HTB CJCA study guide
HTB CJCA · Work through your exam, one topic at a time.
The HTB CJCA (Certified Junior Cybersecurity Analyst) is an entry-level credential offered by Hack The Box that validates the foundational knowledge expected of someone stepping into a first security role - SOC analyst, junior blue-teamer, or IT generalist with security responsibilities. It is aimed at candidates with little or no professional experience who want a structured, verifiable signal of baseline competence rather than a deep specialist certification. The HTB CJCA study guide has 8 sections and about 2,479 words.
01Security Fundamentals and Concepts
This domain tests the vocabulary and mental models CJCA candidates use to reason about security decisions: the CIA triad, risk, controls, and trust boundaries. Expect questions that ask you to classify a control or identify which security property a measure protects.
320 words, about 2 min02Networking Fundamentals
Networking Fundamentals tests how data moves between hosts and how attackers and defenders use that path. CJCA questions focus on the OSI/TCP-IP models, core protocols, port numbers, and basic troubleshooting logic.
324 words, about 2 min03Operating System and Endpoint Security
Operating System and Endpoint Security tests hardening and permission logic on Windows and Linux endpoints. CJCA expects you to read access rules, identify risky configurations, and choose endpoint controls that actually reduce attack surface.
335 words, about 2 min04Identity, Access, and Authentication
Identity, Access, and Authentication tests how systems prove identity and enforce permissions. CJCA questions cover factors, federation protocols, access models, and credential storage.
300 words, about 2 min05Threats, Vulnerabilities, and Attack Techniques
Threats, Vulnerabilities, and Attack Techniques tests how attacks work and how to describe them precisely. Expect questions on malware, social engineering, web vulnerabilities, threat modeling, and scoring.
310 words, about 2 min06Security Operations and Incident Response
Security Operations and Incident Response tests how a SOC detects, escalates, and contains incidents. CJCA focuses on process order, evidence handling, and the difference between containment and eradication.
286 words, about 1 min07Log Analysis, Monitoring, and Detection
Log Analysis, Monitoring, and Detection tests whether you can read telemetry and turn it into a defensible detection. CJCA emphasizes Windows event IDs, Linux logs, network logs, and correlation.
303 words, about 2 min08Governance, Risk, and Compliance Basics
Governance, Risk, and Compliance Basics tests the documents and decisions that steer security: policy, risk treatment, audits, and regulatory obligations. CJCA expects practical distinctions, not legal advice.
301 words, about 2 min