MikroTik MTCNA Practice Exam

• A. Yes
• B. No Correct answer

RouterOS does not support manual installation of drivers for PCI Ethernet cards. The operating system is designed to work with a predefined set of drivers, and users cannot add new drivers manually. This aligns with the standard knowledge expected in the MTCNA certification exam.

• A. A. 24 hours Correct answer
• B. B. Infinite time
• C. C. 1 month
• D. D. 1 year
• E. E. 12 hours

Option A is correct because a Level 1 (Demo) license in MikroTik RouterOS is specifically designed for short-term testing and strictly expires exactly 24 hours after the initial installation. Once this 24-hour runtime clock runs completely out, the router stops operating and locks administrative configurations until a permanent license tier is purchased or applied.

• A. True
• B. False Correct answer

Telnet transmits data in plaintext, making it insecure for remote management. A more secure method would be to use SSH, which encrypts the session to protect sensitive information.

• A. A. Yes
• B. B. No Correct answer

The MikroTik hotspot feature can be used on both Ethernet and wireless interfaces. You do not need a separate access point to provide hotspot services over wireless; you can configure the hotspot directly on a wireless interface of a MikroTik device. This allows users to connect and authenticate via Wi-Fi using the same device.

• A. A. Users
• B. B. IP bindings Correct answer
• C. C. Walled-garden
• D. D. Walled-garden IP

To allow a specific computer to bypass Hotspot authentication, you use the IP bindings menu. In IP bindings, you can add the MAC address or IP address of the device and set its type to 'bypassed.' This allows the device to access the internet without being redirected to the Hotspot login page, effectively exempting it from authentication requirements.

• A. True Correct answer
• B. False

Using the 'Static' lease option in MikroTik's DHCP server configuration allows the assignment of specific IP addresses to devices based on their MAC addresses.

• A. 1 Correct answer
• B. 2
• C. 5
• D. 12

In a network running the Spanning Tree Protocol (STP), only one switch is elected as the root bridge. All other switches calculate their best path to this single root bridge to prevent loops. The root bridge acts as the central reference point for all spanning tree calculations in the network.

• A. Acts as the fastest port to all servers.
• B. Provides multiple collision domains on one switch port.
• C. Breaks up broadcast domains in a layer 2 switch internetwork. Correct answer
• D. Provides multiple broadcast domains within a single collision domain.

A VLAN (Virtual Local Area Network) is used to segment a physical network into multiple, isolated broadcast domains at Layer 2. This means devices in different VLANs cannot communicate directly without a router, reducing unnecessary broadcast traffic and improving network organization and security. VLANs do not affect collision domains, which are determined by physical port boundaries in modern switched networks.

• A. 15.242.55.31-15.242.55.62
• B. 15.242.55.32-15.242.55.63
• C. 15.242.55.33-15.242.55.62 Correct answer
• D. 15.242.55.33-15.242.55.63

A /27 subnet has 32 IP addresses. The network address is the first address in the range, and the broadcast address is the last. For 15.242.55.62/27, the network address is 15.242.55.32 and the broadcast address is 15.242.55.63. Valid host addresses are those between the network and broadcast addresses, so the range is 15.242.55.33 to 15.242.55.62.

• A. A
• B. C Correct answer
• C. D
• D. I
• E. S

In RouterOS, when a route is automatically generated after a user adds a valid address to an active interface, it is typically marked with the letter 'C' for 'Connected'. This is standard knowledge for the MTCNA certification.

• A. 2310
• B. 2327
• C. 5220
• D. 2412 Correct answer
• E. 5800

The 802.11b/g wireless standards operate in the 2.4 GHz frequency band. The frequency 2412 MHz is within this band, making it a valid option for an 802.11b/g wireless card. This aligns with the standard knowledge expected in the MTCNA certification.

• A. Use the same SSID as on accesspoint Correct answer
• B. Use the same Radio Name
• C. Use the same Band (5 GHz, 2.4 GHz, ...) Correct answer

To connect a MikroTik router to a wireless access point, the router's wireless interface must be configured with the same SSID as the access point and set to operate on the same frequency band (such as 2.4 GHz or 5 GHz). The SSID identifies the specific wireless network, and the band ensures both devices use compatible radio frequencies. The radio name is just a device identifier and does not affect connectivity.

