PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free HTB CJCA Practice Questions

Prepare for the HTB Certified Junior Cybersecurity Associate exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Hack The Box Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

HTB Certified Active Directory Pentesting Expert (CAPE)

Practice Questions

HTB Certified Defensive Security Analyst (CDSA)

Practice Questions

HTB Certified Penetration Testing Specialist (CPTS)

Practice Questions

HTB Certified Web Exploitation Expert (CWEE)

Practice Questions

HTB Certified Web Exploitation Specialist (CWES)

Practice Questions

HTB Certified Wi-Fi Pentesting Expert (CWPE)

Practice Questions
2026 Statistics

Key Facts: HTB CJCA Exam

5 days

Practical Exam Window

Hack The Box

100%

Practical (No MCQ Component)

Hack The Box

20 modules

Junior Cybersecurity Analyst Path Length

HTB Academy

50%

Tier 0 Modules Available Free

HTB Academy

~$490/yr

Silver Annual Subscription (includes voucher)

Hack The Box

6 domains

Exam Coverage Areas

HTB CJCA Curriculum

The HTB CJCA is Hack The Box's beginner-friendly hybrid certification (offensive + defensive) mapped to the 20-module Junior Cybersecurity Analyst job-role path. The practical 5-day exam involves compromising machines and analyzing security logs/alerts. Half the preparatory modules are free on HTB Academy. The Silver Annual subscription (~$490/year) includes one exam voucher. This practice bank covers all six domains: Linux/Windows fundamentals, networking/Wireshark, Elastic SIEM/KQL, security monitoring/event logs, intro pentesting, and incident handling.

Sample HTB CJCA Practice Questions

Try these sample questions to test your HTB CJCA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which layer of the OSI model is responsible for logical addressing and routing packets between networks?
A.Data Link layer
B.Transport layer
C.Network layer
D.Session layer
Explanation: The Network layer (Layer 3) handles logical addressing (IP addresses) and routes packets across different networks. Routers operate at this layer, using routing tables to determine the best path for packet delivery. The Data Link layer handles physical MAC addressing within the same network segment.
2A Linux file has permissions `-rwxr-x---`. Which group of users can execute this file?
A.Only the file owner
B.The file owner and group members
C.The file owner, group members, and others
D.Anyone on the system
Explanation: The permission string `-rwxr-x---` breaks down as: owner (rwx = read/write/execute), group (r-x = read/execute), others (--- = no permissions). Both the owner and group members have the execute bit set, so both can execute the file. Others have no permissions at all.
3Which TCP flag combination is used during the TCP three-way handshake to initiate a connection?
A.SYN, SYN-ACK, ACK
B.SYN, ACK, FIN
C.RST, SYN, ACK
D.PSH, URG, ACK
Explanation: A TCP three-way handshake consists of: (1) Client sends SYN to request a connection, (2) Server responds with SYN-ACK acknowledging the request and synchronizing its own sequence number, (3) Client sends ACK to complete the connection. This establishes a reliable, bidirectional connection before data transfer begins.
4In Wireshark, which display filter would show only HTTP traffic on port 80?
A.port == 80
B.ip.port == 80
C.http.port == 80
D.tcp.port == 80
Explanation: In Wireshark display filters, `tcp.port == 80` correctly filters packets where either the source or destination TCP port is 80. This captures HTTP traffic. Wireshark does not use the bare `port` syntax (that is a capture filter syntax), and `http.port` and `ip.port` are not valid Wireshark display filter fields.
5What does the CIA triad stand for in information security?
A.Confidentiality, Integrity, Availability
B.Control, Integrity, Authentication
C.Compliance, Identity, Authorization
D.Confidentiality, Identification, Access
Explanation: The CIA triad — Confidentiality, Integrity, and Availability — is the core model for information security policy. Confidentiality ensures data is accessible only to authorized parties. Integrity ensures data is accurate and unmodified. Availability ensures systems and data are accessible when needed by authorized users.
6Which Linux command displays the current user's id and group memberships?
A.whoami
B.passwd
C.groups
D.id
Explanation: The `id` command displays the current user's UID (user ID), GID (primary group ID), and all supplementary group memberships. For example: `uid=1000(john) gid=1000(john) groups=1000(john),27(sudo)`. This is useful for privilege escalation enumeration. `whoami` only shows the username without IDs.
7What is the primary purpose of a SIEM (Security Information and Event Management) system?
A.To aggregate, correlate, and analyze security log data from multiple sources
B.To block network intrusions in real time using signature matching
C.To perform vulnerability scanning on network endpoints
D.To encrypt sensitive data at rest and in transit
Explanation: A SIEM aggregates log data from across an organization (firewalls, endpoints, servers, applications), normalizes it, and correlates events to detect security incidents. It provides centralized visibility, alerting, and reporting. SIEMs are the backbone of SOC operations. Real-time blocking is done by IPS/firewalls, not SIEMs.
8In Windows, which Event ID indicates a successful logon?
A.4624
B.4625
C.4648
D.4720
Explanation: Windows Security Event ID 4624 records a successful account logon. This is one of the most fundamental events for SOC analysts monitoring authentication. Event ID 4625 is a failed logon. Monitoring both together helps detect brute-force attacks: repeated 4625 events followed by a 4624 indicate a successful brute force.
9Which nmap flag is used to perform a SYN (stealth) scan?
A.-sT
B.-sU
C.-sS
D.-sV
Explanation: The `-sS` flag performs a TCP SYN (half-open) scan. Nmap sends a SYN packet and waits for a response without completing the three-way handshake. Open ports respond with SYN-ACK; closed ports respond with RST. Because the connection is never fully established, it is less likely to be logged by some older applications and is faster than a full connect scan.
10What does the Elastic KQL query `event.category: "network" AND destination.port: 443` return?
A.Network events destined for port 443
B.All events where the source port is 443
C.All HTTPS certificate validation events
D.Events from the network category on any port except 443
Explanation: Kibana Query Language (KQL) uses `field: value` syntax with boolean operators. This query combines two conditions with AND: `event.category: "network"` (network-category events) AND `destination.port: 443` (destination port is 443). The result is network events going to port 443, typically HTTPS traffic. KQL searches are case-insensitive for field values.

