What can be used as ’target-address’ in the simple queue?
client’s MAC address
server’s address
address list name
client’s address
In MikroTik’s Simple Queues, the target-address field is used to define the IP address of the device (host) to which the queue will apply. This must be an IP address — not a MAC address or an address list name.
Let’s evaluate:
A.❌MAC address is not supported as target-address in simple queues
B.❌"server’s address" is vague; if it means an IP, then it could work, but the best answer is "client’s address"
C.❌Address lists can be used in firewall and mangle rules, but not directly in simple queues
D.✅Correct – An individual IP address (like 192.168.1.100) can be assigned as the target-address
MTCNA Course Manual – Simple Queue Structure:
“Use the target-address field to apply a queue to a specific host by IP.”
René Meneses Guide – Queue Setup:
“Only IP addresses can be used as targets in simple queues. Address lists are not accepted.”
Terry Combs Notes – Bandwidth Limiting:
“Target-address = device IP. MACs and lists are not allowed here.”
Answer: DQUESTION NO: 75 [RouterOS Introduction]
What kind of users are listed in the "/user" menu?
A. router users
B. wireless users
C. Hot-Spot users
D. PPTP users
Answer: A
The /user menu in MikroTik RouterOS lists users who are allowed to log in to the router itself — via Winbox, SSH, WebFig, console, or API. These are administrative users of the RouterOS system.
Let’s evaluate:
A.✅Correct – These are RouterOS users (admin, techs, operators)
B.❌Wireless users are authenticated via security-profiles and access-lists
C.❌Hotspot users are managed under /ip hotspot user
D.❌PPTP users are managed under /ppp secrets
MTCNA User Management Section:
“/user is used to configure login accounts for RouterOS access.”
René Meneses Guide – User Types:
“Only RouterOS admin users are listed under /user. VPN and hotspot users are managed elsewhere.”
Terry Combs Notes – User Menu Summary:
“/user = login to router (Winbox/SSH). Not for PPP or hotspot authentication.”
Answer: AQUESTION NO: 76 [RouterBOARD Hardware]
Which is a default baud-rate of currently manufactured RouterBOARDs?
A. 9600
B. 115200
C. 38400
D. 11520
Answer: B
The default serial console baud rate for most modern MikroTik RouterBOARD devices is 115200 bps. This is important when accessing the router via serial console (e.g., through RS-232 or USB-to-serial adapters).
Let’s evaluate:
A. 9600 →❌Too slow; used in legacy systems
B.✅115200 → Correct default for MikroTik boards
C. 38400 →❌Incorrect
D. 11520 →❌Typo; not a standard rate
MTCNA Hardware Module – Serial Access:
“Default baud-rate is 115200. Use this setting when connecting via serial cable.”
René Meneses Study Guide – RouterBOARD Console Access:
“Use 115200 baud to access RouterBOARD via serial port.”
Terry Combs Notes – Serial Console Tips:
“Almost all modern RouterBOARDs use 115200 as default serial speed.”
Answer: BQUESTION NO: 77 [Routing]
When viewing the routes in Winbox, some routes will show "DAC" in the first column. These flags mean:
A. Dynamic, Available, Created
B. Dynamic, Active, Connected
C. Direct, Available, Connected
D. Dynamic, Active, Console
Answer: B
Route flags in MikroTik indicate how a route was created and its status:
D = Dynamic → Added automatically (e.g., by IP address assignment)
A = Active → Route is currently being used
C = Connected → Directly connected subnet or IP address
So:
DAC = Dynamic + Active + Connected→ Usually created when you assign an IP address to an interface.
Let’s review:
A.❌"Available" and "Created" are not valid flags
B.✅Correct – matches MikroTik routing flag definitions
C.❌“Direct” and “Available” are not valid route flags in MikroTik
D.❌"Console" is not a route flag
MTCNA Routing Section – Route Flag Definitions:
“D – Dynamic, A – Active, C – Connected. These appear when the router creates a route based on interface IP.”
René Meneses Guide – Route Table Interpretation:
“DAC is the most common flag combination. Dynamic and connected routes are automatically active.”
Terry Combs Notes – Route Status Flags:
“D = Dynamic, A = Active, C = Connected. Common on local interfaces.”
════════════════════════════════════════════
What flavor of Network Address Translation can be used to have one IP address allow many users to connect to the global Internet?
NAT
Static
Dynamic
PAT
PAT (Port Address Translation) is a subtype of NAT that maps multiple private IP addresses to a single public IP address using different port numbers. It is the most common form of NAT used in home and business networks to allow multiple internal hosts to access the internet using one public IP address.
MTCNA Course Material – NAT Concepts:
“PAT (also known as NAT overload) allows multiple devices to share a single public IP address. It uses different port numbers to distinguish sessions.”
Cisco IOS NAT Configuration Guide:
“PAT translates multiple local IP addresses to one public IP address by assigning different port numbers to each session.”
Other options:
A: Generic term — not specific enough
B: Static NAT maps one private IP to one public IP
C: Dynamic NAT maps private IPs to a pool of public IPs, not one-to-many
Final Answer: DQUESTION NO: 149 [IPv6 – Addressing Standards]
How long is an IPv6 address?
A. 32 bits
B. 128 bytes
C. 64 bits
D. 128 bits
Answer: D
IPv6 addresses are 128 bits in length, represented as eight groups of four hexadecimal digits separated by colons (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). This allows for a vastly larger address space compared to IPv4 (32 bits).
MTCNA Course Material – IPv6 Basics:
“An IPv6 address is 128 bits long, providing 3.4×10^38 possible addresses. It is written in hexadecimal format.”
René Meneses MTCNA Study Guide – IPv6 Addressing:
“IPv6 = 128 bits, not bytes. Address includes a 64-bit network prefix and 64-bit interface identifier.”
Other options:
A: 32 bits is IPv4
B: 128 bytes = 1024 bits — incorrect
C: 64 bits = only half of an IPv6 address
Final Answer: DQUESTION NO: 150 [IP Addressing – Subnetting]
How many usable IP addresses are there in a 23-bit (255.255.254.0) subnet?
A. 512
B. 510
C. 508
D. 254
Answer: B
A /23 subnet provides 2^9 = 512 total addresses.
Subtract 2 (network address + broadcast address)
512 – 2 = 510 usable IP addresses
MTCNA Course Material – Subnet Calculations:
“For any subnet, usable hosts = 2^(32 – subnet mask bits) – 2.”
René Meneses MTCNA Study Guide – IP Subnetting:
“/23 provides 512 total addresses; usable = 510 after subtracting network and broadcast.”
Option Breakdown:
A: Total addresses (512)
B:✔Usable addresses (510)
C: Incorrect (508 is for /23 minus 4 — not relevant here)
D: 254 is usable for /24
What protocol does ping use?
TCP
ARP
UDP
ICMP
Ping is a network diagnostic tool used to test the reachability of a host and measure round-trip time for packets. It uses the Internet Control Message Protocol (ICMP), not TCP or UDP.
ICMP is a Layer 3 protocol designed for diagnostics and control messaging. Ping sends ICMP Echo Request packets and waits for ICMP Echo Reply packets.
Evaluation:
A. TCP → Used for reliable data transmission, not for ping.
B. ARP → Resolves MAC addresses on LANs; unrelated to ping.
C. UDP → Used for connectionless communication; ping does not use it.
D. ICMP → Correct. Protocol used by ping.✅
Extract from MTCNA Official Training Slides – Tools Section:
“Ping sends ICMP Echo Request messages to the target IP address and expects Echo Reply messages. ICMP is a protocol used for diagnostic purposes.”
René Meneses Study Guide – Diagnostic Tools:
“Ping is based on ICMP, which is part of Layer 3. It’s used for checking connectivity and response times.”
Terry Combs Notes – Common Tools:
“Ping = ICMP. Always. No TCP/UDP involved.”
===========
You have a DHCP server on your MikroTik router. The IP addresses 10.1.2.2–10.2.2.20 are distributed in the DHCP network. Additionally, 3 static IP addresses are defined for your servers: 10.1.2.31–10.1.2.33.
After a while, 20 more IP addresses need to be distributed in the network. It is possible to distribute the extra IP addresses without adding another DHCP Server:
True
False
MikroTik RouterOS allows DHCP administrators to modify the DHCP address pool without creating an additional DHCP server. You can simply edit or extend the address pool range, and the DHCP server will start offering those new IPs.
Therefore, it is completely possible to:
Extend the existing address pool
Exclude statically assigned IPs
Continue using the same DHCP Server instance
You do NOT need to create a second DHCP server on the same interface.
MTCNA Course Manual – DHCP Configuration:
“It is possible to expand the address-pool dynamically without adding additional DHCP servers. Just add more IPs to the pool.”
René Meneses Study Guide – DHCP Pools Section:
“You can edit the address pool associated with the DHCP server anytime to include more addresses. No need to create another server.”
Terry Combs Notes – DHCP Tips:
“Keep one DHCP server per subnet. Extend pools via IP > Pool if more IPs are needed.”
Answer: AQUESTION NO: 25 [Wireless]
In which order are the entries in Access List and Connect List processed?
A. By Signal Strength Range
B. By interface name
C. In sequence order
D. In a random order
Answer: C
MikroTik processes the entries in the Access List and Connect List in a top-down fashion —meaning that the first matching entry is the one applied. This is known as sequence order (from top to bottom).
Each rule is checked in the order it appears in the list, and once a match is found, the rest of the list is ignored for that client.
Incorrect options:
A. Signal strength is only a condition, not a sorting method
B. Interface names are part of rule conditions
D. Not random — rules are processed sequentially
MTCNA Official Training Manual – Wireless Access & Connect List:
“Rules in access-list and connect-list are checked in the order they are listed. Once a match is found, further rules are ignored.”
René Meneses Guide – Wireless Access Rules:
“Access-list is evaluated top-down. Sequence matters.”