• A. Chain=srcnat
• B. Chain=dstnat Correct answer
• C. Chain=foward
• D. All of the above

The 'redirect' action in MikroTik RouterOS NAT rules is only valid in the 'dstnat' chain. This is because 'redirect' changes the destination address of packets so they are sent to the router itself, typically for services like transparent proxy. The 'dstnat' chain is designed for destination NAT operations, which is where this kind of address modification is handled. 'srcnat' is used for source NAT, which modifies the source address, and the 'forward' chain is for routing packets between interfaces, not for NAT actions like 'redirect'.

• A. Foward DNS to another device IP address
• B. Transparent DNS Cache Correct answer
• C. Transparent HTTP Proxy Correct answer
• D. Enable local service

The 'redirect' action in MikroTik NAT rules changes the destination port of packets so they are sent to a local service running on the router itself, without changing the destination IP address. This is how transparent DNS caching and transparent HTTP proxying work: client requests are intercepted and handled by the router, even though the clients are trying to reach external servers. This allows the router to provide these services transparently, with no changes needed on the client side.

• A. Target-address, dst-address
• B. Target-address, max limit
• C. Max-limit Correct answer
• D. Target-address, max-limit, dst-address

The option Max-limit is marked correct because it defines the actual speed cap (bandwidth boundary) for both download and upload traffic inside the queue. Without configuring a maximum traffic rate here, the router cannot enforce any rate-limiting action.

• A. kind=pcq pcq-rate=256000 pcq-classifier=src-address Correct answer
• B. kind=pcq pcq-rate=1256000 pcq-classifier=dst-address
• C. kind=pcq pcq-rate=256000 pcq-classifier=dst-address Correct answer
• D. kind=pcq pcq-rate=5000000 pcq-classifier=src-address
• E. kind=pcq pcq-rate=5000000 pcq-classifier=dst-address

To limit each client to 256k for both upload and download using PCQ, you must set pcq-rate=256000. For upload queues, use pcq-classifier=src-address, because the source address is the client sending data. For download queues, use pcq-classifier=dst-address, because the destination address is the client receiving data. Both A and C are correct: A is for upload, C is for download. The classifier determines which IP field is used to separate clients.

• A. A. PPTP users Correct answer
• B. B. Winbox users
• C. C. L2TP users Correct answer
• D. D. Wireless users
• E. E. PPPOE users Correct answer
• F. F. Hotspot users

The Secrets window in the PPP menu is used to configure authentication credentials for PPP-based services such as PPTP, L2TP, and PPPoE. These users are defined here so they can authenticate when connecting via these protocols. Winbox users, wireless users, and Hotspot users are managed in different sections of RouterOS, not in the PPP Secrets window.

• A. A. Yes
• B. B. No Correct answer

Router A cannot directly use '/PPP secret' accounts stored on Router B because these secrets are stored locally on each router and are not shared or synchronized between devices. Each router maintains its own user database for PPP authentication. Unless you set up a centralized authentication service like RADIUS, Router A will not have access to the secrets configured on Router B.

• A. TCP
• B. UDP
• C. ICMP Correct answer
• D. IP

Ping and Trace Route use the Internet Control Message Protocol (ICMP) to send echo requests and receive echo replies, allowing you to test connectivity and measure route hops. ICMP is specifically designed for network diagnostics and error reporting, not for data transport like TCP or UDP. Ping sends ICMP Echo Request packets, and Trace Route typically uses ICMP Echo Requests (or sometimes UDP, but on MikroTik and most systems, ICMP is standard) to map the path to a destination.

• A. True
• B. False Correct answer

The /system backup save command produces a binary file with a .backup extension. This file is not human-readable and cannot be opened or meaningfully edited in a text editor. To obtain a text-based configuration, use /export instead, which generates a readable .rsc script.