About the HTB CJCA Exam

The HTB CJCA (Certified Junior Cybersecurity Associate) is Hack The Box's entry-level hybrid certification covering both offensive and defensive cybersecurity fundamentals. Unlike purely theoretical exams, CJCA is a 100% practical hands-on assessment across a 5-day window involving machine compromise and blue-team log analysis. This practice exam tests the theoretical knowledge needed: Linux/Windows commands, networking, Wireshark, Elastic KQL, Windows Event IDs, incident handling, and basic pentesting concepts.

Assessment

Performance-based assessment

Time Limit

5-day practical lab window

Passing Score

Practical objectives (threshold not published)

Exam Fee

HTB Academy Silver Annual (~$490/year) or standalone voucher (Hack The Box)

HTB CJCA Exam Content Outline

20%

Linux & Windows Fundamentals

Linux CLI (chmod, find, grep, sudo, cron, /etc/shadow), Windows (registry hives, PowerShell cmdlets, ipconfig, net user, hostname), bash scripting variables, and IT fundamentals

20%

Networking & Traffic Analysis

OSI model, TCP three-way handshake and flags, DNS, DHCP, SMB ports, Wireshark display filters (ip.src, tcp.port, dns.flags.response, http.request.method), tcpdump, ARP spoofing detection

20%

SIEM Fundamentals & Elastic Stack

ELK components (Elasticsearch indexing, Logstash pipelines, Kibana dashboards, Winlogbeat shipping), KQL syntax (field: value, AND/OR/NOT, wildcards, CIDR ranges, ECS fields), detection rules

15%

Security Monitoring & Windows Event Logs

Key Event IDs (4624 logon, 4625 failed logon, 4688/4720/4732 process/account/group changes), Sysmon IDs (1 process, 3 network, 7 DLL, 11 file), True/False Positive triage, SOC Tier 1 role

15%

Intro Penetration Testing & Basic Exploitation

Pentest methodology phases, nmap flags (-sS, -sV, -O, -p-, -sC, --script=vuln), Metasploit (search, RHOST/LHOST, msfvenom), Gobuster, reverse shells, post-exploitation (id, sudo -l, find SUID)

10%

Incident Handling & Threat Hunting

NIST SP 800-61 lifecycle phases (Preparation, Detection, Containment, Eradication, Recovery, Post-Incident), hypothesis-driven hunting, MITRE ATT&CK tactics/techniques, incident report components