Terry Combs MTCNA Notes – Wireless Filtering:
“Be careful with order. The first matching rule is applied — no exceptions.”
Answer: CQUESTION NO: 26 [Wireless]
During a scan, in order to see all the available wireless frequencies that are supported by the card, the following option must be selected in the wireless card's "Frequency Mode":
A. superchannel
B. regulatory domain
C. manual txpower
Answer: A
In MikroTik RouterOS, enabling the "superchannel" frequency mode allows access to all frequencies supported by the wireless chip, including those that may be outside of country-specific regulatory limits. This mode is typically used in lab testing or in regions where regulations permit.
A. superchannel →✅Correct. Enables full frequency range
B. regulatory domain → Restricts visible frequencies to region’s law
C. manual txpower → Controls power output, not frequency scanning
MTCNA Course Material – Wireless Configuration Options:
“To unlock all available wireless frequencies for scanning or connection, enable the 'superchannel' frequency mode.”
René Meneses Study Guide – Wireless Advanced Config:
“Superchannel mode shows all channels supported by the hardware. Use with caution — may violate regulations.”
Terry Combs Notes – Wireless Modes:
“Want to see hidden or extended frequencies? Use superchannel mode. Not legal in every region.”
Answer: AQUESTION NO: 27 [NAT]
It is required to make a web server on a private LAN visible on the public internet. Only the web server port should be visible to the public. Which of the following configuration steps must be met? (Select all that apply)
A. Public IP address of the web server must be installed on the NAT Router
B. In IP firewall NAT, there should be a dst-nat between the public IP of the router and the private IP of the web server
C. Connection Tracking must be enabled on NAT router
D. A route between the NAT router and the web server must exist
E. LAN address of the web server should be routable on the internet
Answer: B, C, D
To expose a web server behind a MikroTik router to the public, the following steps must be met:
B. dst-nat rule must be created to forward incoming requests (e.g., TCP port 80) to the internal web server IP →✅Required
C. Connection Tracking must be enabled, otherwise NAT rules won’t function →✅Required
D. A route between the NAT router and the web server must exist (usually a directly connected subnet) →✅Required
Incorrect Options:
A. The public IP does not need to be installed on the web server — it remains private →❌
E. Private LAN IP (like 192.168.x.x) does not need to be routable on the internet →❌
MTCNA Course Manual – NAT and Port Forwarding Section:
“To expose internal services to the public internet, use dst-nat. Ensure connection tracking is active and the server is reachable through routing.”
René Meneses Guide – NAT Configuration:
“DST-NAT forwards specific ports to internal IPs. Connection tracking is a prerequisite. LAN IPs remain private.”
Terry Combs Notes – Web Server NAT Rules:
“No need to assign public IP to server. Just configure a proper NAT rule and ensure routing exists internally.”
════════════════════════════════════════════
If 'check-gateway' is enabled for an ECMP route and one of the gateways is unreachable, then:
ECMP is going to send packets to all gateways even if one is unreachable
The unreachable gateway is not going be used in Round Robin algorithm
The ECMP route becomes inactive
When multiple gateways are used in an ECMP (Equal Cost Multi-Path) configuration, the check-gateway option ensures that RouterOS will actively monitor the health of each gateway using ping (or ARP). If a gateway becomes unreachable, RouterOS temporarily removes it from the active ECMP gateway list.
A.✘Incorrect – Unreachable gateways are excluded from packet forwarding.
B.✔Correct – Only reachable gateways are used in the ECMP round robin logic.
C.✘Incorrect – The entire ECMP route remains active; only the failed gateway is excluded.
Extract from MTCNA Course Material – ECMP Routing:
“With check-gateway enabled, RouterOS will exclude unreachable gateways from ECMP rotation.”
Extract from MikroTik Wiki – Check-Gateway Option:
“When a gateway is unreachable, it is skipped in ECMP logic until it becomes reachable again.”
Extract from René Meneses Study Guide – ECMP and Gateway Monitoring:
“Check-gateway helps prevent blackholing by skipping dead gateways. The route remains active.”
==================================
Which firewall chain should you use to filter clients' HTTP traffic going through the router?
prerouting
forward
output
input
When a router forwards traffic between two interfaces (such as from LAN to WAN), it uses the forward chain. HTTP traffic initiated by users destined to external servers passes through this chain.
A.✘prerouting – Used mainly for routing decisions and NAT, not filtering.
B.✔forward – Used to filter transit traffic.
C.✘output – For traffic originating from the router itself.
D.✘input – For traffic destined to the router itself.
Extract from MTCNA Course Material – Firewall Chains:
“Client-to-server traffic, like browsing the web, passes through the forward chain when routed through the router.”
Extract from René Meneses Study Guide – Firewall Structure:
“To block or allow traffic passing through the router (LAN to Internet), use the forward chain.”
Extract from MikroTik Wiki – Firewall Filtering Overview:
“forward: filters all transit traffic routed through the router.”
===========
Is it possible to limit how many clients are able to connect to an access point?
No it's not possible at all
Yes, but only with access-lists
Yes
Yes, MikroTik RouterOS allows administrators to limit the maximum number of clients that can connect to a wireless access point. This can be done through the wireless interface settings using the max-station-count parameter.
The max-station-count option defines the maximum number of client devices (stations) that may be connected simultaneously. You are not restricted to access-lists; this setting works globally per interface.
A.❌Incorrect. It is definitely possible.
B.❌Limiting via access-list is one method (e.g., per MAC), but the more general and scalable method is via max-station-count.
C.✅Correct. MikroTik provides both general limits and fine control (like access-lists or registration-table rules).
MTCNA Official Wireless Module – Access Point Configuration:
“Set the maximum number of stations using max-station-count. This is a hardware-level control on the interface.”
René Meneses Study Guide – Wireless Configuration:
“Limiting clients can be done through access-lists or via interface properties such as max-station-count.”
Terry Combs Notes – Wireless Station Limits:
“Use max-station-count under wireless settings. This applies a hard limit on how many clients can connect.”
Answer: CQUESTION NO: 29 [QoS – Simple Queues]
The highest queue priority is:
A. 1
B. 256
C. 16
D. 8
Answer: A
MikroTik RouterOS supports prioritizing traffic in queues using a numerical priority system. The queue priority values range from 1 to 8, where:
1 = Highest priority (most preferred)
8 = Lowest priority (least preferred)
This means that traffic marked with priority 1 is processed before traffic with lower priorities. Priorities are used within simple queues, queue trees, and in some packet marking strategies.
Evaluation:
A. 1 →✅Correct. This is the highest priority.
B. 256 →❌Invalid priority value in MikroTik queues.
C. 16 →❌Priority range is only 1 to 8.
D. 8 →❌Lowest priority.
MTCNA Course Slides – QoS and Queuing:
“Queue priority values range from 1 to 8. Lower values indicate higher priority.”
René Meneses Study Guide – Traffic Management Section:
“MikroTik queues use priority values from 1 (highest) to 8 (lowest).”
Terry Combs Notes – QoS and Prioritization:
“Set queue priority to 1 for critical traffic like VoIP or routing protocols.”
Answer: AQUESTION NO: 30 [QoS – Simple Queues]
How many different priorities can be selected for queues in MikroTik RouterOS?
A. 16
B. 1
C. 8
D. 0
Answer: C
MikroTik RouterOS allows you to assign one of 8 different priority levels to each queue. These range from 1 (highest) to 8 (lowest). This allows for traffic shaping and prioritization in simple queues and queue trees.
These priority levels are used when multiple queues are competing for bandwidth or processing time. They influence which traffic gets handled first when congestion occurs.
A. 16 →❌Invalid. Only 8 supported.
B. 1 →❌Not correct. Only says one value; MikroTik supports multiple.
C. 8 →✅Correct. There are 8 valid priority values.
D. 0 →❌Priority 0 is not valid in MikroTik queues.
MTCNA Course Manual – Queues and Priorities:
“MikroTik queues support 8 priority levels (1–8). These affect which traffic is processed first.”
René Meneses Study Guide – QoS Mechanics:
“You can select between 8 priorities. These are configured per queue to define traffic importance.”
Terry Combs Notes – Simple Queues:
“Only 8 priority values exist. They follow a numerical scale from 1 to 8, not 0 or beyond.”
There are two wireless cards (wlan1 and wlan2) which are bridged together. On wlan1 card thereis a setting "Forwarding=no". Choose the correct answer(s):
Stations on wlan2 will be able to communicate with stations on wlan2
Stations on wlan2 will be able to communicate with stations on wlan1
Stations on wlan1 will be able to communicate with stations on wlan1
To prevent communication between wlan1 and wlan2 one cannot use Bridge Filters
Stations on wlan1 will be able to communicate with stations on wlan2
Setting "forwarding=no" on a wireless interface prevents communication between connected clients on that interface and between that interface and other interfaces in the same bridge. This means:
Stations connected to wlan1 cannot talk to each other
Stations on wlan1 cannot talk to stations on wlan2 (even if bridged)
Stations on wlan2 can talk to each other normally
Evaluation:
A.✅Correct – forwarding=no does not affect wlan2
B.❌Incorrect – forwarding=no blocks this
C.✅Correct – clients on wlan1 cannot talk to each other either
D.❌Bridge filters can be used but this scenario is about forwarding settings
E.❌Blocked by forwarding=no
MTCNA Wireless Module – Wireless Forwarding Behavior:
“Forwarding=no disables client-to-client communication on the interface and across bridges.”
René Meneses Study Guide – Wireless Access Config:
“Use forwarding=no to isolate clients on the same AP. Affects bridging too.”
Terry Combs Notes – Wireless Isolation:
“Setting forwarding=no isolates all clients on that wireless card.”
Answer: A, CQUESTION NO: 81 [Wireless]
Consider a wireless access point with mode=ap-bridge. What is the maximum number of concurrent clients that can connect to it?
