CRTP practice examsIn development
Certified Red Team Professional
The standard first serious Active Directory certification: a 24-hour assumed-breach exam done with PowerView and native PowerShell so each technique is genuinely understood, enumeration that reads the path the domain already contains through ACLs, delegation and weak service accounts, and local escalation that unlocks credential extraction; then Kerberos attacks explained at the mechanism level, lateral movement on reused hashes and tickets, DCSync and the krbtgt key forging a Golden Ticket for domain dominance, and trust abuse establishing that the forest, not the domain, is the true security boundary.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Enumeration and privilege escalation | Not published |
| Lateral movement, domain dominance and trusts | Not published |
Two sample questions
1. A tester with write access to a computer's msDS-AllowedToActOnBehalfOfOtherIdentity can perform which attack?
- Unconstrained delegation abuse of the TGTs
- A golden ticket forged from the krbtgt hash
- Resource-based constrained delegation abuse — correct
- DCSync replication of the directory data
Why: Writing to msDS-AllowedToActOnBehalfOfOtherIdentity enables resource-based constrained delegation abuse to impersonate users to that host.
2. What does a service ticket request for a service account enable when cracked?
- Recovery of the service account password offline — correct
- Immediate command execution on the service's host
- A forged service ticket for any service at all
- Read access to the whole of the directory
Why: The ticket is encrypted with the account's key, so a weak password can be recovered without touching the account. A long machine-generated password on service accounts is the defence.
The real CRTP exam
| Length | 24 hours of lab access, then 48 hours to report |
|---|---|
| Questions | Practical: compromise the domain and forest in the exam lab, then a report |
| Pass mark | Compromise of the required machines and an acceptable report |
| Price | Bundled with the Attacking and Defending Active Directory course |
| Recommended before you sit it | None enforced. The associated Active Directory course is the intended preparation. |
| Valid for | Does not expire |
Exam facts as published by Altered Security; always check the vendor’s page before you book.
Study CRTP with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.