CARTP Review: The Optional Flag I Couldn't Walk Away From

There’s a flag in the CARTP lab you don’t need. It doesn’t count toward anything. It’s marked optional, it won’t appear on your exam, and nobody would blame you for skipping it.

It cost me two days.

I ended up tearing down my whole approach and rebuilding the path from scratch, not because a tool broke, but because my thinking was messy and that was the only way to see the trail. When it finally popped it was 4 a.m. and I said something out loud I won’t repeat here. That optional flag taught me more about attacking Azure than any single video in the course. Honestly, that’s the highest compliment I can pay CARTP.

Here’s what it’s actually like, and whether it’s worth your money.

TL;DR

If you have some security fundamentals and you want to actually learn to attack Azure and Entra ID, not just read about it, CARTP is one of the best-value certs going. The content is excellent, the lab is the real teacher, and the exam is fair. The rough edges are all in delivery, not substance.

Overall is weighted toward what matters: content and lab, not production polish.

Pros

• Genuinely hands-on. You attack real Azure, not slideware.
• Kill-chain thinking, not a checklist of isolated tricks.
• The lab is deep, and the optional content will humble you (in the best way).
• $449 with lifetime access to the course material. Ridiculous value.
• Responsive, technically competent support.

Cons

• The videos are recorded live bootcamp sessions, not purpose-built lessons.
• Auto-generated subtitles mangle half the technical terms (a captions file that can’t spell your tooling is not a great look on a paid course).
• Content is organized by learning objective, not by kill chain, so the end-to-end “story” is something you assemble yourself.
• You won’t use everything you learn on the exam. Fine, but worth knowing.

Is CARTP for you?

Quick gut-check before you spend the money. This assumes some security grounding. If you’ve done CRTP or you already think in attack paths, you’ll feel at home fast. I came in with CRTP and a red-team background but essentially zero Azure, and the hardest part was unlearning on-prem instincts, not the cert itself. If you’ve never opened a cloud console you’ll still make it, but do AZ-900 or a weekend of Azure fundamentals first. Otherwise day one is spent learning what a subscription is instead of how to abuse one.

The course

The content is the strong part. It covers what you’ll actually reach for: recon, initial access, authenticated enumeration, privilege escalation, lateral movement, and persistence, all mapped onto how Azure and Entra ID really behave. The single most important idea it hammers in is control plane vs data plane. The portal saying “access denied” often means nothing, because the data plane is wide open to the exact token you’re holding. Once that clicks, you start seeing doors everywhere.

Now the honest part. You’re not watching a polished studio course. You’re watching recordings of the instructor’s live bootcamp. There’s real value there (unscripted war stories and “here’s why this fails in the real world” asides you never get from a script), but only the instructor is mic’d, so you’ll sit through him answering audience questions you can’t hear, one-sided exchanges that stretch the runtime. And the subtitles are auto-generated, so the second a technical term shows up (tool names, attack names, Azure services) the captions turn to confetti. For $449, cleaned-up captions and a tighter edit would go a long way.

One more quirk: the material is sequenced by learning objective, not by kill chain. So you learn “initial access technique #1” from one path, then jump to the same stage on another path, and it’s on you to stitch it into a full attack story. I actually think assembling that story yourself is good for learning. Just go in expecting it.

The lab

This is where CARTP earns its name. It’s a proper multi-tenant Azure environment full of realistic misconfigurations, and it hands you nothing. Lab access comes in 30, 60, or 90-day options; I took the 30-day and treated every hour as exam prep, because it is.

What the lab does better than most is force you to hold a lot of state in your head. You’ll juggle users, service principals, managed identities, and tokens, and it’s dangerously easy to forget which identity you’re currently wearing. Half of getting stuck is just losing track of who you are. The other half is tunnelling on the first shiny thing instead of enumerating broadly.

And then there’s that optional flag. It’s a longer, meaner chain than anything the exam asks, and it’s the reason I now genuinely understand Azure attack paths instead of just reproducing them. My two-day detour wasn’t a tooling failure. It was a methodology failure. The fix wasn’t a new exploit; it was slowing down, writing everything out, and organizing my thinking until the path revealed itself. If you take one line from this review: when you’re stuck in cloud, it’s almost never the tool. It’s your notes.

