HTB CJCA study plan
HTB CJCA · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Fundamentals and Concepts & Networking Fundamentals
Explain the CIA triad, defense in depth, least privilege, and risk vs. vulnerability vs. threat using your own written definitions, not copied text
Map the OSI and TCP/IP models against each other and state which layer each of ARP, IP, TCP, UDP, TLS, DNS, and HTTP operates at
Calculate subnet boundaries for /24, /25, /26, and /27 ranges by hand and verify each answer with a subnet calculator
Identify the purpose of the most common ports (22, 25, 53, 80, 123, 389, 443, 445, 3389) and the protocol each carries
Your checkpoint
A one-page cheat sheet listing 20 core security and networking terms with your own one-sentence definitions plus a 10-row port/protocol table, self-quizzed to 90% accuracy
Networking Fundamentals & Security Fundamentals and Concepts
Trace a full TCP three-way handshake and a TLS 1.3 handshake step by step, naming the packets exchanged and what each side learns
Distinguish stateful vs. stateless inspection and explain how NAT, VLANs, and a DMZ segment change traffic flow
Interpret a packet capture of a DNS query and an HTTP request and identify the source, destination, and payload at each layer
Describe symmetric vs. asymmetric encryption, hashing, and digital signatures and where each appears in TLS and file integrity checks
Your checkpoint
A written walkthrough of one captured HTTP or TLS session (from a lab you generated) explaining every layer and the cryptographic step involved, at least 400 words
Threats, Vulnerabilities, and Attack Techniques & Security Fundamentals and Concepts
Classify at least 15 common attack techniques (phishing, credential stuffing, SQL injection, XSS, privilege escalation, lateral movement, ransomware) by the CIA pillar each most damages
Explain the vulnerability lifecycle from discovery through CVE assignment, CVSS scoring, and patch or mitigation
Read a CVSS v3.1 vector string and translate each metric into plain language
Describe the MITRE ATT&CK tactic flow from initial access to impact and place five techniques on it
Your checkpoint
An attack-to-impact table of 15 techniques with CIA impact, a sample CVSS vector decoded, and the corresponding ATT&CK tactic for each
Threats, Vulnerabilities, and Attack Techniques & Security Operations and Incident Response
Walk through the incident response lifecycle (preparation, identification, containment, eradication, recovery, lessons learned) and state the decision made at each stage
Differentiate an event, an alert, and an incident and justify escalation decisions in three short scenarios you write
Explain common web and network attack mechanics (SQLi, XSS, directory traversal, ARP spoofing, DNS poisoning) at the level needed to spot them in logs
Draft containment options for a suspected compromised endpoint and rank them by business disruption
Your checkpoint
A tabletop incident report for a fictional phishing-to-ransomware scenario: timeline, IR phase at each step, containment choices, and lessons learned
Operating System and Endpoint Security & Identity, Access, and Authentication
Compare Windows and Linux access control models (ACLs, sudo, file permissions) and demonstrate least-privilege configuration in a lab VM
Explain authentication vs. authorization and place MFA, SSO, Kerberos, and OAuth/OIDC in the identity flow
Describe password storage best practice (salting, slow hashing) and why password spraying defeats lockout policies
List endpoint hardening controls (patching, application allowlisting, EDR, disk encryption, logging) and the attack each one blocks
Your checkpoint
A hardening checklist of 15 concrete controls covering one Windows and one Linux system, each mapped to the threat it mitigates and how you would verify it is enabled
Log Analysis, Monitoring, and Detection & Security Operations and Incident Response
Identify the key fields in Windows Event Log, Linux syslog/auth.log, and a web server access log and say what anomaly each field can reveal
Write detection logic (in plain language or a Sigma-style rule) for three behaviors: repeated failed logins, unusual process parent-child pairs, and outbound traffic to a new domain
Explain log sources, retention, time synchronization, and centralized logging as prerequisites for detection
Triage a set of sample log lines and separate benign noise from two true positives with reasoning
Your checkpoint
A detection workbook with three written detection rules, the log source each needs, expected false positives, and a triage write-up of a supplied sample log set
Governance, Risk, and Compliance Basics & Log Analysis, Monitoring, and Detection
Distinguish governance, risk, and compliance and place policies, standards, procedures, and guidelines correctly in a hierarchy
Explain the purpose of ISO 27001, NIST CSF, SOC 2, GDPR, and PCI DSS and the type of organization each applies to
Perform a qualitative risk assessment (likelihood x impact) on five risks and assign treatment options (accept, mitigate, transfer, avoid)
Describe how monitoring and log retention requirements flow from compliance obligations into daily operations
Your checkpoint
A risk register of five risks with likelihood, impact, score, treatment decision, and the compliance driver behind each, plus a one-page control-to-framework mapping
Security Fundamentals and Concepts & Networking Fundamentals & Operating System and Endpoint Security & Identity, Access, and Authentication & Threats, Vulnerabilities, and Attack Techniques & Security Operations and Incident Response & Log Analysis, Monitoring, and Detection & Governance, Risk, and Compliance Basics
Re-test every weak area flagged in earlier weeks and close each gap to at least 80% on self-quiz
Complete two timed full-length practice sets under exam conditions and review every missed question to root cause
Re-derive the highest-yield facts from memory: port table, IR phases, CVSS metric meanings, CIA mapping, and log field names
Write a one-page personal exam-day strategy covering pacing, question triage, and flag-and-return rules
Your checkpoint
A final review log showing scores on both timed practice sets, a root-cause note for every miss, and a one-page exam-day strategy sheet
Milestones
Week 2: Can explain a full TCP and TLS handshake and decode a captured packet from memory without notes
Week 4: Can walk the entire incident response lifecycle and correctly classify 10 mixed events as event, alert, or incident
Week 6: Can write a working detection rule for failed-login brute force and name the log source and expected false positives
Week 7: Can score five risks and map each treatment to the compliance framework that drives it
Week 8: Score at least 80% on both timed practice sets with every miss root-caused in writing