CJCA — Going Through the Junior Hack The Box Certification

In October 2026, I passed the CJCA (Certified Junior Cybersecurity Associate) exam, and I'd like to share what my study journey was like, along with some (totally unsolicited) tips for anyone interested in giving it a try.

Prior knowledge

The first thing to point out is that, despite being aimed at junior professionals, the CJCA is not trivial. You need to build some knowledge before starting the course and the exam, especially in computer networking and operating systems. This makes the process a lot easier.

The Hack The Box path is VERY IMPORTANT, because most of the answers you need are there. That, however, doesn't diminish the value of hands-on experience outside of it. That experience is what will help you be creative and find simpler solutions to the problems in the exam.

All of the path's content shows up in the exam in some form, even if only as a "rabbit hole" or a brief mention. So pay attention to every module, even those covering areas you've already mastered. It can make a difference when exam time comes.

For those going for their first certification, I recommend solving a few machines on Hack The Box itself to get used to dealing with problems "in the dark," without knowing where or what is vulnerable.

The path

Because some parts are very long and tedious, the path can be a pretty exhausting stage. My advice is to take it slowly. It's better to stay consistent by studying a little every day than to burn out your energy in a short time and never open HTB again.

The path covers both Red Team and Blue Team, with Red Team making up most of the content. As I said before, it prepares you well in terms of raw content, but it doesn't necessarily develop the creativity and problem-solving skills the exam demands. That's why I'll say it again: it's VERY worthwhile to do some labs before the exam.

Another thing that helped me a lot, and that I wish I had done more of, was taking notes. After spending a long time studying the modules, it's normal to forget some detail, tool, or technique. Write down the most important parts of each one, mainly to understand HOW things work, and not just in what order to press the buttons.

Finally, keep the path open next to you during the exam and don't be ashamed to look things up in it. In the real world we look things up, so why not in the exam? I used the path as my primary reference during the exam, and it saved me a lot of time on research and troubleshooting.

The exam

The CJCA is a 100% hands-on exam. You'll need to put everything you've learned into practice, in an environment that simulates reality very well (this impressed me). It's not an exam designed to be extremely hard, but that doesn't mean it's easy. You'll need to think creatively and dig deep into the problems to figure out what the next step is.

The exam is divided into two parts, Red Team and Blue Team, both equally important in the evaluation. So don't neglect either one, because you can indeed fail if something goes off the rails.

You'll have 5 full, continuous days to take the exam, which I found to be enough time. I spent 4 days in total, with a few sleepless nights, but I also kept up my routine: I went to the gym, went out for lunch, and so on. Overall, if you're well prepared, time won't be a problem.

The report

This is the most important part of the whole journey, since we're only evaluated on what we write and submit to the graders. There's a real chance of failing if you can't properly describe the attacks or justify your decisions in the Blue Team part.

Describe each step clearly and understandably, so that whoever is reading can reproduce it. There's no need to go overboard and make the report excessively long. The ideal is to strike a balance between clarity and too much detail.

Adding screenshots of each step is also very important. Besides making the report more visually appealing, they serve as a guide to the logic described and make writing it as a whole easier. Add a caption to every image, explaining why it's there.

Vulnerabilities must be described in context. It's no use explaining generically what the vulnerability is, because it needs to be connected to the exam scenario. Likewise, mitigation proposals must be specific and justified, not just general recommendations.

General tips

Rest during the exam. A tired mind kills creativity and can hurt more than help. It leads you down wrong paths that cost far more time than watching an episode of your favorite show to get away from the terminal for a bit. If you have time, go about your life normally: go to the gym, talk to your friends, and eat good meals. You want your mind working well.

Don't underestimate the Blue Team part. It's not trivial, it takes considerable time, and it requires close attention to what you're doing. You can indeed fail due to carelessness at this stage.