The CRTP certification exam does not ask you a single multiple-choice question. Altered Security drops you into a fully patched enterprise Active Directory environment with five target servers and a foothold student machine, and gives you 24 hours to get OS-level command execution on all five. That is the entire bar. No essay, no theory section, no scenario picker.
That format is why candidates coming from written exams struggle with it, and why people who have never held a security job pass it. This guide covers what the exam actually tests, what the CRTP certification costs in 2026, and a six-week study plan that fits around a full-time job.
What the CRTP Certification Exam Actually Is
CRTP stands for Certified Red Team Professional. It is run by Altered Security (previously Pentester Academy) and it focuses on one thing: attacking Windows Active Directory the way an adversary already inside the network would.
The exam environment is a live AD lab, not a simulation. Altered Security states the environment is fully patched, which is the point of the course. You are not exploiting missing patches. You are abusing the way Active Directory is designed to work: delegation, trusts, certificate services, ACLs and Kerberos.
Exam Tip: The goal is OS-level command execution on all five targets. You do not need SYSTEM or Domain Admin on every box to tick a target off, so if you are burning time on a privilege escalation you do not need, move on and come back.
Key facts, all confirmed on Altered Security's own course and certification pages:
- Exam length: 24 hours, hands-on
- Targets: 5 servers, plus a foothold student machine you start from
- Objective: OS-level command execution on all 5 targets
- Deliverable: a report covering your solutions and practical mitigations
- Certificate validity: 3 years
- Renewal: a free renewal exam before expiry, or earn CRTE, CETP or CRTM instead
- Prerequisites: a basic understanding of Active Directory and comfort with the Windows command line
The report matters more than people expect. You are asked for mitigations, not just steps, and that is the part most reviewers say they underestimated. Check the exact submission window in your exam email rather than relying on a forum post, because it is administered per candidate.
What the CRTP Certification Costs in 2026
Altered Security sells lab time, and the exam attempt comes with it. There is no separate exam voucher to buy.
| Package | Lab access | Price (USD) |
|---|---|---|
| Standard on-demand | 30 days | $249 |
| Extended on-demand | 60 days | $379 |
| Premium on-demand | 90 days | $499 |
| Instructor-led bootcamp | 30 days | $299 |
| Lab extension | 30 days | $199 |
| Exam reattempt | n/a | $99 |
At $249 including a first exam attempt, CRTP is one of the cheapest hands-on offensive certifications available. For comparison, an OSCP attempt runs into four figures.
Reattempts are $99 with a one-month cooldown between them. After three attempts you wait six months. That cooldown is the real reason to buy 60 days rather than 30 if your evenings are unpredictable: a failed attempt plus a month of waiting costs you more than the extra $130 did.
What the Course Covers
The syllabus runs to 13 modules, and they map closely onto what the exam makes you do:
- Active Directory enumeration
- Offensive PowerShell tradecraft
- Offensive .NET tradecraft
- Local privilege escalation
- Domain privilege escalation
- Domain persistence and dominance
- Cross-trust attacks
- Active Directory Certificate Services (AD CS)
- Microsoft Defender for Endpoint defence and bypass
- Microsoft Defender for Identity defence and bypass
- Architecture and work-culture defences
- Monitoring and logging
- Deception-based defences
Modules 1, 5 and 7 carry the most exam weight in practice. Enumeration is where every attack path starts, domain privilege escalation is how you move, and cross-trust attacks are what separates candidates who reach four targets from candidates who finish.
Modules 9 and 10 are newer additions and they change how you work in the lab. Defender for Endpoint and Defender for Identity are live in the environment, so tooling that runs fine on a home lab gets flagged. Learning to run things in memory and off disk is not an optional extra here.
You also get 14 or more hours of video, two lab manuals (one for standalone tools, one for C2 methods) and lifetime access to the course material. The material stays yours after the lab expires, which matters for the six-week plan below.
A Six-Week CRTP Study Plan
This assumes 8 to 10 hours a week and a 60-day lab. Buy the lab at the start of week one, not before, because the clock starts on purchase.
Week 1: enumeration until it is boring. Work through the AD enumeration module and do nothing else. Enumerate the lab domain manually with PowerView and the .NET equivalents until you can list users, groups, ACLs, trusts, delegation and SPNs without opening your notes. Every attack path in the exam is found here.
