Get 2025 Updated Free MikroTik MTCNA Exam Questions and Answer
MTCNA Dumps PDF and Test Engine Exam Questions
NEW QUESTION # 88
How often are BPDUs sent from a layer 2 device?
- A. Every 10 minutes
- B. Never
- C. Every 30 seconds
- D. Every 2 seconds
Answer: D
NEW QUESTION # 89
How many different priorities can be selected for queues in MikroTik RouterOS?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
MikroTik RouterOS allows you to assign one of 8 different priority levels to each queue. These range from 1 (highest) to 8 (lowest). This allows for traffic shaping and prioritization in simple queues and queue trees.
These priority levels are used when multiple queues are competing for bandwidth or processing time. They influence which traffic gets handled first when congestion occurs.
* A. 16 ##Invalid. Only 8 supported.
* B. 1 ##Not correct. Only says one value; MikroTik supports multiple.
* C. 8 ##Correct. There are 8 valid priority values.
* D. 0 ##Priority 0 is not valid in MikroTik queues.
MTCNA Course Manual - Queues and Priorities:
"MikroTik queues support 8 priority levels (1-8). These affect which traffic is processed first." Rene Meneses Study Guide - QoS Mechanics:
"You can select between 8 priorities. These are configured per queue to define traffic importance." Terry Combs Notes - Simple Queues:
"Only 8 priority values exist. They follow a numerical scale from 1 to 8, not 0 or beyond."
NEW QUESTION # 90
Action=redirect allows you to make:
- A. Forward DNS to another device IP address
- B. Enable Local Service
- C. Transparent DNS Cache
- D. Transparent HTTP Proxy
Answer: D
Explanation:
In RouterOS, action=redirect is used in NAT rules to redirect traffic destined for specific ports to local services. This is often used for:
* Transparent web proxy (redirect port 80 to a local proxy service)
* Transparent DNS interception (if RouterOS is the DNS server)
In most practical MikroTik use cases, redirect is associated with Transparent HTTP Proxy.
MTCNA Course Material - NAT Configuration:
"action=redirect rewrites the destination address to the router's own IP. It is commonly used to create transparent web proxies." MikroTik Wiki - NAT Redirect:
"Redirect is used for redirecting traffic to local services like web proxy or DNS cache on the router." Breakdown:
* A: Possible, but limited use; DNS cache works better with dst-nat
* B: Incorrect - to forward to another IP, use dst-nat
* C: Misleading - enabling local services doesn't require redirect
* D:#Correct-redirect enables transparent proxy setup
NEW QUESTION # 91
PPP Secrets are used for:
- A. Router users
- B. PPTP clients
- C. PPPoE clients
- D. L2TP clients
- E. PPP clients
- F. IPSec clients
Answer: B,C,D,E
Explanation:
PPP Secrets is a user authentication mechanism used in MikroTik RouterOS for various PPP-based services.
These include:
* PPP (Point-to-Point Protocol)
* PPPoE (PPP over Ethernet)
* PPTP (Point-to-Point Tunneling Protocol)
* L2TP (Layer 2 Tunneling Protocol)
Each client authenticates with a username/password combination defined under PPP # Secrets. PPP Secrets is not used for:
* IPSec clients ##They use peer configurations and policies
* Router users (Winbox/WebFig) ##Use system # users, not PPP secrets
MTCNA PPP Chapter - Secrets Authentication:
"PPP Secrets are used for all PPP services: PPP, PPPoE, L2TP, and PPTP. It defines usernames, passwords, profiles, and IP bindings." Rene Meneses Guide - Tunnels and PPP:
"Any PPP-based tunnel uses PPP secrets for login validation. This includes local dial-in and remote VPN tunnels." Terry Combs Notes - PPP Authentication Table:
"PPP Secrets = for PPP, PPPoE, PPTP, and L2TP. Not for IPSec or Winbox."
NEW QUESTION # 92
You want to implement a mechanism that automates the IP configuration, including IP address, subnet mask, default gateway, and DNS information. Which protocol will you use to accomplish this?