A. 2007
B. 2012
C. 2048
D. 1024
Answer: C
In MikroTik RouterOS, the theoretical maximum number of clients that can associate with an AP in ap-bridge mode is 2048. However, practical limits depend on hardware performance and network stability, and most real-world setups use far fewer clients.
Let’s review:
A. 2007 →❌Close, but not the actual hard limit
B. 2012 →❌Incorrect
C.✅2048 → Correct per MikroTik’s AP mode specification
D. 1024 →❌Lower than the actual maximum
MTCNA Wireless Module – AP Behavior:
“In ap-bridge mode, the maximum theoretical client limit is 2048. Actual stable operation may be lower.”
René Meneses Guide – Wireless Scaling:
“2048 is the upper limit for client associations on a MikroTik AP in bridge mode.”
Terry Combs Notes – Client Capacity:
“2048 clients = maximum. Performance may degrade before that in high-traffic environments.”
Evaluate the following information:
Access Point configuration:
-- wlan1 is in 'AP-Bridge' mode
-- Bridge1 has wlan1 and ether1 as ports
CPE configuration:
-- wlan1 is in 'Station-Bridge' mode
-- Bridge1 has wlan1 and ether1 as ports
Select protocols that will pass from ether1 on the CPE to ether1 on the Access Point:
IPv4
ARP
USB
BGP
Firewire
IPv6
DHCP
In this configuration, the wireless interface (wlan1) on the AP is in ap-bridge mode, and on the CPE it's in station-bridge mode. This mode allows full Layer 2 bridging over wireless, supporting all Ethernet-based protocols and services, including:
IPv4, IPv6, DHCP, ARP, PPPoE, and routing protocols like BGP (which use TCP/IP).
Protocols like USB or Firewire are hardware-level or local bus protocols and cannot be transmitted over Ethernet frames or wireless.
Option Review:
A.✔IPv4 – supported
B.✔ARP – Layer 2 protocol, supported
C.✘USB – not a network protocol, not transmitted over bridges
D.✔BGP – Layer 3 protocol, supported over bridged links
E.✘Firewire – not a Layer 2 or network protocol
F.✔IPv6 – fully supported
G.✔DHCP – Layer 3 broadcast protocol, works over bridges
H.✔PPPoE – Ethernet-based protocol, passes over Layer 2 bridge
Extract from Official MTCNA Course Material – Wireless Bridging:
“station-bridge mode allows transparent Layer 2 bridging, supporting all Ethernet protocols including IPv4, IPv6, ARP, DHCP, PPPoE, and more.”
Extract from René Meneses MTCNA Study Guide – Wireless Modes:
“Use station-bridge with ap-bridge to pass full Layer 2 traffic. This allows DHCP, PPPoE, and other protocols to work transparently.”
Extract from MikroTik Wiki – Station Bridge:
“station-bridge mode is used with MikroTik-only links and allows full Layer 2 protocol support, including dynamic IP assignments and bridging.”
Consider the following diagram. We want to communicate from a device on LAN1 (192.168.0.0/24) to a device on LAN2 (192.168.1.0/24). Assuming that all necessary configurations are already included on R2, which of the following configurations in R1 would enable this communication?
/ip route add dst-address=192.168.1.0/24 src-address=192.168.0.0/24 gateway=192.168.99.2
/ip route add dst-address=0.0.0.0/0 gateway=Ether1
/ip route add dst-address=192.168.0.0/24 gateway=192.168.0.1
/ip route add dst-address=192.168.1.0/24 gateway=192.168.99.2
/ip route add dst-address=0.0.0.0/0 gateway=192.168.99.2
To route traffic from LAN1 (192.168.0.0/24) behind R1 to LAN2 (192.168.1.0/24) behind R2, R1 must know how to reach the destination network 192.168.1.0/24. The proper way is to add a static route on R1 pointing to the next hop IP address of R2’s interface (192.168.99.2) connected via their shared transit network (192.168.99.0/24).
According to:
René Meneses MTCNA Study Guide – Routing Section:
“A static route requires the destination prefix and the gateway (next-hop) IP address. The gateway should be reachable through a directly connected network interface.”
Terry Combs MTCNA Notes – Static Routing Example:
“To route packets to a remote network, configure a static route specifying the destination network (e.g., 192.168.50.0/24) and the gateway IP (e.g., 10.0.0.2). Ensure that the gateway is reachable via a locally connected interface.”
MikroTik Wiki – Static Routing:
“The most common usage of static routes is to forward packets for destination networks that are not directly connected. You must use the IP address of a reachable next-hop router.”
Option A incorrectly includes src-address, which is not part of a standard /ip route syntax.
Option B uses “Ether1” as a gateway, which is syntactically invalid unless using recursive routing, which this situation does not require.
Option C adds a route back to the local network — unnecessary and incorrect.
Option E routes all traffic to R2, which is inefficient and not specific.
Thus, only Option D adds the correct static route:
/ip route add dst-address=192.168.1.0/24 gateway=192.168.99.2
Final Answer: DQUESTION NO: 83 [Bridging]
For a Simple Queue to apply bandwidth restrictions on a bridged interface, the following must be done:
A. Configure an IP address on the bridge interface
B. Use mangle to mark the connections
C. Associate the Simple Queue to the bridge interface
D. Enable 'Use IP Firewall' in bridge settings
Answer: D
By default, RouterOS does not pass traffic on a bridge interface through the firewall or queue system. If you want to apply queueing (Simple Queues or other policies) on a bridge interface, you must enable the bridge to use the IP Firewall.
MTCNA Official Course Material – Bridging & IP Firewall Integration:
“If you want to apply queues or firewall rules to traffic flowing through a bridge, you must enable ‘use-ip-firewall’ under the bridge settings.”
René Meneses MTCNA Guide – Bridge Queuing Section:
“Simple Queues do not affect bridged traffic unless you activate the ‘Use IP Firewall’ setting in bridge configuration. This pushes the packets through the normal firewall and queueing engine.”
MikroTik Wiki – Bridge Settings:
“If use-ip-firewall is enabled, then all bridged traffic is also processed by firewall and queues.”
Options A and C are incorrect because assigning an IP or linking the queue alone does not enforce restrictions at Layer 2.
Option B refers to advanced queueing with mangle + Queue Trees, not Simple Queues.
Final Answer: DQUESTION NO: 84 [QoS (Simple Queues)]
In RouterOS queue configurations the word "total" usually represents:
A. download - upload
B. upload
C. upload + download
D. download
Answer: C
In Simple Queues, MikroTik uses the term “total” to refer to the sum of the incoming and outgoing traffic for a particular target. This includes both upload (TX) and download (RX) traffic.
MTCNA Course Material – Queues Overview:
“Total limit represents the combined limit of upload and download traffic. If both target-upload and target-download are defined, total-limit should be equal or higher.”
René Meneses MTCNA Study Guide – Queues Chapter:
“In Simple Queues, ‘max-limit’ and ‘limit-at’ can be set individually for upload and download, or together as ‘total’ which combines both directions.”
Terry Combs Notes – Queue Definitions:
“Total in RouterOS queues means sum of upload and download. Always consider total bandwidth used in both directions when using ‘total-limit’.”
Therefore, the correct and verified answer is C: upload + download.
Mark all correct answers.
/ip firewall filter allows to deny authentication to AP
Wireless access-list could allow and deny connect to your AP
Default-Forwarding could be enabled for a specific clients by wireless access-list
The only way to prevent wireless clients connections - disable wireless interface
Let’s evaluate each statement:
A.✘Incorrect – /ip firewall filter can block traffic after association/authentication but cannot directly prevent wireless authentication. Association happens before IP-level filtering.
B.✔Correct – Wireless access-list allows or denies associations based on MAC address and other parameters (signal strength, etc.).
C.✔Correct – Access-list rules can enable/disable default-forwarding per client (overriding global setting).
D.✘Incorrect – Disabling the wireless interface is not the only way. You can use access-list or disable SSID broadcast.
Extract from MTCNA Course Material – Wireless Access List:
“Access List provides client control based on MAC address. You can accept, reject, and even override default-forwarding per client.”
Extract from René Meneses MTCNA Study Guide – Access Control:
“Wireless Access List can selectively allow or deny clients and enforce individual settings like forwarding.”
Extract from MikroTik Wiki – Wireless Access List:
“The firewall filter is not involved in authentication. Access control must be done at the wireless layer using access-lists.”
===========
MAC layer by OSI model is also known as
Layer 2
Layer 1
Layer 6
Layer 7
Layer 3
The basic unit of a physical network (OSI Layer 1) is the:
Frame
Bit
Byte
Header
The OSI Layer 1, also known as the Physical Layer, is responsible for the transmission and reception of raw binary data over a physical medium. The most fundamental unit at this layer is the bit.
Bit = Binary Digit (0 or 1)
It is transmitted over physical media (cables, radio signals, etc.)
Frames (A) exist at Layer 2 (Data Link Layer), not Layer 1.
Bytes (C) are groups of 8 bits, but bits are still the smallest indivisible transmission unit.
Headers (D) are metadata used at Layers 2–7; not relevant to Layer 1.
MTCNA Official Training Manual – OSI Model Chapter:
“Layer 1 transmits raw bits over a transmission medium. These bits form the foundation for higher-layer data structures.”
René Meneses MTCNA Guide – OSI Model Breakdown:
“Physical Layer (Layer 1) carries bits, not frames or bytes. It's concerned with voltages, cables, connectors, and signal encoding.”
Terry Combs Notes – OSI Layers:
“Layer 1 = Bits. Nothing more. Frames come into play in Layer 2.”
