Simulate a Real Red Team Engagement. Prove You Can Reach the Objective.

The ARTOC exam is an advanced, hands-on red team simulation designed to validate real-world offensive operations across hardened enterprise environments.

This is not a capture-the-flag exercise. Candidates are placed in a live environment and must operate as an external attacker, starting with nothing more than a single IP address and working their way into a mature, defended network.

This certification evaluates your ability to plan, execute, adapt, and operate like a real red team operator under pressure.

Explore Live Training
Browse Certification Courses

Real Engagement. Real Constraints.

The ARTOC exam simulates a real-world client engagement.

You are given a single objective:

Gain access to sensitive data within the environment without being detected.

There is no guided path, no hints, and no predefined attack sequence. Multiple paths exist, and success depends on your ability to identify and chain them together.

Exam Only Option

White Knight Labs offers an Exam-Only option for experienced operators.

  • One attempt at the ARTOC exam
  • No course content included
  • Full access to the exam environment
  • Same certification requirements and standards

This option is intended for practitioners who already possess advanced red team experience.

Exam Overview

  • 48 hour hands-on technical assessment
  • 1 final flag to be captured
  • Additional 48 hours to submit a professional report

This is a pass or fail exam.

The report is mandatory and must include:

  • Full attack chain and methodology
  • Commands, tooling, and infrastructure used
  • Clear evideaScreenshots of access and compromisence of compromise
  • Explanation of misconfigurations and exploits
  • Operator decision-making and tradeoffs
  • How you maintained stealth and avoided detection

Starting the Exam

Students have full control over when they begin the exam.

  • The exam can be started at any time
  • No scheduled start time is required
  • On-demand students unlock the exam after completing all modules
  • Exam-only students receive immediate access after purchase

Once started:

  • The process is fully automated
  • The 48 hour timer begins immediately
  • There are no pauses, resets, or extensions
  • The exam cannot be restarted

Students should only begin when fully prepared.

The ARTOC exam begins from a true external attacker perspective.

  • You are provided one public IP address
  • No credentials are given
  • No internal access is provided
  • No additional context or documentation is shared

This is a black box engagement.

Students must:

  • Identify exposed services
  • Enumerate the attack surface
  • Develop an entry point
  • Work their way into the environment

The ARTOC exam environment simulates a mature enterprise network.

Includes:

  • Three domain environment with trust relationships
  • Hardened systems and realistic segmentation
  • Enterprise firewall protections
  • Active EDR and defensive controls
  • Multiple attack paths with no single solution

This environment reflects real-world networks encountered during client engagements.

White Knight Labs provides core infrastructure to support your operations.

Students receive:

  • Cobalt Strike Team Server:
    Preconfigured and running (latest version available)
    Student-level access with ability to modify profiles and restart
  • Development Server (Windows Server 2022/2025):
    Used for payload development and C2 interaction
  • Redirector Server (Ubuntu):
    External redirector with internal access to the team server
  • Public-facing infrastructure including ports 80/443
  • Internal access ports (e.g., 4443–4449) for advanced operations

Students must be prepared to operate within this infrastructure.

Students are expected to build and manage their own offensive infrastructure during the exam.

  • Domains are not provided
  • Students must configure required infrastructure themselves
  • This must be completed early in the exam window

Preparation is critical. This is part of the assessment.

Students may use:

  • Cobalt Strike (provided)
  • Any open source or commercial C2
  • Custom-built frameworks

Requirements:

  • Must support persistent communication (heartbeat)
  • Must support protocols such as HTTPS, DNS, or similar
  • Must support real red team operations (pivoting, SOCKS, etc.)

Simple reverse shells are not sufficient.

Built from Real Client Environments

The ARTOC exam is based on real enterprise environments encountered during red team engagements.

Students are exposed to:

  • Real domain configurations and trust relationships
  • Realistic segmentation and access controls
  • Defensive tooling and monitoring
  • Multiple viable attack paths

This is one of the closest simulations to a real engagement available in a certification.

Exam Objectives

Students must:

  • Enumerate and identify entry points
  • Gain initial access from an external position
  • Bypass defensive controls
  • Escalate privileges across domains
  • Move laterally through the environment
  • Maintain operational access
  • Reach and access the target data
  • Capture the final flag

This is an objective-based engagement, not a linear challenge.

What Is Required to Pass

To pass the ARTOC exam, students must:

  • Successfully navigate the environment from external access
  • Reach the target data location
  • Capture the final flag
  • Demonstrate full attack chain capability
  • Submit a complete professional report

This is a single-objective, pass or fail exam.

What You Must Submit

Students must submit a professional report that includes:

  • Full attack chain from initial access to objective
  • Commands, tooling, and infrastructure used
  • Screenshots of shells, beacons, or access
  • Identification of vulnerabilities and misconfigurations
  • Explanation of decisions and tradeoffs
  • Description of how stealth was maintained

Reports must reflect real red team reporting standards.

Environment Management

  • Students may restart systems as needed
  • Full environment rebuilds are allowed
  • Rebuilds may be performed multiple times
  • The exam timer will continue running at all times

Students are responsible for managing time and recovery.

Exam Expectations

This exam is intentionally difficult.

Students should expect:

  • Hardened systems and strong defenses
  • Multiple failed attempts before success
  • Complex attack chains across domains
  • Real-world constraints and limitations

This is one of the most challenging red team certification exams available.