- A. DHCP
- B. ARP
- C. SMTP
- D. SNMP
Answer: A
Explanation:
DHCP (Dynamic Host Configuration Protocol) is specifically designed to assign IP configuration details automatically to clients on a network, including:
* IP address
* Subnet mask
* Default gateway
* DNS servers
MTCNA Course Material - DHCP Server Function:
"DHCP is a service that dynamically assigns IP settings to clients, removing the need for manual configuration." Rene Meneses MTCNA Study Guide - DHCP Operation:
"DHCP provides automatic configuration of network parameters including IP, mask, DNS, and gateway." Other options:
* A: SMTP is for email
* B: SNMP is for monitoring
* D: ARP resolves IP-to-MAC addresses
NEW QUESTION # 93
You want to use PCQ and allow 256k maximum download and upload for each client. Choose correct argument values for the required queue.
- A. kind=pcq pcq-rate=256000 pcq-classifier=src-address
- B. kind=pcq pcq-rate=5000000 pcq-classifier=dst-address
- C. kind=pcq pcq-rate=1256000 pcq-classifier=dst-address
- D. kind=pcq pcq-rate=256000 pcq-classifier=dst-address
- E. kind=pcq pcq-rate=5000000 pcq-classifier=src-address
Answer: A,D
Explanation:
PCQ (Per Connection Queue) is used in MikroTik to enforce bandwidth fairness across multiple users. To limit each client to 256k:
* pcq-rate=256000 # sets maximum bandwidth per client to 256,000 bps (256 kbps)
* pcq-classifier=src-address # used in upload queues
* pcq-classifier=dst-address # used in download queues
So:
* A.#Used for upload: src-address
* C.#Used for download: dst-address
The other options have incorrect rates or classifiers:
* B.#Incorrect rate (1256000 # 256k)
* D & E.#Incorrect rate (5000000 = 5 Mbps)
MTCNA Course Manual - PCQ Explanation:
"Use pcq-classifier=src-address for upload, and dst-address for download. pcq-rate sets per-client limit." Rene Meneses Study Guide - Queue Management:
"To cap clients to 256k, configure pcq-rate=256000. Adjust classifiers based on traffic direction." Terry Combs Notes - PCQ Parameters:
"Classifier is the key. src-address = upload, dst-address = download. Don't mix."
NEW QUESTION # 94
In order to use dynamic keys in your wireless security profile for an AP, you MUST set up the DHCP server to provide the dynamic keys.
- A. true
- B. false
Answer: B
Explanation:
MikroTik RouterOS supports dynamic key exchange for wireless networks using WPA/WPA2 (with PSK or EAP). These dynamic keys are not provided by the DHCP server but are instead part of the wireless security profile configured under /interface wireless security-profiles.
DHCP only assigns IP addresses and other network configuration parameters - it does not provide encryption keys.
MTCNA Wireless Security Module - WPA/WPA2 Explained:
"Dynamic keys are negotiated during the WPA/WPA2 authentication process, not via DHCP." Rene Meneses Guide - Wireless Authentication:
"Security profiles define pre-shared or dynamic key exchange (WPA-EAP). DHCP is unrelated." Terry Combs Notes - Misconceptions in Wireless Setup:
"DHCP and wireless encryption are separate layers. Keys are not assigned through DHCP."
NEW QUESTION # 95
Firewall NAT rules process only the first packet of each connection.
- A. False
- B. True
Answer: B
Explanation:
MikroTik's NAT (Network Address Translation) is part of the connection tracking mechanism. NAT rules are applied only to the first packet of a connection. Subsequent packets belonging to the same connection are automatically handled by the connection tracking module using the same translation mappings established by that first packet.
Option Analysis:
* A.#True - NAT is evaluated only on the first packet of a new connection.
* B.#False - Subsequent packets are not re-evaluated against NAT rules.
Extract from Official MTCNA Course Material - Firewall & NAT Section:
"NAT rules apply to the first packet in a connection. After that, RouterOS uses the tracked connection entry." Extract from Rene Meneses MTCNA Study Guide - NAT & Firewall Concepts:
"Once the initial packet matches a NAT rule, connection tracking applies it to the whole session." Extract from MikroTik Wiki - NAT Implementation:
"NAT is evaluated on the first packet. Other packets in the same connection follow the established NAT mapping."
NEW QUESTION # 96
Destination NAT (chain dstnat, action dst-nat) can be used to:
- A. Change source port
- B. Change destination port
- C. Hide your local network from the Internet
- D. Direct users from the Internet to a server within your local network
Answer: B,D
Explanation:
Destination NAT (dst-nat) is used to redirect packets arriving at the router to a different internal destination. It is most commonly used to allow public access to internal services such as web servers or mail servers.