Answer: B
To use masquerade, you need to specify:
action=accept, out-interface, chain=src-nat
action=masquerade, out-interface, chain=src-nat
action=masquerade, in-interface, chain=src-nat
action=masquerade, out-interface, chain=dst-nat
Masquerading is a form of source NAT (src-nat) where the router dynamically replaces the source address of outgoing packets with the IP address of the router’s outgoing interface. This is commonly used when internal LAN clients access the internet through a single public IP.
Key points for masquerade configuration:
Use chain=src-nat (because it modifies the source address)
Use action=masquerade
Specify the out-interface (i.e., the WAN interface)
MTCNA Course Material – NAT Section:
“To configure masquerading, use chain=src-nat and action=masquerade. Specify out-interface to define the traffic direction.”
René Meneses MTCNA Study Guide – NAT Examples:
“Masquerade automatically uses the IP address of the specified out-interface. Required parameters: chain=src-nat, action=masquerade, out-interface.”
MikroTik Wiki – Source NAT / Masquerade:
“Masquerade is a special form of src-nat. You must use it in chain=src-nat and define the out-interface for which NAT will be applied.”
Option A: Incorrect action=accept (used in filter rules, not NAT)
Option C: in-interface is not applicable here
Option D: chain=dst-nat is used for destination NAT, not source NAT
Only Option B is fully correct.
Final Answer: BQUESTION NO: 94 [Tools]
In which situations can Netinstall NOT be used to install a RouterBOARD?
A. The router does not have an operating system
B. The router is connected only to a wireless network
C. You do not know the password of the router
D. The router is connected only to a secondary Ethernet port
Answer: B
Netinstall works over a wired Ethernet connection and uses PXE or Etherboot to install RouterOS over the network. It cannot function over wireless, as wireless interfaces do not support PXE booting or Netinstall protocols.
MTCNA Course Material – Netinstall Overview:
“Netinstall requires a direct Ethernet connection between the PC and the router. Wireless interfaces are not supported for Netinstall procedures.”
René Meneses MTCNA Guide – Netinstall:
“Netinstall only works over Ethernet. You cannot Netinstall a device connected only through Wi-Fi.”
MikroTik Wiki – Netinstall Prerequisites:
“Router must be connected via Ethernet. Wireless and USB interfaces are not supported.”
Other options:
A: This is a typical use case (installing RouterOS when OS is missing)
C: Netinstall bypasses password (not needed)
D: Netinstall can work via any Ethernet port, provided it's accessible
Final Answer: BQUESTION NO: 95 [Monitoring and Logging]
MikroTik RouterOS is sending logs to an external syslog server. Which protocol and port is used by RouterOS for sending logs (by default)?
A. UDP 514
B. UDP 21
C. UDP 113
D. TCP 110
Answer: A
RouterOS uses the industry-standard syslog protocol for remote logging. By default, syslog uses UDP port 514.
MTCNA Course Material – Logging Section:
“For sending logs to a remote syslog server, RouterOS uses the syslog protocol on UDP port 514 by default.”
René Meneses MTCNA Guide – Monitoring & Logging:
“External logging is done using UDP port 514, which is the standard syslog protocol port.”
MikroTik Wiki – Logging Configuration:
“To send logs to a remote server, configure an action of type remote with a remote address and use UDP port 514 unless otherwise changed.”
Other ports:
UDP 21 = FTP (not logging)
UDP 113 = Ident protocol
TCP 110 = POP3
Only UDP 514 is correct.
Final Answer: AQUESTION NO: 96 [RouterBOARD Hardware]
Can you manually add drivers to RouterOS in case your PCI Ethernet card is not recognized, and you suspect it is a driver issue?
A. Yes
B. No
Answer: B
RouterOS is a closed, embedded Linux-based system. It does not support adding custom drivers or compiling modules manually. You must use supported hardware that is natively compatible with RouterOS.
MTCNA Course Material – RouterBOARD Compatibility:
“RouterOS supports a fixed set of drivers. You cannot install third-party drivers or modules.”
René Meneses MTCNA Guide – Hardware Limitations:
“Custom drivers cannot be added to RouterOS. Use only supported network interface cards as listed by MikroTik.”
MikroTik Wiki – Hardware Support:
“RouterOS does not allow manual driver installation. All drivers are precompiled and built into the system image.”
Therefore, if your PCI Ethernet card is not recognized, you must replace it with a compatible model — you cannot add a driver manually.
Is action=masquerade allowed in chain=dstnat?
yes, but only if dst-addr is specified
yes
yes, but it works only for incoming connections
no
The action=masquerade is used exclusively in the srcnat chain. It dynamically hides internal IP addresses behind the router's public IP. It cannot be used in the dstnat chain.
A.✘Incorrect – masquerade is not allowed in dstnat regardless of parameters.
B.✘Incorrect – masquerade is not valid in the dstnat chain.
C.✘Incorrect – masquerade does not operate in dstnat, direction does not change this.
D.✔Correct – masquerade must only be used in chain=srcnat.
Extract from MTCNA Course Material – NAT Concepts:
“Masquerade is a special type of source NAT used only in the srcnat chain. It is invalid in dstnat.”
Extract from René Meneses Study Guide – NAT Actions:
“Use action=masquerade in chain=srcnat. RouterOS will not accept it in dstnat.”
Extract from MikroTik Wiki – NAT Rules:
“action=masquerade is not allowed in dstnat chain and will result in error if applied.”
===========
For static routing functionality, additionally to the RouterOS 'system' package, you will also need the following software package:
no extra package required
advanced-tools
routing
dhcp
Static routing is a core feature of MikroTik RouterOS and is included in the default 'system' package. You do not need to install any additional packages (like the "routing" package) for simple static routing.
The routing package is only needed for advanced dynamic routing protocols like BGP, OSPF, and RIP. For manually configured static routes, the system package alone is sufficient.
Let’s evaluate:
A.✅Correct. Static routing is part of the default system.
B.❌advanced-tools are for diagnostics and tools like traceroute, bandwidth-test, etc.
C.❌routing package is for dynamic protocols (OSPF, BGP, etc.), not static routes
D.❌dhcp is unrelated to routing — used for dynamic host IP assignment
MTCNA Course Manual – Routing Fundamentals:
“Static routing requires no additional package — it is included in the base system.”
René Meneses Guide – Routing Overview:
“For static routes, you do not need the 'routing' package. That’s only for protocols like BGP or OSPF.”
Terry Combs Notes – Routing Concepts:
“No extra packages needed for static routes. Just use /ip route.”
Answer: AQUESTION NO: 40 [Tools]
You want to transfer existing '/ip firewall filter' configuration from one router to a new system.
Choose the best possible way to do:
A. Export global configuration and remove everything apart from '/ip firewall filter'
B. Export only '/ip firewall filter'
C. Create backup, edit backup file and restore on target router
D. Create backup only of '/ip firewall filter' rules
Answer: B
The best way to transfer only the firewall filter rules is to export just that section of the configuration. This avoids unrelated settings (like IP addresses, user accounts, etc.) that could cause issues on the new router.
MikroTik allows you to selectively export parts of the configuration using:
/ip firewall filter export
This command outputs the firewall filter rules in script format, which can then be copied and applied to another router using import or pasting into terminal.
Evaluations:
A.❌Inefficient and error-prone. Exporting everything then removing parts increases the chance of mistakes.
B.✅Best method. Selective export via command line is clean and precise.
C.❌Backups are binary and system-specific — cannot be safely edited or restored on different hardware.
D.❌Backup doesn’t work selectively per section; export is the proper method.
MTCNA Course Manual – Backup vs Export:
“Use export when you need partial configurations. Backup is for full system state and cannot be selectively restored.”
René Meneses Study Guide – Configuration Transfer:
“Export is human-readable and editable. Use it for transferring only desired parts.”
Terry Combs Notes – Best Practices for Configuration Migration:
“Don’t use backups for partial transfer. Use export for readable and editable results.”
Answer: BQUESTION NO: 41 [QoS – PCQ]
You want to use PCQ and allow 256k maximum download and upload for each client. Choose correct argument values for the required queue.
A. kind=pcq pcq-rate=256000 pcq-classifier=src-address
B. kind=pcq pcq-rate=1256000 pcq-classifier=dst-address
C. kind=pcq pcq-rate=256000 pcq-classifier=dst-address
D. kind=pcq pcq-rate=5000000 pcq-classifier=src-address
E. kind=pcq pcq-rate=5000000 pcq-classifier=dst-address
Answer: A, C
PCQ (Per Connection Queue) is used in MikroTik to enforce bandwidth fairness across multiple users. To limit each client to 256k:
pcq-rate=256000 → sets maximum bandwidth per client to 256,000 bps (256 kbps)
pcq-classifier=src-address → used in upload queues
pcq-classifier=dst-address → used in download queues
So:
A.✅Used for upload: src-address
C.✅Used for download: dst-address
The other options have incorrect rates or classifiers:
B.❌Incorrect rate (1256000 ≠ 256k)
D & E.❌Incorrect rate (5000000 = 5 Mbps)
MTCNA Course Manual – PCQ Explanation:
“Use pcq-classifier=src-address for upload, and dst-address for download. pcq-rate sets per-client limit.”
René Meneses Study Guide – Queue Management:
“To cap clients to 256k, configure pcq-rate=256000. Adjust classifiers based on traffic direction.”
Terry Combs Notes – PCQ Parameters:
“Classifier is the key. src-address = upload, dst-address = download. Don’t mix.”
Answer: A, CQUESTION NO: 42 [Routing]
Which of the following Route statuses are possible?
A. A = Active
B. C = Connected
C. S = Static
D. D = Drop
Answer: A, B, C
In the MikroTik routing table, route status flags describe the type and status of each route:
A = Active → The route is being used to forward packets✅
C = Connected → The route is to a directly connected subnet✅
S = Static → The route was added manually by the administrator✅
D = Drop →❌There is no such routing flag; “drop” may be an action in firewall or route rules but not a route status
Correct route flags in MikroTik include:
D = Dynamic
A = Active
C = Connected
S = Static
r = RIP
o = OSPF
b = BGP
MTCNA Routing Section – Route Flags Overview:
“Static routes show as S, connected routes as C, and routes in use are marked with A.”
