CRTO practice examsIn development
Red Team Ops - Certified Red Team Operator
Red teaming as an operational discipline rather than a wider penetration test: emulating an adversary against a mature defence and operating without detection, a resilient Cobalt Strike C2 posture of beacons, sleep and jitter, malleable profiles and redirectors, phishing initial access that survives controls, and host evasion where every action has a detection cost; then privilege escalation and credential access through the quieter techniques, BloodHound choosing the stealthiest path, lateral movement selected by detection profile, and an Active Directory compromise to domain dominance achieved quietly and logged for the blue team debrief.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Command and control, initial access and host evasion | Not published |
| Active Directory, lateral movement and domain dominance | Not published |
Two sample questions
1. What does unconstrained delegation allow an attacker to capture?
- The plaintext form of every password held in the domain
- The krbtgt hash from the controller
- The open ports on the network
- Tickets of users who authenticate to the host — correct
Why: The host caches tickets an attacker can then reuse.
2. What is the trade-off of a shorter sleep interval?
- Faster tasking, more traffic — correct
- Larger payload, less detection
- No traffic and no control
- Slower tasking, fewer artefacts
Why: A shorter sleep gives faster tasking but generates more traffic that defenders can spot.
The real CRTO exam
| Length | 48 hours of lab access within a 4-day window |
|---|---|
| Questions | Practical: capture defined flags in a defended lab environment |
| Pass mark | 6 of 8 flags |
| Price | Bundled with the Red Team Ops course; exam attempts are purchased |
| Recommended before you sit it | None enforced. The Red Team Ops course is the intended preparation. |
| Valid for | Does not expire |
Exam facts as published by Zero-Point Security; always check the vendor’s page before you book.
Study CRTO with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.