You can:
* Change the destination IP address (redirect to an internal host)
* Change the destination port (e.g., port 8080 to port 80)
But:
* C. Changing the source port is a function of src-nat, not dst-nat ##
* D. Hiding the local network from the Internet is done via masquerade or src-nat ## MTCNA Course Manual - NAT Section:
"Use dst-nat to forward traffic to a private host. Port translation can also be applied (e.g., from 81 to 80)." Rene Meneses Study Guide - NAT Configuration:
"dst-nat changes the destination IP/port of packets arriving on a specific interface. Common use case: access to LAN services from WAN." Terry Combs Notes - NAT Rule Summary:
"dst-nat = port forwarding. src-nat/masquerade = hide internal addresses."
NEW QUESTION # 97
What is possible with Netinstall?
- A. MikroTik RouterOS password reset with saving router's configuration
- B. MikroTik RouterOS reinstall
- C. MikroTik RouterOS configuration reset
Answer: A,B,C
NEW QUESTION # 98
What is marked by connection-state=established matcher?
- A. Packet begins a new TCP connection
- B. Packet is related to, but not part of an existing connection
- C. Packet does not correspond to any known connection
- D. Packet belongs to an existing connection, for example a reply packet or a packet which belongs to already replied connection
Answer: D
Explanation:
The connection-state=established matcher in MikroTik's firewall refers to packets that are part of an already active connection. These packets are neither new nor related - they are directly associated with a known connection that has been previously accepted or initiated.
MikroTik uses Connection Tracking (enabled by default) to determine the state of each packet:
* new: Packet begins a new connection (e.g., TCP SYN)
* established: Packet belongs to a previously established connection (reply or subsequent packets)
* related: Packet is not part of the connection, but is related (e.g., FTP data channel)
* invalid: Packet that does not match any known or valid connection
Therefore:
* A.#Correct. "Established" means part of an ongoing, known connection.
* B.#This describes "related"
* C.#This describes "invalid"
* D.#This describes "new"
MTCNA Course Manual - Firewall and Connection Tracking:
"Established - Packet that belongs to an existing connection. This includes replies and ongoing streams." Rene Meneses Study Guide - Firewall Fundamentals:
"Use connection-state=established to allow traffic that is part of previously accepted sessions." Terry Combs Notes - Connection States:
"Established = trusted, ongoing session. Essential for return traffic."
NEW QUESTION # 99
Which of the following is true for connection tracking
- A. Connection tracking must be enabled for NAT'ed network
- B. Enabling connection tracking reduces CPU usage in RouterOS
- C. Disable connection tracking for mangle to work
- D. Connection tracking must be enabled to be able to use all firewall features
Answer: B,D
NEW QUESTION # 100
In a network with dozens of switches, how many root bridges would you have?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Spanning Tree Protocol (STP) is used in Ethernet switching environments to prevent loops. In any STP domain, only one switch is elected as the root bridge. All other switches determine the shortest path to this root bridge and may block redundant paths.
MTCNA Course Material - STP Basics:
"STP ensures a loop-free topology by electing a single root bridge. All path calculations are made from the root bridge's perspective." Rene Meneses MTCNA Study Guide - STP and Loop Prevention:
"Only one root bridge exists per STP domain. Switches use BPDU messages to elect it based on bridge ID priority." No matter how many switches exist (2, 10, or 50), only one root bridge is present at any time.
NEW QUESTION # 101
Which of the following are valid IP addresses?
- A. 192.168.13.255
- B. 1.27.14.254
- C. 10.10.14.0
- D. 192.168.256.1
Answer: A,B,C
Explanation:
An IPv4 address is a 32-bit number divided into 4 octets. Each octet must be between 0 and 255.
Let's evaluate:
* A. 10.10.14.0 ##Valid; .0 is legal, may represent a network or host depending on subnet
* B. 192.168.256.1 ##Invalid; 256 exceeds the max octet value (0-255)
* C. 192.168.13.255 ##Valid broadcast or host IP, depending on subnet
* D. 1.27.14.254 ##All octets are within valid range
MTCNA Training Manual - IP Basics:
"Each octet must be between 0 and 255. Addresses like 192.168.256.1 are invalid." Rene Meneses Guide - Valid IP Criteria:
"Watch for octets above 255 - they are illegal in IPv4."
Terry Combs Notes - Address Format Validation:
"Decimal format must be checked - 256, 999, or negative values break IPv4 standards."