René Meneses Guide – Routing Table Flags:
“Check route flags: A (Active), C (Connected), S (Static). Drop is not a valid route flag.”
Terry Combs Notes – Route Status Flags:
“Drop = firewall action, not route flag. Don’t confuse it with routing status.”
A client that has successfully connected to a wireless network is considered to be which of the following? Choose all that apply:
Authenticated
Associated
Unauthenticated
Unassociated
For a client to exchange data over a wireless network, it must complete two key steps:
Association – Establishes the basic radio link between client and access point
Authentication – Verifies credentials (e.g., WPA2 handshake)
When both are complete, the client is both authenticated and associated.
A.✔Authenticated – Encryption and access control is complete
B.✔Associated – Wireless radio link is established
C.✘Unauthenticated – Incorrect; client is verified
D.✘Unassociated – Incorrect; client is linked to AP
Extract from MTCNA Course Material – Wireless Client States:
“A connected client is associated (Layer 2) and authenticated (security/credentials verified).”
Extract from Terry Combs MTCNA Notes – Wireless States:
“Authenticated and associated are required for data transfer. Unassociated = disconnected.”
===========
Which router command allows you to view the entire contents of all access lists?
show all access-lists
show access-lists
show ip interface
show interface
The show access-lists command in Cisco IOS is used to display all configured access control entries (ACEs) in every access list, both named and numbered. This command shows the complete content, including rules and hit counters.
Cisco IOS Command Reference – Access List Monitoring:
“Use show access-lists to view the complete list of all access control entries. This includes both standard and extended lists.”
Other options:
A: Invalid command syntax
C: show ip interface shows interface-level IP settings and ACL applications, but not full ACL content
D: show interface shows status and statistics, not ACL rules
Final Answer: BQUESTION NO: 134 [Cisco IOS – Console Access Configuration]
What does the command routerA(config)#line cons 0 allow you to perform next?
A. Set the Telnet password.
B. Shut down the router.
C. Set your console password.
D. Disable console connections.
Answer: C
The command line cons 0 enters the console line configuration mode. This is used to apply settings specific to the physical console line, such as setting a login password (via password and login commands).
Cisco IOS Configuration Guide – Line Console Mode:
“Use line console 0 to configure settings for the console line, including timeouts, password security, and logging behavior.”
René Meneses Study Guide – Device Access:
“Console access configuration begins with line console 0. It is followed by login and password commands.”
Other options:
A: Telnet is configured under line vty, not console
B: Router shutdown is done with reload or shutdown commands (not here)
D: Console cannot be disabled from line cons 0
Final Answer: CQUESTION NO: 135 [Switching – Spanning Tree Protocol]
How often are BPDUs sent from a Layer 2 device?
A. Never
B. Every 2 seconds
C. Every 10 minutes
D. Every 30 seconds
Answer: B
BPDU (Bridge Protocol Data Units) are messages exchanged by switches in a Spanning Tree Protocol (STP) topology to maintain loop-free Layer 2 networks. By default, switches send BPDUs every 2 seconds.
MTCNA Course Material – STP Operation:
“Switches send BPDUs to maintain spanning tree and detect topology changes. The default transmission interval is 2 seconds.”
Cisco STP Documentation:
“BPDUs are transmitted by the root bridge and propagated every 2 seconds by default, controlled by the hello-time timer.”
Other options:
A: Incorrect — BPDUs are essential for loop prevention
C & D: Not correct — default is 2 seconds, not minutes
Final Answer: BQUESTION NO: 136 [Routing Protocols – Passive Interface Behavior]
What does the passive command provide to dynamic routing protocols?
A. Stops an interface from sending or receiving periodic dynamic updates.
B. Stops an interface from sending periodic dynamic updates but not from receiving updates.
C. Stops the router from receiving any dynamic updates.
D. Stops the router from sending any dynamic updates.
Answer: B
In dynamic routing (e.g., RIP, OSPF, EIGRP), the passive-interface command stops routingadvertisements (outgoing updates) from being sent through the specified interface. However, the router still listens for incoming routing updates.
Cisco IOS Configuration Guide – Passive Interface:
“The passive-interface command prevents routing updates from being sent on an interface, while still allowing updates to be received.”
René Meneses MTCNA Guide – Passive Mode:
“It suppresses sending routing advertisements but does not block receiving updates on that interface.”
Other options:
A: Incorrect — it does not block receiving
C: Incorrect — it applies to interfaces, not globally
D: Also incorrect — it does not block all updates
Final Answer: B
────────────────────────────────────────────────────────────
What is possible with Netinstall?
MikroTik RouterOS reinstall
MikroTik RouterOS password reset with saving router's configuration
MikroTik RouterOS configuration reset
Netinstall is a powerful utility provided by MikroTik that allows reinstallation of RouterOS on RouterBOARD devices. It is primarily used for:
Reflashing or reinstalling RouterOS
Recovering devices that are not booting correctly
Clearing configurations during reinstall
It does not allow you to reset the password without losing the configuration, nor is it used just for configuration reset.
MTCNA Official Course Material – Tools & Netinstall:
“Netinstall is used to reinstall RouterOS onto a MikroTik device via the network. It can be used to install a specific RouterOS version or wipe the existing installation.”
René Meneses MTCNA Guide – Tools Chapter:
“Netinstall allows you to reinstall RouterOS and optionally reset the configuration. It does not allow recovery of the existing password or configuration unless backed up beforehand.”
MikroTik Wiki – Netinstall Utility:
“Netinstall is a tool used for reinstalling RouterOS. It formats the system partition and reinstalls RouterOS. This is useful in case of misconfiguration or firmware corruption.”
Option B is incorrect — password reset is only possible via full configuration wipe.
Option C is not accurate — Netinstall reinstalls the entire OS, not just resets configuration.
Only A is correct.
Final Answer: AQUESTION NO: 90 [Wireless]
You would like to allow multiple logins with one user name on a HotSpot server. How should this be configured?
A. Set "Shared Users" option at /ip HotSpot user profile
B. It's not possible
C. Set "Shared Users" option at /ip HotSpot
D. Set "only-one=no" at /ip HotSpot
Answer: A
MikroTik HotSpot user management allows defining how many simultaneous sessions a single username can support. This is done via the "Shared Users" option in the user profile configuration, not in the general HotSpot or interface settings.
MTCNA Course Material – HotSpot Section:
“Shared Users in user-profile allows multiple concurrent logins using the same username/password combination. Default is 1. If set to 3, then three sessions can be active simultaneously.”
René Meneses MTCNA Study Guide – HotSpot Configuration:
“The shared-users parameter in /ip hotspot user profile allows multiple concurrent sessions for the same user. This is commonly used in shared environments like hotels or cafes.”
Terry Combs MTCNA Notes – HotSpot Profiles:
“Shared-users is set per profile, not per user. If you want three devices to log in with the same account, set shared-users=3 in the profile assigned to that user.”
Option A is correct.
Option B is false — it is definitely possible.
Option C is incorrect — /ip hotspot does not contain this parameter.
Option D is invalid — “only-one” is not a known parameter in HotSpot configuration.
Final Answer: AQUESTION NO: 91 [Routing]
When adding a static route, you must always ensure that you add both the gateway and the interface.
A. False
B. True
Answer: A
In RouterOS, specifying the gateway IP is sufficient for static routing as long as the gateway IP is reachable via a directly connected interface. The system automatically determines the correct interface based on the routing table. Adding an interface manually is only required in special cases, such as point-to-point links.
MTCNA Course Material – Static Routing Section:
“You can configure static routes by specifying the destination and gateway only. The system can resolve the interface automatically if the gateway is reachable.”
René Meneses MTCNA Study Guide – Routing Examples:
“The interface field is optional in most routing scenarios. MikroTik will find the outgoing interface if the gateway IP is in a directly connected subnet.”
MikroTik Wiki – Routing Configuration:
“In most cases, just the dst-address and gateway are sufficient. The interface will be determined by the router.”
Therefore, the idea that both gateway and interface must always be defined is incorrect.
Final Answer: AQUESTION NO: 92 [Wireless]
Please select valid scan-list values in interface wireless configuration:
A. 5560,5620-5700
B. 5640~5680
C. default,5560,5600,5660-5700
D. 5540,5560,5620+5700
Answer: C
The scan-list option defines the frequencies that a wireless interface should scan or operate on. Valid formats include:
Single frequencies: e.g., 5560
Ranges: e.g., 5660-5700
Including "default" for system-determined values
Comma-separated lists are accepted
Characters like ~ or + are not allowed.
MTCNA Official Course Material – Wireless Configuration:
“scan-list can include frequency numbers and ranges separated by commas. Example: 5500,5520-5700. Use ‘default’ to use the standard channel list.”
René Meneses MTCNA Guide – Wireless Interface Options:
“Valid scan-list includes entries like: 5180,5200-5320, or default. Invalid characters such as ‘~’ or ‘+’ are not supported.”
MikroTik Wiki – Wireless Manual:
“Values can be comma-separated frequencies and ranges. Symbols such as ‘+’ or ‘~’ are not allowed in scan-list values.”
Option A: valid format
Option B: invalid (‘~’ is not allowed)
Option C: valid — includes default and proper ranges
Option D: invalid — ‘+’ symbol is not allowed
Thus, Option C is the only valid and complete answer.
It is possible to create an encrypted PPPoE tunnel in RouterOS:
True
False
PPPoE (Point-to-Point Protocol over Ethernet) does not natively support encryption. It provides authentication using PAP/CHAP and allows IP assignment, but any data transmitted through a PPPoE tunnel is unencrypted unless another encryption mechanism (such as IPSec) is used on top of it.
