Zero-point Security's Red Team Ops II (CRTL) review

What it is

A first-hand review of Zero-point Security's Red Team Ops II course (the path to the CRTL certification), with concrete cost, time, and exam-format numbers the summary omits, plus the reviewer's judgment on prerequisites.

Preconditions / worth knowing before buying

• Cost: £425 (~€490) for course + 40 hours of lab access. It's a rolling-release, bought for life, with updates whenever Zero-point publishes them.
• Prerequisite: RTO I is not mandatory, but the reviewer advises taking it first if you're inexperienced. Critically — not everything the exam requires is taught in RTO II; if you skip RTO I, learn its syllabus anyway. The exam also needs creativity beyond the material.
• Time budget: ~30 hours to complete course + lab (so 40 lab hours is adequate, not tight). Exam took the reviewer ~50 hours.

What the course covers

Advanced red team tactics plus defence evasion, all exercises done in Cobalt Strike against a small virtual AD environment accessed via Guacamole in a browser. Specifically called out as relevant:

• Bypassing up-to-date AV (e.g. Microsoft Defender) on patched Windows.
• Bypassing WDAC, ASR, and other modern defences seen on current assessments.
• Bypassing "simple" EDRs (deliberately easier than Crowdstrike-class products, to lower the learning curve).
• Windows API programming and an introduction to Windows drivers.

You write your own tooling (e.g. for shell injection) in Visual Studio; reference code is provided so you can check your attempts afterward. Duggan's OPSEC notes are highlighted as field-tested and valuable.

The exam

• 72 hours of practical time spread across 5 calendar days.
• Four flags on a virtual environment; you must score 4/4 to pass — stricter than RTO I's 6/8.
• Rated realistic; some parts are "made easier" only because it's time-limited.

Caveats

• Limited lab time (40 hours) and the reviewer hit slow workstation connections on one day (possibly the provider, Snaplabs, being overloaded).
• Hermetic environment: external tools cannot be brought into the lab or exam.
• The CRTL has no HR-level recognition — only technical people in the field will know what it is.

The reviewer recommends the course and notes a driver-development course as a possible next step.