How to Pass the HTB CJCA Exam

What You Need to Know

  • Passing score: Practical objectives (threshold not published)
  • Assessment: Performance-based assessment
  • Time limit: 5-day practical lab window
  • Exam fee: HTB Academy Silver Annual (~$490/year) or standalone voucher

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

HTB CJCA Study Tips from Top Performers

1Complete all 20 modules of the Junior Cybersecurity Analyst path on HTB Academy — especially the free Tier 0 modules as a starting point
2Memorize key Windows Event IDs: 4624 (successful logon), 4625 (failed logon), 4688 (process creation), 4720 (new user), 4732 (added to local group)
3Practice KQL syntax in Elastic SIEM — field: value, AND/OR/NOT operators, wildcard *, CIDR ranges, and ECS field names like process.parent.name
4Master Wireshark display filters — ip.src, tcp.port, dns.flags.response, http.request.method, and Follow TCP Stream
5Know the NIST SP 800-61 incident response phases: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity
6Practice nmap scanning flags: -sS (SYN scan), -sV (version), -O (OS), -p- (all ports), -sC (default scripts), --script=vuln
7Understand the ELK Stack architecture: Elasticsearch (store/index), Logstash (transform/pipeline), Kibana (visualize/SIEM), Beats/Winlogbeat (ship)
8Learn Sysmon Event IDs: 1 (process creation), 3 (network connection), 7 (DLL load), 11 (file create) — these are critical for threat detection
9Study MITRE ATT&CK tactics — especially Initial Access (TA0001), Execution (TA0002), Persistence (TA0003), and Command & Control (TA0011)
10Take organized notes during lab exercises — document commands, findings, and screenshots as practice for the professional report submission

Frequently Asked Questions

What is the HTB CJCA exam format?

The HTB CJCA is a 100% practical hands-on exam with a 5-day window. It is a hybrid assessment combining offensive tasks (machine compromise) and defensive tasks (log analysis, alert triage). Candidates must analyze approximately 40 security log alerts as True Positive or False Positive, compromise several machines in a realistic lab environment, and submit a professional report documenting their findings.

What topics does the HTB CJCA cover?

CJCA covers six domains: (1) Linux and Windows fundamentals; (2) Networking and traffic analysis with Wireshark; (3) SIEM fundamentals using Elastic Stack and KQL; (4) Security monitoring and Windows Event Log analysis; (5) Introduction to penetration testing with Nmap and Metasploit; and (6) Incident handling using the NIST SP 800-61 framework and threat hunting with Elastic.

How do I prepare for the HTB CJCA?

Complete the Junior Cybersecurity Analyst job-role path on HTB Academy. The path contains 20 modules including Linux Fundamentals, Windows Fundamentals, Network Traffic Analysis, Security Monitoring & SIEM Fundamentals, Windows Event Logs & Finding Evil, and Introduction to Threat Hunting & Hunting with Elastic. Half the modules are free. Take detailed notes, practice each module's hands-on exercises, and use this practice exam to test your conceptual knowledge.

Is the HTB CJCA good for beginners?

Yes — the CJCA is explicitly designed for complete beginners and career changers entering cybersecurity. No prior security experience is required. It covers foundational IT concepts alongside security-specific content, and half the preparatory modules are free. The 5-day exam window is generous compared to other certifications. It is an excellent first cybersecurity certification before advancing to CompTIA Security+, HTB CDSA, or eJPT.

How much does the HTB CJCA cost?

The CJCA exam voucher is included with the HTB Academy Silver Annual subscription (~$490/year), which also provides access to the full Junior Cybersecurity Analyst learning path. Standalone exam vouchers may also be available — check the HTB Academy website for current pricing. Silver Annual subscribers after September 1, 2025 receive an extra CJCA exam voucher.

Is this practice exam like the real HTB CJCA?

No — this is a theoretical multiple-choice practice exam covering the knowledge base behind CJCA topics. The real HTB CJCA is 100% practical: you must actually compromise machines and analyze real security logs in a lab environment. Use this practice exam to test your conceptual understanding of tools, commands, and methodology, then validate hands-on skills through the HTB Academy modules and Hack The Box machines.