MikroTik RouterOS supports encrypted tunneling protocols such as SSTP, L2TP/IPSec, or OpenVPN, but not native encryption in PPPoE.
MTCNA Course Manual – PPP Protocols Overview:
“PPPoE supports user authentication and compression but not encryption by itself.”
René Meneses Study Guide – Tunneling Protocols:
“PPPoE is not secure by design. If encryption is needed, use SSTP or L2TP/IPSec.”
Terry Combs Notes – PPP Protocol Capabilities:
“PPPoE does not encrypt data. Only authentication is handled within PPP.”
Answer: BQUESTION NO: 36 [Wireless]
Why is it useful to set a Radio Name on the radio interface?
A. To identify a station in the Access List
B. To identify a station in Neighbor discovery
C. To identify a station in a list of connected clients
Answer: C
Setting a Radio Name in RouterOS provides a unique identifier that is visible to other devices in the wireless environment. It is particularly helpful for identifying connected clients in the registration table on the Access Point.
This name does not affect Access List matching or general Layer 2 communication — it’s used for human readability and monitoring.
A. Access List uses MAC addresses for filtering →❌
B. Neighbor discovery identifies devices based on MAC, IP, and identity →❌
C. Correct → Radio Name shows up in the registration table and helps identify stations✅
MTCNA Wireless Module – Interface Settings:
“The Radio Name is shown in the registration table of access points, making it easier to identify connected clients.”
René Meneses Guide – Wireless Management Tips:
“Use Radio Names to label devices in multi-client setups. It appears under registration when clients connect.”
Terry Combs Notes – Wireless Interface Options:
“Radio Name is not used for access filtering — it’s for display and diagnostics.”
Answer: CQUESTION NO: 37 [DHCP]
A DHCP server is configured on a LAN interface which is a port on a bridge. The DHCP server does not start. What could be the reason(s)?
A. The DHCP server cannot run on an interface which is also a bridge port
B. There might not be an IP address assigned to the LAN Interface
C. The IP address pool could be incorrectly defined
D. There may be multiple IP addresses set on the LAN interface
Answer: B, C
For a DHCP server to operate properly, the following conditions must be met:
The DHCP server must be attached to the correct interface (typically the bridge, not individual ports).
The bridge interface must have a valid IP address.
The IP address pool must be defined correctly (matching subnet, avoiding conflicts).
Let’s evaluate:
A.❌Incorrect. DHCP can run on a bridge or an interface on a bridge. It is recommended to attach DHCP to the bridge, not individual ports.
B.✅Correct. If there is no IP address on the interface (bridge), DHCP won’t start.
C.✅Correct. If the address pool is misconfigured (e.g., outside the subnet or overlapping with the router’s IP), DHCP won’t function.
D.❌Not a valid blocker. Multiple IPs can exist on the interface; DHCP still works if one is valid.
MTCNA DHCP Module – Configuration Troubleshooting:
“Make sure that the interface (bridge) where the DHCP server is assigned has a valid IP and a properly defined pool.”
René Meneses Guide – DHCP Server Setup:
“DHCP will not function if no IP is assigned to the interface. Check the pool range and binding address.”
Terry Combs Notes – DHCP Tips:
“Assign the DHCP server to the bridge, not individual ports. Missing IP or incorrect pool = DHCP won’t start.”
Answer: B, CQUESTION NO: 38 [PPP]
There can be more than one PPPoE server in a single broadcast domain:
A. True
B. False
Answer: A
Yes, it is possible — and fully supported — to run multiple PPPoE servers in the same Layer 2 broadcast domain. Clients will receive Offer packets (PADO) from all PPPoE servers, and can choose which one to connect to based on configuration or server name (service name).
This is commonly used in ISP networks to provide redundancy or offer different service types.
MTCNA Course Manual – PPPoE Deployment:
“Multiple PPPoE servers may exist in the same Layer 2 domain. Clients choose based on response or service name.”
René Meneses Study Guide – PPPoE Operations:
“PPPoE discovery protocol supports multi-server environments. Clients may be configured to select a preferred one.”
Terry Combs Notes – PPPoE Server Design:
“Several PPPoE servers can coexist. Just avoid assigning overlapping IP pools.”
Which command is used to upgrade an IOS on a Cisco router?
copy tftp run
copy tftp start
config net
copy tftp flash
To upgrade or install a new Cisco IOS image on a router, you typically copy the IOS image file from a TFTP server into the router’s flash memory. The correct syntax is:
copy tftp flash
This command tells the router to copy the IOS image from a TFTP server into flash storage, where it can be booted.
Cisco IOS Documentation – Image Upgrade Process:
“Use the command copy tftp flash to transfer an IOS image from a TFTP server to the router’s flash memory.”
Other options:
A: copy tftp run – invalid; you cannot copy into the running-config that way
B: copy tftp start – used to copy configuration, not IOS image
C: config net – an older and deprecated command, not for IOS upgrades
Final Answer: DQUESTION NO: 122 [RouterOS Introduction – ICMP and Diagnostics]
Which protocol does Ping use?
A. TCP
B. ARP
C. ICMP
D. BootP
Answer: C
Ping is a diagnostic utility used to test reachability between devices. It sends ICMP Echo Request packets and waits for ICMP Echo Replies. ICMP (Internet Control Message Protocol) is used for these types of control messages and is encapsulated within IP.
MTCNA Course Material – Diagnostic Tools:
“Ping uses ICMP Echo Requests to verify if a destination is reachable. It does not use TCP or UDP.”
René Meneses MTCNA Study Guide – Ping and ICMP:
“Ping uses ICMP, not TCP or ARP. ICMP packets are used to check basic connectivity.”
MikroTik Wiki – Ping Tool Description:
“Ping works by sending ICMP packets. It cannot use TCP.”
Other options:
TCP: Used by protocols like HTTP, FTP
ARP: Resolves IP to MAC, not used for ping
BootP: DHCP-related protocol, not diagnostic
Final Answer: CQUESTION NO: 123 [Cisco – Frame Relay Troubleshooting]
What command will display the line, protocol, DLCI, and LMI information of an interface?
A. sh pvc
B. show interface
C. show frame-relay pvc
D. show run
Answer: C
In Cisco IOS, to display detailed Frame Relay virtual circuit information, including the line status, protocol status, DLCI (Data Link Connection Identifier), and LMI (Local Management Interface) details, the correct command is:
show frame-relay pvc
Cisco IOS Command Reference – Frame Relay:
“The show frame-relay pvc command displays information about PVC status, including DLCI numbers and LMI statistics.”
Breakdown:
A: sh pvc – shorthand and ambiguous, may not be recognized
B: show interface – general interface stats but lacks detailed LMI/DLCI info
C: show frame-relay pvc –✔correct, provides detailed DLCI/LMI info
D: show run – shows current configuration, not real-time PVC status
Final Answer: CQUESTION NO: 124 [Networking Fundamentals – Ethernet and Switching]
How many collision domains are created when you segment a network with a 12-port switch?
A. 1
B. 2
C. 5
D. 12
Answer: D
Each port on a switch creates its own collision domain. Unlike hubs (which extend a single collision domain), switches segment each interface, allowing full-duplex communication and eliminating collisions.
MTCNA Course Material – Ethernet Switching Concepts:
“Each switch port is a separate collision domain. A 24-port switch creates 24 separate collision domains.”
René Meneses MTCNA Study Guide – Collision and Broadcast Domains:
“Switches break up collision domains per port, unlike hubs.”
Therefore, a 12-port switch creates 12 individual collision domains.
If a packet comes to a router and starts a new, previously unseen connection, which connection state would be applied to it?
no connection state would be applied to such packet
new
unknown
invalid
established
MikroTik uses connection tracking to assign states to packets that pass through the router’s firewall. When a packet initiates a connection that is not previously tracked, it is marked as new.
Connection states:
new: First packet of a new connection
established: Part of an existing tracked connection
related: New connection related to an existing one (e.g., FTP data channel)
invalid: Unrecognized or malformed connection
unknown: Used in very specific or rare circumstances (not common in IP-based networks)
Therefore:
A.✘Incorrect – All packets entering the firewall are tracked
B.✔Correct – This is a new connection
C.✘Incorrect – "unknown" is not used for typical traffic
D.✘Incorrect – Not invalid unless malformed or contextless
E.✘Incorrect – This is not an existing connection
Extract from Official MTCNA Course Material – Firewall Connection States:
“A packet that begins a new connection is marked as ‘new’. Connection tracking then continues monitoring that session.”
Extract from René Meneses MTCNA Study Guide – Connection Tracking:
“New connections receive the 'new' state. Firewall rules often start by permitting or blocking 'new' and 'established' states.”
Extract from MikroTik Wiki – Firewall and Connection States:
“State=new is assigned when no existing connection entry matches the incoming packet.”
===========
How many IP addresses can one find in the header of an IP packet?
4
2
3
1
An IP packet contains two critical IP addresses in its header:
Source IP address – the IP of the sending host
Destination IP address – the IP of the receiving host
These addresses allow routers to forward the packet from source to destination over Layer 3 (Network Layer).
Other values in the IP header include TTL, protocol type, and checksum — but not additional IP addresses.
A. 4 →❌Incorrect. Only 2 IPs are included
B. 2 →✅Correct: Source and Destination
C. 3 →❌Some protocols like NAT may temporarily associate more addresses, but not in header
D. 1 →❌Incomplete
MTCNA Course Manual – IP Packet Structure:
“An IP packet always contains a source and destination IP address in the Layer 3 header. This allows routing to function across networks.”
René Meneses Guide – Packet Flow:
“IP headers are designed to carry the minimal information necessary for routing. That includes the source and destination IPs.”
Terry Combs Notes – Header Fields:
“Two IPs: one for sender, one for receiver. That’s all you’ll find in the IP header.”
