MikroTik MTCSE Practice Exam

MikroTik Certified Security Engineer (MTCSE)

The MikroTik Certified Security Engineer (MTCSE) certification validates the ability to plan and implement security measures for MikroTik networks. It covers common network attacks, RouterOS firewall management including stateful filtering and SYN flood mitigation, OSI Layer attacks like DHCP starvation and ICMP Smurf, brute-force and port scan detection, cryptography and PKI, secure router access via HTTPS/SSH/WinBox, and secure tunneling with IPsec, L2TP, and SSTP.

Question bank updated : questions, answers, explanations and chapters.

Certification Overview

  • Exam name: MTCSE
  • Vendor: MikroTik
  • Exam code: MTCSE
  • Duration: 60 minutes
  • Total questions: about 25
  • Official passing score: 60% (source)
  • Our practice exam pass mark: 60%

Who Should Take This Exam?

Network Engineer, Network Technician, Security Analyst, IT Administrator, Systems Engineer, Security Consultant, Network Security Specialist, Technical Support Engineer

Prerequisites

Valid MTCNA certification

Topics Covered

  • Introduction
  • Firewall
  • OSI Layer Attacks
  • Cryptography
  • Securing the Router
  • Secure Tunnels

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • True / False
  • Scenario-Based

MTCSE Practice Questions

Our question bank contains 488+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomised questions from our full question bank.

Introduction

The wireless authentication mode that necessitates a separate authentication server is:
  • A. WEP
  • B. WPA
  • C. WPA2
  • D. 802.1X Correct answer

802.1X is an authentication framework that requires a separate authentication server, typically a RADIUS server, to validate user credentials before granting access to the wireless network. It is designed for enterprise environments where centralized authentication is needed. WEP, WPA, and WPA2 can use pre-shared keys (PSK) for authentication, which do not require a separate authentication server unless configured in enterprise mode, which specifically uses 802.1X.

The wireless security mode that utilizes a separate authentication server for authentication among the options provided is:
  • A. WEP
  • B. WPA
  • C. WPA2
  • D. 802.1X Correct answer

802.1X is a network access control protocol that uses an external authentication server, typically RADIUS, to authenticate users or devices before granting access to the network. This is different from WEP, WPA, and WPA2, which are encryption protocols that can use pre-shared keys for authentication and do not require a separate authentication server by default. 802.1X is commonly used in enterprise wireless networks to provide stronger, centralized authentication.

The wireless authentication mode that applies a RADIUS server for authentication is:
  • A. WEP
  • B. WPA
  • C. WPA2
  • D. 802.1X Correct answer

802.1X is a network access control protocol that uses a RADIUS server to authenticate users or devices before granting access to the network. It is specifically designed to provide port-based authentication, and is commonly used in enterprise wireless networks to enforce secure authentication using external authentication servers like RADIUS. While WPA and WPA2 can use 802.1X for enterprise authentication, 802.1X is the actual protocol that enables RADIUS integration.

An organization uses MikroTik RouterOS and wants to implement a dynamic routing protocol to optimize its network performance. OSPF is the best choice for small to medium-sized networks.
  • A. True Correct answer
  • B. False

OSPF is designed for efficiency in small to medium-sized networks, providing fast convergence and scalability, making it a suitable choice for dynamic routing in such environments.

Firewall

The NAT rule that translates the source port number to a different port number is:
  • A. srcnat Correct answer
  • B. dstnat
  • C. masquerade

The srcnat rule is used for Source NAT, which modifies the source address and/or source port of outgoing packets. This is commonly used to allow multiple devices on a private network to share a single public IP address, and it can change the source port to avoid conflicts. dstnat is used for Destination NAT, which changes the destination address or port, not the source. Masquerade is a special type of srcnat that automatically uses the outgoing interface's IP, but it is still a form of srcnat, not a separate rule type. 'All of the above' is incorrect because only srcnat (and masquerade as a type of srcnat) translates source ports.

The firewall chain that processes packets forwarded through the router in MikroTik RouterOS is:
  • A. input
  • B. output
  • C. forward Correct answer
  • D. prerouting

The 'forward' chain in MikroTik RouterOS handles packets that are passing through the router, meaning packets that are neither destined for nor originating from the router itself. This is distinct from traffic to or from the router, which is handled by the 'input' and 'output' chains. The 'forward' chain is specifically designed to filter and manage transit traffic between interfaces.

How can a network administrator ensure that only authorized users can access the MikroTik router's management interface? Select two options.
  • A. Implement IP address filtering Correct answer
  • B. Use default admin credentials
  • C. Configure user roles and permissions Correct answer
  • D. Disable all remote access

Implementing IP address filtering (A) restricts access to specific IPs, enhancing security. Configuring user roles and permissions (C) ensures that only authorized users have access to sensitive functions. Using default admin credentials (B) poses a security risk, and disabling remote access (D) is overly restrictive and not always practical.

An organization uses a MikroTik router with a firewall rule that allows all incoming traffic from a specific IP address. This rule effectively mitigates all security risks from that IP.
  • A. True
  • B. False Correct answer

Allowing all incoming traffic from a specific IP address does not mitigate security risks, as it creates a potential vulnerability if that IP becomes compromised or malicious.

OSI Layer Attacks

Which command is used to monitor traffic that may indicate an OSI Layer 3 attack on a MikroTik router?
  • A. /interface monitor-traffic Correct answer
  • B. /ip firewall filter
  • C. /log print
  • D. /system resource

/interface monitor-traffic command allows you to see real-time traffic statistics, which can help identify unusual patterns indicative of Layer 3 attacks. The other commands do not specifically monitor traffic.

