Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam

A cybersecurity professional who recently began transitioning careers has published a comprehensive guide based on successfully passing the HTB CJCA certification. The post details what the author wished they had known before attempting the exam, covering preparation, exam structure, note-taking strategies, and examiner feedback.

What CJCA Actually Entails

Although often described as an entry-level certification, CJCA differs significantly from typical training labs or CTF challenges. The exam places candidates in a realistic laboratory environment where they must complete tasks as a working security professional would. There are no multiple-choice questions; instead, participants receive a lab and must solve problems while producing a professional report. The certification evaluates both offensive and defensive skills, requiring candidates to analyze events from a defender’s perspective in addition to performing attacks.

The exam lasts five days. Separate passing scores are required for the red team and blue team portions, meaning strong performance in one area cannot compensate for weakness in the other.

Preparation Steps Taken

The author completed the entire Junior Cybersecurity Analyst learning path in HTB Academy before the exam. Additional practice included solving Easy and Medium difficulty machines across multiple platforms. Prior to the exam, the candidate also began the SOC Analyst Path on LetsDefend to gain familiarity with how attacks appear in logs and how to work with those logs effectively.

Modules on reconnaissance, such as Footprinting and Network Enumeration with Nmap, proved foundational. Process-oriented modules like Introduction to Penetration Testing and Pentest in a Nutshell helped frame the overall workflow. Blue team modules covering Security Monitoring & SIEM Fundamentals, Windows Event Logs & Finding Evil, and Incident Handling Process were identified as particularly valuable.

Exam Experience and Key Advice

The first day was spent understanding the assignment and creating a plan rather than immediately running scanners. Working in short 4-5 hour sessions allowed the candidate to finish within four days while maintaining mental freshness. When stuck on one task, switching between red and blue team activities helped generate new perspectives.

The second phase proved most challenging, requiring analysis of security events, decision-making, and justification of each action. This defensive mindset demanded separate preparation beyond typical offensive skills.

Note-Taking and Reporting Practices

Effective note organization formed half the battle for producing the final report. The author maintained a structured folder system with dedicated files for scope, reconnaissance per host, findings, walkthroughs, credentials, flags, alerts from phase two, and host summaries. Screenshots were captured immediately, and each finding followed a consistent format covering what was discovered, its location, severity, detection method, attacker value, and remediation steps.

Reports were prepared in SysReptor. The author recommends learning the tool before the exam to avoid wasting time during the test. Findings were enriched with MITRE ATT&CK mappings, indicators of compromise, and detection recommendations to address both phases of the exam.

Examiner Feedback and Lessons

The red team portion scored 100 points while the blue team portion passed the threshold. The report received praise for clearly describing the impact of each finding and providing practical recommendations that maintained the tester’s independence. Constructive criticism emphasized signing command outputs, providing sufficient reproduction evidence, documenting hosts with no findings, and explaining vulnerabilities specifically rather than using generic CVE or CWE references.

The author advises future candidates to allocate more preparation time, especially for blue team activities involving event analysis and alert triage. Following the exam, the individual completed the LetsDefend SOC Analyst Path and identified CDSA as the next certification goal.