Demonstrate capability in Red Team engagement skills and operations from start to finish.
The GIAC Red Team Professional (GRTP) certification validates an individual’s ability to conduct end-to-end Red Team engagements. GRTP certification holders have the expertise to build an adversary emulation plan, establish an C2 infrastructure, and emulate adversary tactics, techniques, and procedures (TTPs) to assist in improving overall security.
Areas Covered
- Build an adversary emulation plan using gathered threat intelligence
Create a comprehensive attack infrastructure
Perform target reconnaissance
- Bypass common defense mechanisms
Gain initial access
Network and Active Directory enumeration
Propagate throughout the network
Active Directory attacks
Collect and exfiltrate sensitive data
- Produce an engagement report
Present Red Team actions to key personnel
Retest and replay Red Team activities
Who is GRTP for?
- Security professionals responsible for Red Team engagements
- Penetration testers
- Red Team members
- Blue Team members
- Auditors, defenders, and forensic specialists who want to better understand offensive methodologies, tools, tactics, techniques, and procedures
- Information security managers who participate in Red Ream engagements
CyberLive: Real labs. Real tools. Real skills.
CyberLive is a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments to validate real-world capability.
Virtual Machines:
Full-scale lab systems that behave like physical computers: install, attack, defend, and run services.
Real Security Tools:
Exact tools used by professionals every day including all the quirks and challenges
Authentic Code:
Real code, real exploits, real impacts
Instructor Testimonial
“Instructor Testimonial
With this course we provide students with a blueprint they can use to set up a realistic Red Team operation against a client environment. Students will be able to consume threat intelligence, formulate a plan of attack, execute it, and ultimately create a debrief package that will provide maximum value for their organization. This course truly brings together a wide variety of knowledge provided by actual real world practitioners and aims to equip the students with state-of-the-art tradecraft, keeping up to date with the latest and greatest TTPs. No other course brings together such a wide variety of knowledge of all things Red Team.”
Exam Format
- 1 proctored exam
- 82 questions
- 3 hours
- Minimum passing score of 76%
Note: GIAC periodically reviews and may update certification specifications to ensure fairness, validity, and reliability. Using a psychometric standard-setting study, GIAC has set the passing score for the GRTP exam at 76% for all candidates who receive the exam version released on or after April 10, 2026.
To confirm the exam format and passing score that apply to your specific attempt, please refer to the Certification Information section of your GIAC account: https://exams.giac.org/pages/attempts.
Certification Delivery
GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.
NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.
Exam Certification Objectives & Outcome Statements
- Adversary Emulation FundamentalsThe candidate will have an understanding of common terminology, frameworks, and methodology associated with adversary emulation.
- Attacking Active DirectoryThe candidate will have an understanding of Active Directory objects, the different authentication methods offered within an Active Directory environment, and the techniques used to attack those authentication methods.
- Command and Control infrastructureThe candidate will have an understanding of command-and-control deployments, uses, channels and tools including Empire and Cobalt Strike.
- Creating the Attack infrastructureThe candidate will have an understanding how to create and manage an adversary infrastructure to include, an adversary domain, DNS, and an understanding of redirection and pivoting.
- Discovery and EnumerationThe candidate will have an understanding of how to perform network and Active Directory discovery and enumeration as well as how to acquire available credentials within the target environment.
- Enumerating and Attacking PrivilegesThe candidate will understand how to determine privileges within the environment and how to escalate to the required privileges to achieve their objectives including Linux attacks and performing privilege recon remotely.
- Gaining AccessThe candidate will have an understanding on how to perform reconnaissance on a target, how to create and test a malicious payload, and how to deliver the malicious payload ensuring access to the target environment.
- Leveraging the DomainThe candidate will have an understanding of how to move within the target environment in order to achieve the objectives of the engagement.
- Persistence and ExfiltrationThe candidate will have an understanding on different methods to gain persistence in a environment and how to exploit that persistence to complete the objectives of the engagement including, gaining access to a database, staging data for exfiltration, and emulating ransomware.
- Red Team Engagement Planning and ReportingThe candidate will be able to plan an engagement including tasks such as adversary profiling, scoping the engagement, and red team creation. The candidate will also be able to understand how to close the engagement including data consolidation, revealing the red teams actions, producing an engagement report, and determining if retesting will be completed.
Practice Tests
- Practice exams are a simulation of the real exam, allowing you to become familiar with the test engine and style of questions
- Practice exams can serve as a gauge to determine if your preparation methods are sufficient
- The bank of practice questions is limited, so you may encounter the same question on multiple practice tests
- Practice exams never include actual exam questions
- Purchase a GRTP practice test here
Other Resources
- Training is available in a variety of modalities including live training and OnDemand
- Practical work experience can help ensure that you have mastered the skills necessary for certification
- College level courses or self-paced study through other programs or materials may meet the needs for mastery
- Understand the procedure to contest exam results