HTB CJCA case studies
HTB CJCA · Put your knowledge to work in context.
The HTB CJCA (Certified Junior Cybersecurity Analyst) is an entry-level credential offered by Hack The Box that validates the foundational knowledge expected of someone stepping into a first security role - SOC analyst, junior blue-teamer, or IT generalist with security responsibilities. It is aimed at candidates with little or no professional experience who want a structured, verifiable signal of baseline competence rather than a deep specialist certification. The exam is delivered in a multiple-choice and scenario-based format, so it tests both recall of core concepts and the ability to reason about a short situation and pick the defensible answer. Coverage spans the building blocks of the field: security principles and terminology, networking fundamentals, operating system and endpoint hardening, identity and authentication, common threats and vulnerabilities, security operations and incident response, log analysis and detection, and the governance, risk, and compliance basics that shape real decisions. The HTB CJCA case studies are 5 cases and about 3,509 words.
1PCI Segmentation on a Flat /16
Northwind Retail runs a flat 10.10.0.0/16 network across one headquarters and two stores. Its 24 payment terminals sit in VLAN 50 (10.10.50.0/24) and must reach an on-premises update server at 10.10.10.20, a payment processor at 198.51.100.0/28 over an IPsec tunnel, and DNS/NTP.
696 words, about 3 min2Application Allowlisting With a Legacy ERP
Contoso Manufacturing has 60 Windows 10 workstations on one AD domain. Every user is a local administrator because an ERP client writes to C: Files and to HKLM ; the vendor signs the executable.
711 words, about 4 min3Kerberoasting Alert During Payroll
Tailspin has 1,200 employees, on-premises Active Directory, Entra Connect, and a 90-day password policy. MFA is enforced only on VPN and Microsoft 365; internal apps use Kerberos.
706 words, about 4 min4Phishing-Led Endpoint Compromise on a Friday
At 10:05 on Friday, EDR alerts on FIN-LT-022, a finance laptop at a 200-person SaaS company. WINWORD.EXE spawned powershell.exe with an encoded command, created a scheduled task named Updater, and opened a connection to 203.0.113.45:443.
699 words, about 3 min5Password Spraying in a Noisy SIEM
Your SIEM ingests 8,000 EPS from 500 Windows endpoints, 12 servers, VPN, and Entra ID. Two analysts triage roughly 450 alerts per day.
697 words, about 3 min