Certified Azure Red Team Expert (CARTE) - Review 🚀

Hey again everyone! This is Foued SAIDI: Senior Penetration Tester at Intrinsic-Security , holder of CARTE, CRTE, CRTP, CARTP, CADPenXv2 and CETP professional certifications, Web3/Blockchain Security Researcher and Bug Bounty Hunter.

I have recently passed my Certified Azure Red Team Expert (CARTE) certification from Altered Security and I would like to share my feedback regarding it along with a few tips for anyone planning on passing it.

CARTE Overview

First of all, CARTE (Certified by Altered Security Red Team Expert for Azure) is a 48-hour completely hands-on certification where the holder has the expertise to assess the security posture of a highly secure, live multi-tenant Azure environment by purely abusing misconfigurations, feature abuse and trust relationships across tenants.

What I really like about Altered Security is that their professional certifications only rely on real-life misconfigurations and logic abuses, not some CTFy unrealistic stuff. CARTE is basically the “expert” big brother of CARTP: where CARTP got you comfortable with Azure/Entra ID attacks, CARTE throws you into a much harder, defended, cross-tenant environment where Conditional Access, MFA, PIM and Defender for Cloud are actually in your way and you have to work around them.

I consider achieving this certification a really worthwhile investment as the lab access starts at 499$ for 30 days (699$ for 60 days and 899$ for 90 days), and each purchase includes lifetime access to the course material and one exam attempt. In case of failure, the retake fee is a reasonable 99$ with a 1-month cooldown period. The certification is valid for 3 years, with a FREE renewal exam before it expires (which is a really nice touch and something more vendors should do).

One thing worth mentioning: this is an expert-level cert, so it does expect you to already have some Azure security / red teaming background. If you’re completely new to Azure attacks, do CARTP first, otherwise you’re going to have a rough time.

Course Content

Regarding the course content, we were provided with access to the Altered Security platform which is a centralized hub for all your certs and materials: course videos, learning objectives walkthroughs, a full Lab Manual, course PDF/slides, diagrams describing all attack paths for the course and finally a zip file containing all the necessary tools for the lab.

The course is built around 18 learning objectives spread across 4 independent kill chains, and Altered Security advertises it as 200+ hours of content, which honestly is not an exaggeration once you actually start grinding the lab.

While going through the course, you’ll be learning a LOT of advanced Azure and Entra ID red teaming: cross-tenant lateral movement, hybrid identity abuse, cloud-to-on-prem pivots, multi-cloud abuse and a whole lot of modern token/identity trickery. What I really appreciated is that each kill chain feels like its own realistic engagement with a full attack path, not just isolated “here’s a technique” labs.

Here is a breakdown of what each kill chain roughly focuses on:

Kill Chain 1 — Device code phishing, Family of Client IDs (FOCI) abuse, JWT assertion signing, ABAC exploitation, Conditional Access bypass, Temporary Access Pass (TAP) abuse, cross-tenant lateral movement and PIM abuse.

Kill Chain 2 — Custom claims abuse, Logic Apps exploitation, hybrid identity attacks and cloud-to-on-premises lateral movement through cloud sync.

Kill Chain 3 — GitHub Actions abuse, authentication strength evasion, token extraction from Office applications and Entra Kerberos exploitation, with a pivot all the way down into on-prem resources.

Kill Chain 4 — Illicit Consent Grant, Attacker-in-the-Middle (Evilginx-style) phishing, Azure Lighthouse abuse, Azure Arc exploitation and a Silver SAML / SAML SSO privilege escalation to finish it off.

But personally, what I REALLY liked about the course is the cross-tenant and hybrid identity work. Pivoting from one tenant into a completely separate one, and going cloud-to-on-prem through cloud sync and Entra Kerberos, is exactly the kind of stuff that reflects real modern enterprise environments where everything is interconnected. It’s the most thorough treatment of multi-tenant Azure attacks I’ve seen in a certification so far.

Course practice Lab

As for the provided course lab, I really liked how stable it was (it was really that stable during every course I have taken with Altered Security). Every issue I thought I had with the lab turned out to be a skill issue on my side haha. I would also like to really thank the support team, they are REALLY available 24/7, the latest they have ever answered me was after 45mn (they usually respond within 15mn max). They are really helpful, respectful, patient and know what they’re doing.

I didn’t encounter any issues, latency or lag whatsoever (just make sure to choose the closest location to you geographically when choosing your server access). Since this is a live multi-tenant Azure lab, everything runs against real Azure services, so you’re practicing against the exact same technologies and defenses you’ll face in the exam and in real engagements.

Exam Environment

The exam is a 48-hour completely hands-on experience. Once started, the exam lab runs for 49 hours. You get an additional hour to compensate for the lab setup time of 10-15 minutes (a huge + for Altered Security).

The exam environment is a highly secure, live multi-tenant Azure setup spread across 5 live Azure tenants with multiple resources. The goal is to compromise all the resources across the tenants and submit a report.

You get a Student VM in the lab, and you can re-launch the exam or reboot the environment from the dashboard. One small but useful detail: the exam dashboard itself notes a known Azure Portal quirk with PIM role activation, and tells you to use the Az PowerShell module or the relevant access token to activate the role instead of the portal. Little things like that being documented right on the dashboard saved me from second-guessing myself during the exam.