Answer: BQUESTION NO: 21 [Routing]
When viewing the routes in Winbox, some routes will show "DAC" in the first column. These flags mean:
A. Dynamic, Active, Console
B. Dynamic, Active, Connected
C. Direct, Available, Connected
D. Dynamic, Available, Created
Answer: B
MikroTik’s RouterOS assigns flags to routing table entries to describe how they were created and their status.
D = Dynamic (added automatically by the system)
A = Active (currently used by RouterOS)
C = Connected (directly connected subnet or interface)
Thus, "DAC" means:
→ Dynamic, Active, Connected✅
Other flags that may appear include:
S = Static (manually added)
R = RIP
O = OSPF
B = BGP
MTCNA Course Manual – Routing Flags:
“DAC means that the route is dynamically added by the system, is currently active, and is directly connected to the device.”
René Meneses MTCNA Guide – Routing Table Interpretation:
“Flags help identify how the route was installed and its type. DAC is common for directly connected interfaces.”
Terry Combs Notes – Route Flags Table:
“DAC = Dynamic + Active + Connected. Usually appears after setting IP address on interface.”
Answer: BQUESTION NO: 22 [RouterBOARD Hardware]
In which situations Netinstall can not be used to install RouterOS on a RouterBOARD?
A. The router is connected only to a secondary Ethernet port
B. The router does not have an operating system
C. The router is connected only to a wireless network
D. The password of the router is not known
Answer: C
Netinstall is a MikroTik utility used to reinstall or upgrade RouterOS. It requires a direct Ethernet connection to the router’s first Ethernet port and works via PXE (boot over Ethernet). It cannot function over wireless.
Let's review the options:
A. The router is connected only to a secondary Ethernet port →❌Netinstall works if booted over that port
B. The router does not have an operating system →❌This is the purpose of Netinstall
C. The router is connected only to a wireless network →✅Correct: Netinstall requires a wired Ethernet connection
D. The password of the router is not known →❌Netinstall bypasses current OS; password irrelevant
MTCNA Course Manual – RouterBOARD Recovery and Netinstall:
“Netinstall must be done over a wired Ethernet connection. Wireless booting is not supported.”
René Meneses Guide – System Recovery:
“Netinstall needs Layer 2 communication via Ethernet. It cannot operate over Wi-Fi.”
Terry Combs Notes – Netinstall Limitations:
“Netinstall does not support Wi-Fi. Must connect via Ethernet to first interface, preferably.”
Answer: CQUESTION NO: 23 [DHCP]
DHCP server is configured on a router’s ether1 interface. IP address 192.168.0.100/24 is assigned to the interface. Possible IP pools, that can be used by this DHCP server, are:
A. 192.168.0.1–192.168.0.255
B. 192.169.0.1–192.169.0.254
C. 192.168.0.1–192.168.0.99, 192.168.0.101–192.168.0.254
D. 192.168.0.1–192.168.0.14
Answer: C
The router’s interface IP is 192.168.0.100/24 → which belongs to the subnet 192.168.0.0–192.168.0.255.
However, 192.168.0.100 is already assigned to the router. So, this IP must be excluded from the DHCP pool to avoid conflicts.
C offers two valid ranges excluding .100:→ 192.168.0.1–192.168.0.99→ 192.168.0.101–192.168.0.254
Let’s evaluate other options:
A. 192.168.0.1–192.168.0.255 →❌Includes broadcast (.255) and router IP (.100) → Invalid
B. 192.169.0.1–192.169.0.254 →❌Completely wrong subnet
D. 192.168.0.1–192.168.0.14 →✅Valid but unnecessarily small
MTCNA DHCP Chapter – Address Pools:
“Make sure the pool does not include the router’s IP or the network’s broadcast address. Common errors involve overlapping pools.”
René Meneses MTCNA Guide – DHCP Configuration:
“Exclude the router’s own IP from the range. Use address pools below and above the assigned IP.”
Terry Combs Notes – DHCP Pool Tips:
“Split the pool to avoid assigning the interface IP to clients. Also avoid .0 and .255.”
Action=redirect applies to
Firewall Filter rules
DST-NAT rules
Route rules
SRC-NAT rules
The redirect action is a specialized type of destination NAT (dst-nat) used to force traffic to a local port on the router (typically for transparent proxies or redirection to hotspot portals). This action is only valid in DST-NAT rules and does not apply to firewall filters, routing rules, or source NAT.
Option breakdown:
A.✘Firewall Filter – These rules allow, drop, or reject traffic, not perform redirection.
B.✔DST-NAT – Redirect is a valid dst-nat action and is processed in the prerouting chain.
C.✘Route – Routing rules do not include NAT actions.
D.✘SRC-NAT – Used for source address translation, not redirection.
Extract from Official MTCNA Course Material – NAT Table & Actions:
“Redirect is an action under dst-nat. It rewrites destination address to the router itself, used for web proxy or hotspot.”
Extract from René Meneses MTCNA Study Guide – NAT Types:
“Use action=redirect in dst-nat rules to direct traffic to local services like proxy or DNS.”
Extract from MikroTik Wiki – NAT Rule Actions:
“redirect: redirects packet to local router port. Can only be used in dst-nat chain.”
===========
MikroTik RouterOS commands can be run once a day by:
/system watchdog
/system cron
/system scheduler
MikroTik RouterOS uses the /system scheduler to execute scripts or commands at defined times or intervals. It allows for automation of tasks such as backups, reboots, updates, and more.
Evaluation:
A. /system watchdog →❌Used for hardware monitoring and rebooting if the system freezes.
B. /system cron →❌Not available in MikroTik RouterOS (RouterOS doesn’t use cron syntax).
C. /system scheduler →✅Correct. Built-in RouterOS feature for scheduled command execution.
MTCNA Course Manual – System Scheduler Section:
“Use /system scheduler to run scripts or commands at regular intervals or specific times.”
René Meneses Guide – Automating Tasks:
“Scheduler is the only built-in time-based job handler in RouterOS.”
Terry Combs Notes – Script Automation:
“RouterOS uses scheduler, not cron. Schedule by time or interval.”
Answer: CQUESTION NO: 67 [Firewall / Tools]
Where can you monitor (see addresses and ports) real-time connections which are processed by the router?
A. Firewall Connection Tracking
B. Firewall Counters
C. Tool Torch
D. Queue Tree
Answer: A
Firewall Connection Tracking (also known as conntrack) is used to monitor real-time connections that pass through the router. It shows source and destination IPs, ports, protocols, connection states (established, new, related), and more.
Let’s evaluate the options:
A.✅Correct – Shows live connection table with IPs, ports, and statuses
B.❌Shows rule match counters only — no detailed connection info
C.❌Torch shows per-interface traffic; useful for bandwidth, but not a connection list
D.❌Queue Tree is used for traffic shaping, not for viewing connections
MTCNA Course Manual – Firewall Concepts:
“Connection tracking shows all active sessions through the router with IP and port details.”
René Meneses Guide – Firewall Tools:
“Use connection tracking to diagnose connection states and NAT behavior.”
Terry Combs Notes – Monitoring Tools:
“conntrack is your real-time connection monitor. Torch is per-interface, not per-flow.”
Answer: AQUESTION NO: 68 [Wireless]
How many wireless clients can connect, when wireless card is configured to mode=bridge?
A. 1
B. 100
C. 2007
D. 2
Answer: A
In MikroTik RouterOS, if a wireless card is configured to mode=bridge (also referred to as "station-bridge"), it can only be used to connect a single client device (MAC address) behind it. This is due to limitations in how 802.11 bridges MAC addresses.
So:
A.✅Correct – Only 1 MAC address can pass via wireless bridge mode (unless using WDS or 4-address mode)
B, C →❌Too many clients for bridge mode
D.❌Incorrect – Still only one client allowed per interface in bridge mode
MTCNA Wireless Module – Wireless Modes:
“Bridge mode allows one client only unless extended bridging protocols are used.”
René Meneses Guide – Wireless Bridging:
“mode=bridge = one MAC behind the station. Use WDS for multiple MACs.”
Terry Combs Notes – Wireless Modes:
“Station-bridge mode works like Ethernet, but only supports one MAC address unless using WDS.”
Answer: AQUESTION NO: 69 [Routing]
In the Route List, the identification DAb for a route stands for:
A. direct - active - bgp
B. direct - acknowledge - backup
C. dynamic - active - backup
D. dynamic - active - bgp
Answer: D
In MikroTik RouterOS, route flags provide quick insight into how the route was created and its status:
D = Dynamic → The route was added dynamically by a protocol (like BGP, OSPF, RIP)
A = Active → This route is currently being used
b = BGP → Indicates that the route was learned via the BGP routing protocol
Therefore, DAb means:
→ D = Dynamic
→ A = Active
→ b = BGP
MTCNA Routing Section – Route Flags Explanation:
“D = dynamically added, A = currently active, b = learned via BGP.”
René Meneses Guide – Understanding Route Lists:
“DAb → dynamic + active + BGP route. Route is learned and installed via BGP.”
Terry Combs Notes – Route Symbols:
“Check the route list: b = BGP, o = OSPF, r = RIP, s = static, c = connected.”
Select all tunnels that support authentication of clients with a username and password.
PPPoE
OpenVPN
IPIP
PPTP/L2TP
EoIP
Only tunnel types built on PPP support authentication with username and password:
A.✔PPPoE – Built on PPP, uses CHAP, PAP authentication.
B.✔OpenVPN – Supports user/password login for client authentication.
C.✘IPIP – A stateless Layer 3 tunnel; no authentication support.
D.✔PPTP/L2TP – Both are PPP-based and support username/password authentication.
E.✘EoIP – MikroTik proprietary Layer 2 tunnel; no username/password authentication.
Extract from MTCNA Course Material – Tunnel Types:
“PPPoE, PPTP, and L2TP are PPP-based and support user/password authentication. IPIP and EoIP do not.”