Week 2: local privilege escalation and PowerShell tradecraft. Cover the offensive PowerShell and .NET modules alongside local privesc. Practise AMSI and logging bypasses now, while you have time to break things, rather than at 3am during the exam.
Week 3: domain privilege escalation. Kerberoasting, AS-REP roasting, unconstrained and constrained delegation, resource-based constrained delegation. Do each one twice: once following the manual, once from scratch with the manual closed.
Week 4: persistence, dominance and AD CS. Golden and silver tickets, DCSync, skeleton key, and the certificate services attack paths. AD CS misconfigurations show up repeatedly in candidate write-ups, so give ESC1 and ESC8 real attention.
Week 5: cross-trust attacks and Defender evasion. Child-to-parent domain escalation, forest trusts, and the two Defender modules. Build a working set of tools you know run cleanly in the lab, then stop collecting tools.
Week 6: a dry run and your notes. Reset the lab and attack it end to end as if it were the exam, on the clock. Then turn your notes into a command-and-syntax cheat sheet organised by attack path rather than by module. Book the exam for the weekend after.
If a week slips, extend the lab rather than sitting the exam early. The $199 extension is cheaper in time than a failed attempt plus a one-month cooldown.
CRTP vs OSCP vs CRTO
These three get compared constantly, and they are not substitutes for each other.
| CRTP | OSCP | CRTO | |
|---|---|---|---|
| Focus | Active Directory attacks | Broad network penetration testing | Red team operations and OPSEC |
| Exam | 24 hours, 5 AD targets | 24 hours, mixed hosts plus AD set | 48 hours across two attempts, scored on objectives |
| Entry cost | $249 | Four figures | Roughly $500 |
| Assumes a foothold | Yes | No | Yes |
| Best for | SOC analysts, AD admins, pentesters going deeper on Windows | Career starters wanting a recognised name | Operators who need C2 and evasion |
CRTP starts with the foothold already granted, so it never tests external exploitation. That narrower scope is a feature: you spend the whole time on the part of a real engagement that actually decides the outcome. If you want the full picture on where each one leads, read our breakdown of what to take after OSCP, and the CRTO study plan if OPSEC scoring is where you are heading next.
Exam Day Tactics That Actually Matter
Sleep before, not during. Twenty-four hours is long enough that most people finish in 8 to 12 and use the rest as buffer. Starting at 8am beats starting at midnight.
Screenshot as you go. The report needs evidence and mitigations. Reconstructing a chain from memory after a 12-hour session wastes hours you could have spent on target five.
Enumerate after every compromise. New host, new context, new credentials, new trust relationships. Candidates who stall almost always stalled because they stopped enumerating.
Do not chase SYSTEM you do not need. Command execution is the bar. Privilege escalation is a means, not the objective.
Frequently Asked Questions
Is CRTP worth it?
For anyone who works with or attacks Active Directory, yes. At $249 with a first exam attempt included, it is the cheapest hands-on offensive certification that carries real weight, and the AD skills transfer directly to SOC, pentest and internal red team work. It is worth less if you need a name that non-technical recruiters recognise, where OSCP still wins.
How much does CRTP cost?
The 30-day on-demand package is $249 and includes one exam attempt. Sixty days is $379, 90 days is $499, and the instructor-led bootcamp is $299. A 30-day lab extension costs $199 and a reattempt costs $99.
What is the difference between CRTP and OSCP?
CRTP is Active Directory only and hands you the initial foothold. OSCP covers external exploitation, web attacks, Linux and Windows hosts, and an AD set, and expects you to break in yourself. CRTP goes deeper on AD; OSCP goes wider and costs several times more.
How hard is the CRTP exam?
It is demanding but fair, and it is closed-book only in the sense that it is timed. You can use your notes and the course material. Candidates who fail usually did the labs by following the manual step by step and never repeated an attack from scratch, which is exactly what the exam requires.
Does the CRTP certification expire?
Yes, after three years. You can renew by sitting a free renewal exam before it expires, or by earning CRTE, CETP or CRTM instead.
Ready to Start Practising?
The CRTP certification rewards repetition in a lab, and so does every exam that sits either side of it on your path. If you are building towards offensive work from a CompTIA base, our PenTest+ practice questions and study material drill the methodology and reporting side that CRTP assumes you already have.
Create a free CertCrush account and start practising against exam-style questions today.