The exam

Public facts only, because that’s all you’ll get from me. It’s a 24-hour hands-on exam in a dedicated environment (a handful of Azure resources across two tenants), and the lab stays live for 25 hours (the extra hour covers setup). You then have 48 hours to submit a detailed PDF report, with one attempt included (you can re-launch the lab twice if something goes wrong).

My honest, slightly contrarian take: the exam is easier than the lab, and less complicated than I’d built it up to be. If you grind the lab (especially that optional monster) the exam feels fair and genuinely approachable. It’s a clean, well-scoped chain that rewards the instincts you’ve been practising: enumerate, find the breadcrumb, pivot, repeat. You will not need every technique in the course; a focused subset carries you through.

“Easier” is not “trivial” though. Two things still decide it: time management (24 hours feels huge until you rabbit-hole four of them into a dead end) and the report (a working exploit you can’t clearly document is worth less than you think). Take breaks. I mean it: a 20-minute walk unstuck me more than once.

The feel of it, without the how: a quiet, satisfying chase. One credential leads to one identity, which opens one door, which reveals the next breadcrumb, until the moment you realize you’ve stepped out of one company entirely and into another that thought it was safely separate. That single “wait, I’m not even in the same tenant anymore” click is the whole cert in one beat.

If you’re about to start, the tips I’d give a friend

• Your notes are the exam. Write down every step, every identity, every token, as you go. That log is your open book, and your report.
• Build the report during the lab, not after. Screenshot every step and output while the lab is live, because it dies at 24 hours. Budget it like Altered Security suggests: roughly 12 hours attacking, 6 writing. A full compromise with a weak report can still fail you.
• Enumerate broadly before you commit. The path usually becomes obvious once you’ve looked around. Resist tunnelling on the first interesting thing.
• Track which identity you’re wearing. Most “I’m stuck” moments are really “I forgot who I am right now.”
• Control plane is not the data plane. “Denied” in the portal doesn’t mean denied to your token. Always check the data plane.
• Set up your tooling on the host first. The exam VM ships with no tools (you copy-paste your own over), and internet is available. If you use BloodHound, run the GUI on your host and only run the collectors in the lab, it saves real time.
• The lab is the study, not the videos. Re-doing objectives by hand beats re-watching every time.
• Take breaks and manage the clock. Walk away when you’re forcing it, a 20-minute reset beats grinding a dead end for an hour.
• Consistency helps, but life happens. I studied maybe 3 to 4 hours a day for about six weeks: some 8-hour days, some skipped entirely. The lab reps mattered more than a perfect schedule.

Value and how it compares

At $449, including lifetime access to the material and one exam attempt, this is hard to beat in cloud security. Put it next to the four-figure price tags elsewhere in offensive security training and the value per dollar isn’t close.

If you’ve done CRTP, treat CARTP as its Azure cousin: the same “learn the identity system, then abuse it end-to-end” philosophy, aimed at Entra ID and Azure RBAC instead of on-prem AD. If you’re crossing over from AWS, the concepts transfer but the mechanics don’t, so budget lab time for the difference.

Verdict: 8.8/10, and I’d do it again

CARTP is a hands-on, no-fluff, genuinely-teaches-you cloud red-team cert, with a lab that punches well above its price. Dock it a point for the bootcamp-recording format and the subtitles that can’t spell half the technical terms, but none of that touches the substance. If you want to walk away actually able to attack an Azure tenant instead of just talking about it, this is money well spent.

And if you want the version of you that finishes the required flags and stays up two extra nights for the one that doesn’t count? That person has more fun. Go get the optional flag. You’ll thank yourself.

CARTP was good enough that I’m already eyeing CARTE, its Expert-level sibling. If I survive it, that writeup comes next.

Got a CARTP question, or working through the lab right now? I’m happy to help, reach me at contact@majdeddine.com, X, or LinkedIn. And if you’re hiring in offensive security or Azure red teaming, my door’s open.