A detailed report of the engagement must be delivered within 48h of the exam attempt ending (which is a very good time to allow you to get some rest). As for me, after my previous experiences with CRTP, CRTE, CARTP and CETP, I figured to just start writing the report in parallel while attempting the exam: that allowed me to stay organized and not miss any details (I’m also a bit lazy to write it without lab access later haha).

I managed to compromise the whole multi-tenant infrastructure and finish the report comfortably within the time window. Note that during that time I took breaks, had lunch and dinner, prayed my 5 prayers (priorities of course), and got some actual sleep between the two days. So the time was not fully for the exam only. CARTE is genuinely harder and longer than CARTP, so don’t be discouraged if this one takes you significantly more time than the other Azure cert, that’s completely normal and expected here.

Time Management

One thing that those who think of passing the CARTE exam should give a really good thought to, is time management. You have 48 hours, and while that sounds like a lot, remember you’re dealing with 5 tenants and 4 full kill chains worth of attack paths, so it goes by faster than you’d think.

One thing I could advise you to do, is to try and avoid rabbit holes (there isn’t any but still) and don’t get too stuck on a single resource or misconfiguration (or something you might think is vulnerable). Everything on the exam maps back to the course material, you don’t have to look for any vulnerabilities that you did not study for. If a token, a role activation or a phishing step isn’t behaving the way you expect, take a step back, re-enumerate, and double check you’re using the right identity/token, because in Azure it’s almost always an identity/scope issue rather than the lab being “broken”.

Also, use the 48 hours the way they’re meant to be used: this is a two-day exam, so actually sleep. Coming back fresh on day two with a clear head is worth way more than grinding at 4am on token errors.

CARTE exam pros and cons

Pros:

What I really liked about CARTE:

The extensive course material and the sheer amount of content (18 learning objectives, 4 kill chains, 200+ hours), it’s genuinely a lot of value.
The really stable live multi-tenant Azure lab and exam environments.
The responsive support team who have never failed to provide students with support.
The Tutor’s methodology and way of explaining complex Azure concepts by making them sound easy.
The realistic, modern nature of the techniques: FOCI abuse, Conditional Access/MFA/auth-strength evasion, PIM abuse, Entra Kerberos, Azure Arc, Lighthouse, Silver SAML… this is exactly what current Azure red teaming looks like.
The deep dive into cross-tenant lateral movement and hybrid cloud-to-on-prem attacks.
The 3-year validity with a FREE renewal exam, which is a really student-friendly policy.

Cons:

The lab pricing is a bit higher than the other Altered Security certs (499$ for 30 days), but given that it’s an expert cert running live multi-tenant Azure with 200+ hours of content, it’s still justified in my opinion.
Because everything runs on live Azure, you’re occasionally at the mercy of Azure Portal quirks (like the PIM activation bug mentioned on the dashboard). It’s well documented and easy to work around, but it’s the kind of thing you don’t get in a fully self-contained on-prem lab.

That’s honestly about it for the cons, the experience overall was really solid.

Things I’d like to see in the future

CARTE already touches multi-cloud a bit (there’s some AWS interaction in one of the kill chains through the multi-cloud parts), and I think leaning even further into true multi-cloud attack paths (Azure ↔ AWS ↔ GCP pivots) in a future iteration would be amazing, since more and more enterprises are genuinely multi-cloud now. Expanding the on-prem side of the hybrid attacks even further would also be a really welcome addition.

Practical Tips

Some tips that will help you along the way:

Take notes, they will REALLY help you while studying and you can get back to them anytime. For CARTE especially, organize your notes per kill chain and keep a running table of every identity, token, app and role you’ve compromised, because in a multi-tenant environment it gets messy FAST.
Do every single learning objective yourself in the lab, don’t just watch the walkthroughs. Azure attacks have a lot of small moving pieces (scopes, tokens, consent) and you only really get them by doing them.
Get comfortable with the tooling before the exam (Az PowerShell, Az CLI, AzureAD/Microsoft Graph, ROADtools, etc.) and have your token/enumeration workflow ready to go so you’re not fumbling with syntax under pressure.
If something behaves weirdly, it’s almost always the token/scope/identity, not the lab. Re-check who you are and what you’re allowed to do before assuming it’s broken.
Remember to get some sleep or to take a 10mn walk if you feel stuck, it can really refresh your mind. It’s a 2-day exam, use both days.
Review your course notes and lab notes before passing the exam, also keep them open on the side for easy access.
Always try to think out of the box and as a creator of the exam, it’ll give you new insights.
Stay hydrated :=) (seriously haha)

Personal Opinion

I really loved the CARTE exam. Great course material, responsive lab support team, stable infrastructure both for the course and the exam lab, and some of the most realistic and modern Azure red teaming content I’ve come across in a certification. It is a great certification for anyone looking to seriously level up in Azure and cloud red teaming after CARTP.

CARTE really fills the “expert Azure” gap: most cloud certs stop at basic identity attacks, but CARTE pushes you into defended, cross-tenant, hybrid environments where you actually have to evade Conditional Access, MFA and PIM to get anywhere. If you enjoyed CARTP, this is the natural and very worthwhile next step. Big shoutout to Nikhil and the whole Altered Security team for putting together such a deep and well-crafted course.

I will hopefully be getting back for CRTM/CESP-ADCS certifications, also from Altered Security.
Stay tuned ! Hope you enjoyed this blog post, and see you soon with a new review!

Foued SAIDI (A.K.A. 0xkujen)