NEW QUESTION # 102
Which of the following protocols / port s are used for SNMP. (Simple Network Management Protocol)
- A. UDP 162
- B. TCP 123
- C. TCP 162
- D. UDP 161
- E. TCP 25
- F. TCP 161
Answer: A,D
NEW QUESTION # 103
You have 10 users plugged into a hub running 10Mbps half-duplex. There is a server connected to the switch running 10Mbps half-duplex as well. How much bandwidth does each host have to the server?
- A. 2 Mbps
- B. 1 Mbps
- C. 10 Mbps
- D. 100 kbps
Answer: C
NEW QUESTION # 104
What can be used as 'target-address' in the simple queue?
- A. client's address
- B. address list name
- C. server's address
- D. client's MAC address
Answer: A
Explanation:
In MikroTik's Simple Queues, the target-address field is used to define the IP address of the device (host) to which the queue will apply. This must be an IP address - not a MAC address or an address list name.
Let's evaluate:
* A.#MAC address is not supported as target-address in simple queues
* B.#"server's address" is vague; if it means an IP, then it could work, but the best answer is "client's address"
* C.#Address lists can be used in firewall and mangle rules, but not directly in simple queues
* D.#Correct - An individual IP address (like 192.168.1.100) can be assigned as the target-address MTCNA Course Manual - Simple Queue Structure:
"Use the target-address field to apply a queue to a specific host by IP." Rene Meneses Guide - Queue Setup:
"Only IP addresses can be used as targets in simple queues. Address lists are not accepted." Terry Combs Notes - Bandwidth Limiting:
"Target-address = device IP. MACs and lists are not allowed here."
NEW QUESTION # 105
Which of the following is the valid host range for the subnet on which the IP address 192.168.168.188
255.255.255.192 resides?
- A. 192.168.168.128-190
- B. 192.168.168.128-192
- C. 192.168.168.129-191
- D. 192.168.168.129-190
Answer: C
Explanation:
IP address: 192.168.168.188
Subnet mask: 255.255.255.192 # /26 # Block size = 64
Subnets:
* 192.168.168.0/26 # 192.168.168.0 - 63
* 192.168.168.64/26 # 192.168.168.64 - 127
* 192.168.168.128/26 # 192.168.168.128 - 191 # Contains 192.168.168.188
* 192.168.168.192/26 # 192.168.168.192 - 255
Valid host range = 192.168.168.129 - 190
(Broadcast = 191, Network address = 128)
MTCNA Course Material - Subnetting Practice:
"To find valid hosts, exclude the subnet and broadcast address. In /26, each block is 64 addresses." Rene Meneses MTCNA Study Guide - IP Addressing:
"For /26 subnetting, calculate block size as 2^(32-26) = 64. Subnet starts at multiples of 64."
NEW QUESTION # 106
Using wireless connect-list it's possible to prioritize connection to one Access Point over another Access Point by changing the order of the entries.
- A. False
- B. True
Answer: B
Explanation:
The connect-list in RouterOS is used to define rules for wireless client behavior when connecting to available Access Points. You can define multiple entries in the connect-list, and RouterOS processes them in top-down order. This allows prioritization of APs based on criteria such as SSID, signal strength, and MAC address.
MTCNA Course Material - Wireless Client Settings:
"The connect-list determines the order in which the wireless client will try to associate with Access Points.
Entries are processed from top to bottom, allowing prioritized connection attempts." Rene Meneses MTCNA Study Guide - Wireless & Connect-List Section:
"By placing the most preferred AP at the top of the connect-list, you ensure it is attempted first. Reordering entries is used to manage roaming behavior and priority." MikroTik Wiki - Wireless Client & Connect List:
"The client will attempt to connect to the first matching entry in the connect list. This means the connect list can be used to define AP priorities." Therefore, the statement is true.
NEW QUESTION # 107
What is necessary for PPPoE client configuration?
- A. ip firewall nat masquerade rule
- B. Interface (on which PPPoE client is going to work)
- C. Static IP address on PPPoE client interface
Answer: A,B
Explanation:
To configure a PPPoE client on MikroTik, you need to:
* Set the client interface (usually ether1 or another WAN-facing port).
* Optionally add NAT masquerading to enable LAN users to reach the internet.
* IP address on the interface is assigned dynamically from the ISP after PPPoE negotiation, so a static IP is not required.
Option Analysis:
* A.#Required - You must select the interface that initiates the PPPoE connection.
* B.#Not Required - The IP is typically assigned by the PPPoE server (ISP).