After Submission

  • Submissions are manually reviewed by experienced operators
  • Reviews typically take 5 to 10 business days
  • Students are notified via email once results are finalized

Environment Stability

  • The environment is monitored by White Knight Labs
  • If a verified platform issue occurs, it will be investigated
  • A free retest will be provided if necessary
  • No resets or extensions are granted for user error

Retakes

  • Retakes are available immediately
  • No cooldown period
  • Each attempt requires a new exam purchase

Not an Entry-Level Exam

The ARTOC exam is not beginner friendly.

Students should have experience with:

  • Red team operations and workflows
  • Active Directory exploitation
  • Command and control infrastructure
  • EDR evasion techniques
  • Lateral movement and privilege escalation

Should You Take the ARTOC Exam

You should attempt this exam if:

  • You can operate independently in unknown environments
  • You have experience with red team engagements
  • You understand multi-domain Active Directory environments
  • You can adapt when techniques fail

You should not attempt this exam if:

  • You are new to offensive security
  • You rely on guided labs or walkthroughs
  • You are not comfortable building infrastructure

Important Policies

  • No extensions are granted once the exam has started
  • The exam cannot be paused or restarted
  • Exam vouchers are non-refundable
  • All sales are final

Frequently Asked Questions (F.A.Q)

  • No. This is not an entry-level exam. ARTOC is designed for experienced red team operators and penetration testers who are comfortable working in complex, real-world environments.
  • No. You may purchase the exam-only option if you already have the required experience. However, the course is strongly recommended for most students.
  • You can start the exam at any time.
  • No scheduled start time is required
  • The process is fully automated
  • The timer begins immediately when the exam is launched
  • 48 hours for the technical assessment
  • 48 additional hours to submit the report
  • Once started:
  • The timer begins immediately
  • The exam cannot be paused or restarted
  • No extensions are granted under any circumstances
  • Students should only start when fully prepared.
  • You begin from an external attacker perspective.
  • You are given a single public IP address
  • No credentials are provided
  • No internal access is available
  • No additional information is given
  • This is a true black box engagement.
  • To pass the exam, you must:
  • Successfully gain access from an external starting point
  • Navigate through the environment
  • Reach the target data
  • Capture the final flag
  • Submit a professional report documenting your full attack chain
  • This is a pass or fail exam based on achieving the objective.
  • You must submit a professional report that includes:
  • Full attack chain from initial access to objective
  • Commands, tooling, and infrastructure used
  • Screenshots of shells, beacons, or access
  • Explanation of vulnerabilities and misconfigurations
  • Description of decision making and tradeoffs
  • How you maintained stealth during the engagement
  • You may use any tools, scripts, or frameworks
  • Internet access for research is allowed
  • Custom tooling and automation are encouraged
  • Collaboration or sharing solutions is prohibited
  • Yes.
  • You may use Cobalt Strike (provided)
  • You may use any open source or commercial C2
  • You may build your own C2
  • Your C2 must support real red team operations such as persistent access, pivoting, and communication over protocols like HTTPS or DNS.
  • No.
  • You must operate like a real red team operator. Simple shells are not sufficient for navigating and completing the environment.
  • Three domain enterprise environment
  • Trust relationships between domains
  • Hardened systems and segmentation
  • Active EDR and defensive controls
  • Multiple attack paths
  • This environment reflects real-world enterprise networks.
  • No.
  • This is not a linear CTF challenge. There are multiple valid attack paths, and success depends on how you approach the environment.
  • Yes.
  • Students are expected to configure required infrastructure
  • Domains are not provided
  • Preparation and setup are part of the assessment
  • This is part of the challenge.
  • The environment contains multiple entry points. Students must enumerate and identify viable paths.
  • Yes.
  • Systems may be restarted
  • Full environment rebuilds are allowed
  • Rebuilds can be performed multiple times
  • The exam timer will continue running
  • The environment is monitored by White Knight Labs
  • If a verified platform issue occurs, it will be investigated
  • A free retest will be provided if necessary
  • No resets or extensions are granted for user error
  • No.
  • This environment is designed to simulate a hardened network. Traditional administrative access methods such as RDP are not available.
  • Yes.
  • Students are expected to operate with a red team mindset and remain as covert as possible while achieving the objective.
  • No. Collaboration, sharing solutions, or receiving assistance from others is strictly prohibited.
  • Yes.
  • Retakes are available immediately
  • No cooldown period
  • Each attempt requires a new exam purchase
  • Reports are manually reviewed
  • Reviews typically take 5 to 10 business days
  • You will be notified by email once results are finalized
  • No.
  • Exam vouchers are non-refundable
  • All sales are final
  • No. Each student receives an isolated environment.
  • The exam and all materials are provided in English.

Still Have Questions

If you have questions before attempting the exam, contact:

support@whiteknightlabs.com

Ready to Attempt the ARTOC Exam

The ARTOC exam is designed for operators who want to prove they can perform real red team operations under real constraints.

If you are ready, begin the engagement.

Purchase

Train with Confidence

White Knight Labs trains professionals who operate in production environments, mature defensive stacks, and regulated organizations.


If your goal is real offensive capability, not just a certificate, our training is built for you.

Certification Courses
Instructor-Led Training
Github X-twitter Linkedin-in Discord

Quick Links

Contact

Services & Company Inquiries:

Student Support
(Billing, Labs, Content, Vouchers, Tickets):

Copyright © 2026 White Knight Labs – All rights reserved

×

Loading modules...