectives is so valuable.
No. GIAC lists no mandatory education, experience, training hours or references. SEC565 is the affiliated SANS preparation course and is a popular route, but you may prepare through other means. Course features such as its 28 labs and capstone CTF are training elements, not exam requirements.
The exam is USD 999 before tax, a failed-exam retake is USD 899, and the certification is valid for four years. Renewal requires 36 qualifying CPEs or passing the renewal exam, with a USD 499 renewal fee. See the full cost breakdown for details.