* C.#Required - NAT masquerade is commonly used to allow internet access for private IP clients behind the router.
Extract from MTCNA Course Material - PPPoE Client Setup:
"The PPPoE client must have an interface specified. A NAT masquerade rule is recommended for internet access sharing." Extract from Rene Meneses MTCNA Study Guide - PPPoE:
"You do not need to assign a static IP to the PPPoE client interface. IP is received after successful login." Extract from MikroTik Wiki - PPPoE Client:
"After setting up the interface and credentials, PPPoE client negotiates and receives dynamic IP. Add NAT if routing LAN traffic."
NEW QUESTION # 108
Which statements are true regarding ICMP packets?
They acknowledge receipt of a TCP segment.
They guarantee datagram delivery.
They can provide hosts with information about network problems.
They are encapsulated within IP datagrams.
- A. 1 only
- B. 3 and 4
- C. 2 and 3
- D. 2, 3 and 4
Answer: B
NEW QUESTION # 109
There are two wireless cards (wlan1 and wlan2) which are bridged together. On wlan1 card thereis a setting
"Forwarding=no". Choose the correct answer(s):
- A. Stations on wlan2 will be able to communicate with stations on wlan2
- B. To prevent communication between wlan1 and wlan2 one cannot use Bridge Filters
- C. Stations on wlan2 will be able to communicate with stations on wlan1
- D. Stations on wlan1 will be able to communicate with stations on wlan1
- E. Stations on wlan1 will be able to communicate with stations on wlan2
Answer: A,D
Explanation:
Setting "forwarding=no" on a wireless interface prevents communication between connected clients on that interface and between that interface and other interfaces in the same bridge. This means:
* Stations connected to wlan1 cannot talk to each other
* Stations on wlan1 cannot talk to stations on wlan2 (even if bridged)
* Stations on wlan2 can talk to each other normally
Evaluation:
* A.#Correct - forwarding=no does not affect wlan2
* B.#Incorrect - forwarding=no blocks this
* C.#Correct - clients on wlan1 cannot talk to each other either
* D.#Bridge filters can be used but this scenario is about forwarding settings
* E.#Blocked by forwarding=no
MTCNA Wireless Module - Wireless Forwarding Behavior:
"Forwarding=no disables client-to-client communication on the interface and across bridges." Rene Meneses Study Guide - Wireless Access Config:
"Use forwarding=no to isolate clients on the same AP. Affects bridging too." Terry Combs Notes - Wireless Isolation:
"Setting forwarding=no isolates all clients on that wireless card."
NEW QUESTION # 110
What kind of users are listed in the Secrets window of the PPP menu?
- A. pptp users
- B. winbox users
- C. wireless users
- D. pppoe users
- E. l2tp users
- F. Hot-Spot users
Answer: A,D,E
Explanation:
The /ppp secret menu is used in RouterOS to manage usernames and passwords for Point-to-Point Protocol (PPP) based services, including:
* PPPoE (Point-to-Point Protocol over Ethernet)
* PPTP (Point-to-Point Tunneling Protocol)
* L2TP (Layer 2 Tunneling Protocol)
It does not include HotSpot users, wireless clients, or Winbox users.
MTCNA Course Material - PPP User Authentication:
"The PPP secret database stores credentials for services like PPPoE, PPTP, and L2TP." Rene Meneses MTCNA Study Guide - PPP Configuration Section:
"Users for PPP-based protocols are configured under PPP # Secrets. This includes PPPoE, PPTP, and L2TP." MikroTik Wiki - PPP Secrets Window:
"Secrets are used to authenticate users for all PPP interfaces. HotSpot users are managed separately under /ip hotspot user." Option A: HotSpot users # /ip hotspot user Option B: Wireless users connect via WPA/802.11 - not listed in PPP Option F: Winbox users refer to /user under system user management Final answer: C, D, E
NEW QUESTION # 111
What does the passive command provide to dynamic routing protocols?
- A. Stops the router from receiving any dynamic updates.
- B. Stops an interface from sending or receiving periodic dynamic updates.
- C. Stops an interface from sending periodic dynamic updates but not from receiving updates.
- D. Stops the router from sending any dynamic updates.
Answer: C
NEW QUESTION # 112
......
Verified MTCNA exam dumps Q&As with Correct 205 Questions and Answers: https://crucialexams.lead1pass.com/MikroTik/MTCNA-practice-exam-dumps.html