HTB Certified Junior Cybersecurity Associate

Preparing the CJCA

The entry point to HTB certifications: a penetration test on a simulated enterprise network, validating alerts in a SIEM, then a professional report in English.

General · Attack and defenceBeginnerJunior Cybersecurity Analyst path

The exam at a glance

Duration5 daysThe countdown never stops
Prerequisite20 modulesJunior Cybersecurity Analyst path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowThe exam has two parts in the same report: a penetration test and the analysis of alerts in an Elastic-based SIEM (true or false positive, with evidence).

Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.

Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.

Review

Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.

Module tracking

The 20 modules of the Junior Cybersecurity Analyst path, grouped by theme. Tick them off as you go: progress is saved in this browser.

Fundamentals

  • Introduction to Information Security
  • Network Foundations
  • Introduction to Networking
  • Linux Fundamentals
  • Introduction to Bash Scripting
  • Windows Fundamentals
  • Introduction to Windows Command Line

Web

  • Web Requests
  • Introduction to Web Applications

Penetration testing

  • Introduction to Penetration Testing
  • Pentest in a Nutshell
  • Network Enumeration with Nmap
  • Footprinting
  • Hacking WordPress
  • Using the Metasploit Framework

Defence

  • Intro to Network Traffic Analysis
  • Incident Handling Process
  • Windows Event Logs & Finding Evil
  • Security Monitoring & SIEM Fundamentals
  • Introduction to Threat Hunting & Hunting With Elastic

What the exam assesses

  • Understand the fundamentals: networking, Linux, Windows, web applications.
  • Carry out a simple penetration test on an enterprise network, from reconnaissance to privilege escalation.
  • Analyse telemetry in an Elastic-based SIEM.
  • Classify alerts as true or false positives, with supporting evidence.
  • Assess risk exposure and write a commercial-grade report.

Study plan

An example to adapt to your pace. Always alternate modules and practice.

  1. One sheet a dayStart with Network, Linux and Windows: everything else builds on them.
  2. Topic flashcardsChoose “I knew it” only when there was no hesitation. Missed cards come back first.
  3. A quiz every weekAim for 85% on the full quiz before booking the exam.
  4. Practice on HTBAcademy modules and Starting Point, taking notes as if for a report.
  5. Report template readySysReptor offers a CJCA template: practising the write-up saves a day.

Exam tips

Specific to the CJCA

  • Note everything from the very first minute: timestamp, command, output, screenshot.
  • For each SIEM alert, keep the query that let you decide.
  • Keep one full day out of five to write and proofread the report.

Valid for every HTB exam

  • Split the time: keep at least a third of it for the report.
  • A screenshot at every key step, timestamped notes.
  • Stuck for two hours? Note the lead and move on.
  • Use the official template or SysReptor's from your practice runs onwards.

Review on this site

Methodology

Writing the report

Open →
 Methodology

Reconnaissance and enumeration

Open →
 Methodology

Web exploitation

Open →
 Methodology

Privilege escalation

Open →
 Methodology

Active Directory attacks

Open →
 Methodology

Pivoting and tunnelling

Open →
 Cheat sheet

Ports and services

Open →
 Cheat sheet

Linux essentials

Open →
 Cheat sheet

OWASP Top 10

Open →
 Cheat sheet

Active Directory

Open →
 Cheat sheet

Windows Event IDs

Open →
 Cheat sheet

Network filters

Open →
 Cheat sheet

SIEM queries

Open →
 Methodology

SOC and SIEM

Open →
 Methodology

Network Traffic Analysis

Open →
 Methodology

Incident response

Open →
 Cheat sheet

Reference frameworks

Open →
 Certification

CPTS

Open →
 Certification

CDSA

Open →

Ready to book?

  • Junior Cybersecurity Analyst path completed at 100%
  • Exam voucher available
  • Personal notes organised and easy to search
  • Report template ready, already used at least once
  • At least one full practice run under real conditions
  • 5 days blocked out in the calendar