How can a security analyst ensure that a MikroTik router is protected against OSI Layer 4 attacks while minimizing latency for legitimate traffic?
  • A. Implementing deep packet inspection on all traffic
  • B. Configuring rate limiting for specific services Correct answer
  • C. Blocking all traffic except for necessary ports
  • D. Enabling logging for all incoming connections

By configuring rate limiting for specific services, the MikroTik router can effectively mitigate Layer 4 attacks such as SYN floods, while allowing legitimate traffic to pass without significant latency or disruption.

What are effective strategies for securing a MikroTik router from OSI Layer 7 attacks, especially when bandwidth is limited?
  • A. Implement application layer firewalls Correct answer
  • B. Use deep packet inspection (DPI) Correct answer
  • C. Allow unrestricted web traffic to enhance performance
  • D. Increase bandwidth to mitigate all threats

Application layer firewalls provide filtering and monitoring for web-based threats, while deep packet inspection helps detect and block malicious payloads. Allowing unrestricted web traffic increases risk, and simply increasing bandwidth does not prevent attacks.

MNDP operates on UDP port 5678 and broadcasts router identity and version information to the local network.
  • A. True Correct answer
  • B. False

MNDP (MikroTik Neighbor Discovery Protocol) uses UDP port 5678 to broadcast information about the router, including its system identity, platform type, RouterOS version, and configured IP addresses. This information is sent as broadcast frames to all devices on the local network segment.

Cryptography

The wireless security mode that utilizes pre-shared key (PSK) authentication and AES encryption among the options provided is:
  • A. WEP
  • B. WPA
  • C. WPA2 Correct answer
  • D. WPA3

WPA2 uses pre-shared key (PSK) authentication and AES encryption as its standard configuration for securing wireless networks. AES provides strong encryption, and WPA2-PSK is widely used in home and small business environments. WEP uses a weaker RC4 algorithm, WPA (original) can use TKIP, and WPA3 introduces more advanced authentication methods.

Which wireless security mode relies on a password (PSK) and TKIP encryption for authentication?
  • A. WEP
  • B. WPA Correct answer
  • C. WPA2
  • D. WPA3

WPA (Wi-Fi Protected Access) with PSK (Pre-Shared Key) uses a password for authentication and TKIP (Temporal Key Integrity Protocol) for encryption. This combination was introduced to improve security over WEP without requiring new hardware. WPA2 and WPA3 use stronger encryption methods, and WEP does not use TKIP.

You are tasked with securing a MikroTik router that handles sensitive financial data. Which cryptographic practices should be employed to mitigate risks of data breaches and ensure compliance with data protection regulations?
  • A. Use TLS for all management interfaces Correct answer
  • B. Disable all encryption for performance
  • C. Regularly update cryptographic algorithms to current standards Correct answer
  • D. Use weak passwords for administrative access

Using TLS for management interfaces encrypts data in transit, protecting against interception. Regular updates to cryptographic algorithms ensure compliance with current security standards. Disabling encryption or using weak passwords significantly increases the risk of data breaches.

Securing the Router

What protocol is utilized for securing remote file transfers in MikroTik routerOS?
  • A. SSH Correct answer
  • B. Telnet
  • C. FTP

SSH (Secure Shell) is used to secure remote file transfers in MikroTik RouterOS because it encrypts both authentication and data transfer, protecting credentials and file contents from interception. Protocols like FTP and Telnet transmit data in plain text, making them insecure for remote file transfers. RouterOS supports secure file transfer via SCP or SFTP, both of which operate over SSH.

Your organization needs to implement a secure method for transferring files over the internet using MikroTik devices. Which cryptographic technologies should be utilized to ensure confidentiality and integrity of the transmitted files?
  • A. SFTP using SSH for secure file transfer Correct answer
  • B. FTP without encryption
  • C. Using GPG for encrypting files before transfer Correct answer
  • D. HTTP for transferring files

SFTP provides secure file transfer over SSH, ensuring confidentiality. GPG can be used to encrypt files prior to transfer, maintaining data integrity and confidentiality. FTP and HTTP do not provide encryption, making them insecure options.

What is the default port number used by MikroTik WinBox for management connections?
  • A. 22
  • B. 443
  • C. 8291 Correct answer
  • D. 8728

Option C is correct because MikroTik WinBox uses TCP port 8291 by default for its proprietary management protocol. Port 22 (A) is used by SSH, port 443 (B) is used by HTTPS web management, and port 8728 (D) is the API service port.

Secure Tunnels

The VPN protocol that uses SSL/TLS encryption among the options provided is:
  • A. PPTP
  • B. L2TP
  • C. SSTP Correct answer
  • D. IPSec

SSTP (Secure Socket Tunneling Protocol) uses SSL/TLS to encrypt VPN traffic, allowing it to traverse firewalls and NAT devices by encapsulating PPP traffic over HTTPS (TCP port 443). This protocol leverages the security and encryption features of SSL/TLS, which are widely used for securing web traffic. The other protocols listed do not use SSL/TLS for encryption.

The VPN protocol used to secure point-to-point connections in MikroTik RouterOS is:
  • A. PPTP
  • B. L2TP
  • C. IPSec Correct answer
  • D. OpenVPN

IPSec is used in MikroTik RouterOS to secure point-to-point connections by providing encryption and authentication at the IP layer. It is a protocol suite designed specifically for securing IP communications, making it the standard for VPN security. While PPTP, L2TP, and OpenVPN can all be used to create VPN tunnels, only IPSec provides the actual encryption and security for the data in transit in a point-to-point VPN setup.

Free Study Guide

Read the free MikroTik MTCSE study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More MikroTik Practice Exams

All MikroTik practice exams →

Practise with realistic mock exams to prepare for your MikroTik certification.