Extract from René Meneses Study Guide – Tunnel Protocols:
“Authentication (PAP/CHAP) is part of PPP. Use PPPoE, PPTP, L2TP, or OpenVPN for user logins.”
Extract from MikroTik Wiki – Tunnel Protocols Overview:
“Only PPP-based tunnels support authentication via username/password.”
===========
What is the main reason the OSI model was created?
To create a layered model larger than the DoD model.
So application developers can change only one layer's protocols at a time.
So different networks could communicate.
So Cisco could use the model.
The OSI (Open Systems Interconnection) model was developed by the ISO (International Standards Organization) to provide a universal standard for network communications. Its primary goal is to enable interoperability between different systems and vendors by establishing a common networking framework.
MTCNA Course Material – OSI Model Purpose:
“The OSI model helps standardize networking so that different systems and networks can communicate.”
René Meneses MTCNA Study Guide – OSI Principles:
“The model was designed to guide product developers and facilitate communication between heterogeneous network systems.”
Other options:
A: The OSI was not intended to be “larger” than DoD model
B: Helpful benefit, but not the main reason for creation
D: Incorrect and vendor-specific (not factual)
Final Answer: CQUESTION NO: 126 [Networking Fundamentals – VLAN Concepts]
What does a VLAN do?
A. Acts as the fastest port to all servers.
B. Provides multiple collision domains on one switch port.
C. Breaks up broadcast domains in a layer 2 switch internetwork.
D. Provides multiple broadcast domains within a single collision domain.
Answer: C
VLANs (Virtual Local Area Networks) segment a Layer 2 switch network into separate broadcast domains. Without VLANs, all devices on a switch share a single broadcast domain. VLANs allow traffic isolation by logically grouping ports, improving security and performance.
MTCNA Course Material – VLAN Fundamentals:
“VLANs allow you to logically segment a switch network. Each VLAN creates a separate broadcast domain.”
René Meneses MTCNA Study Guide – VLAN Behavior:
“Switches normally operate in a single broadcast domain. VLANs break this up without requiring physical segmentation.”
Breakdown:
A: Not related to VLAN function
B: Switch ports are already separate collision domains
D: Reverse of what VLANs actually do
Final Answer: CQUESTION NO: 127 [VLAN Management – VTP and Cisco Switching]
Which one of the following is true regarding VLANs?
A. Two VLANs are configured by default on all Cisco switches.
B. VLANs only work if you have a complete Cisco switched internetwork. No off-brand switches are allowed.
C. You should not have more than 10 switches in the same VTP domain.
D. VTP is used to send VLAN information to switches in a configured VTP domain.
Answer: D
VTP (VLAN Trunking Protocol) is a Cisco proprietary protocol used to manage and propagate VLAN information throughout a switch fabric. It helps maintain consistency across switches by distributing VLAN configurations from a VTP server to client switches in the same domain.
Cisco Switching Guide – VTP Concepts:
“VTP advertises VLAN definitions on a LAN to ensure consistency. It reduces misconfigurations by centralizing VLAN management.”
René Meneses MTCNA Study Guide – VLAN and VTP Notes:
“VTP sends VLAN updates across switches in the same VTP domain. Switches must be compatible and share the domain name.”
Breakdown:
A: Only VLAN 1 exists by default
B: VLANs are not Cisco-exclusive
C: There is no limit of 10 switches in a VTP domain
D:✔Correct
Final Answer: DQUESTION NO: 128 [RouterOS]
If your router is facilitating a CSU/DSU, which of the following commands do you need to use to provide the router with a 64000bps serial link?
A. RouterA(config)#bandwidth 64
B. RouterA(config-if)#bandwidth 64000
C. RouterA(config-if)#clock rate 64
D. RouterA(config-if)#clock rate 64000
Answer: D
In Cisco IOS, the clock rate command is used on the DCE (Data Communications Equipment) end of a serial link to provide timing to the connected DTE (Data Terminal Equipment) device. To configure a 64 kbps link, the correct syntax is:
RouterA(config-if)#clock rate 64000
Cisco IOS Configuration Guide – Serial Interfaces:
“When the router acts as DCE, use the command clock rate [bps] under the serial interface to set the speed. For 64kbps, use 64000.”
René Meneses MTCNA Guide – WAN Configuration (Cisco Compatibility):
“Use clock rate 64000 for CSU/DSU simulation. Bandwidth command is for routing metrics only.”
Option analysis:
A: bandwidth 64 → Sets routing metric, not actual interface speed
B: bandwidth 64000 → Same; metric only
C: clock rate 64 → Incorrect value
D:✔Correct and syntactically valid
Final Answer: D────────────────────────────────────────────────────────────
It is impossible to disable user “admin” at the menu “/user”
True
False
In MikroTik RouterOS, the default user “admin” is a special system account. While it can be renamed or assigned a new password, it cannot be disabled or removed from the /user menu. This account is always present and has full administrative rights unless manually restricted via group policy or firewall rules.
A.✔True – You cannot disable or delete the “admin” user account.
B.✘False – Disabling is not possible via normal means in /user.
Extract from Official MTCNA Course Material – User Management Section:
"The default user 'admin' cannot be deleted or disabled. You may rename it or assign a strong password."
Extract from René Meneses MTCNA Study Guide – Users and Access Control:
“The admin account is permanent. For security reasons, change its name or use a different account and firewall access.”
Extract from Terry Combs Notes – User Management:
“Admin is system-protected. You can change the username, but it cannot be disabled or removed.”
===========
Mark all the features that can be used for limiting client registrations to your access point:
access-list
wpa
WDS
registration-table
MikroTik allows you to control which clients can connect to your access point through:
WPA/WPA2 security – prevents unauthorized devices from authenticating.
Access List – filters by MAC address and signal strength.
Option breakdown:
A.✔access-list – Used to accept/reject client MACs and customize access settings.
B.✔wpa – WPA/WPA2 passphrase restricts who can join the network.
C.✘WDS – Wireless Distribution System, used for bridging, not access control.
D.✘registration-table – A monitoring tool showing currently connected clients; it doesn’t restrict connections.
Extract from Official MTCNA Course Material – Wireless Access Control:
“Use WPA/WPA2 for secure authentication. Access List lets you accept or reject clients based on MAC or signal level.”
Extract from René Meneses MTCNA Study Guide – Wireless Security & Filtering:
“You can limit client access using WPA security and Access List. Registration Table only shows connected users.”
Extract from Terry Combs Notes – Wireless Configuration:
“Access control = WPA + Access List. WDS is for bridging, and registration-table is read-only.”
In which order are the entries in Access List and Connect List processed?
By Signal Strength Range
In sequence order
In a random order
By interface name
MikroTik processes entries in the Access List and Connect List in the order they are listed — from top to bottom. This is referred to as “sequence order.” The first rule that matches the client’s MAC address and interface conditions will be applied, and no further rules are evaluated after a match.
Incorrect options:
A. Signal strength can be used as a condition, but is not the order of evaluation.
C. Random order is never used in rule-based systems.
D. Interface names are used as match conditions, not ordering criteria.
MTCNA Wireless Module – Access and Connect List Order:
“Rules are checked from the top of the list down. The first matching rule is applied, then processing stops.”
René Meneses Guide – Wireless Security and MAC Filtering:
“Sequence matters. If multiple rules could apply, only the first one is enforced.”
Terry Combs Notes – Wireless Filtering:
“Don’t misplace rules. Connect-list and access-list are evaluated in listed order.”
Answer: BQUESTION NO: 59 [Queues – QoS]
Simple Queue number 0 defines 2M for upload and download for target IP 10.10.0.33.
Simple Queue number 1 defines 4M for upload and download for the same target IP 10.10.0.33.
Client 10.10.0.33 will be able to obtain:
A. 6M upload/download
B. 0M upload/download
C. 4M upload/download
D. 2M upload/download
Answer: D
In MikroTik RouterOS, when multiple simple queues are configured for the same target (IP address), only the first matching queue in sequence is processed. This means that:
If queue 0 (2M) comes before queue 1 (4M), the 2M limit will be enforced.
The second queue is ignored, even if it provides a higher rate.
MikroTik does not sum the bandwidth of multiple queues. The first applicable queue (based on order) wins.
MTCNA Course Manual – Simple Queues:
“Simple Queues are matched top-down. Only the first matching queue is applied per packet.”
René Meneses MTCNA Guide – QoS Queue Behavior:
“Queue order matters. The first rule that matches is the one used. Lower queues override lower ones if placed first.”
Terry Combs Notes – Queue Troubleshooting:
“If two queues match the same IP, only the first is active. Don’t stack queues unless using a queue tree.”
Answer: DQUESTION NO: 60 [RouterOS Packages]
Which features are removed when the advanced-tools package is uninstalled?
A. neighbors
B. LCD support
C. ip-scan
D. ping
E. netwatch
F. bandwidth-test
Answer: C, E, F
The advanced-tools package in MikroTik RouterOS contains a set of diagnostic and monitoring tools. If this package is removed, the following features are lost:
ip-scan →✅Used for scanning IP ranges to discover hosts
netwatch →✅Monitors host availability and runs scripts on status changes
bandwidth-test →✅Used to measure throughput between MikroTik devices
Incorrect options:
A. neighbors → Part of the main system package (MAC discovery)
B. LCD support → Tied to specific hardware; not affected by advanced-tools
D. ping → Part of the base system package
MTCNA System Tools Section – Package Breakdown:
“The advanced-tools package includes netwatch, bandwidth-test, and ip-scan. These are not part of the base system.”
René Meneses Guide – Package Management:
“Removing advanced-tools disables several diagnostic commands like ip-scan and bandwidth-test.”
Terry Combs Notes – Tools Overview:
“Ping and neighbors are in core OS. Advanced-tools affects monitoring scripts and traffic tools.”
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 22 Jun 2025
Copyright © 2014-2025 DumpsMate. All Rights Reserved