MikroTik MTCSWE (Certified Switching Engineer) Exam Guide

The MikroTik MTCSWE validates associate-level skills in RouterOS Layer 2 forwarding, bridging, VLANs, STP, link aggregation, QoS, Layer2 security, PoE, SwOS, and Layer2 troubleshooting.

Certification Overview

  • Exam name: MTCSWE
  • Vendor: MikroTik
  • Exam code: mtcswe
  • Duration: 60 minutes
  • Total questions: 25
  • Passing score: 60%

About This Certification

The MikroTik Certified Switching Engineer (MTCSWE) certification validates associate-level capability to implement and manage Layer2 forwarding using MikroTik solutions. It focuses on RouterOS Layer2 forwarding behavior, RouterOS bridge features, and RouterBOARD hardware switch chip capabilities, including differences between basic switch chips and advanced switch chips used in Cloud Router Switch (CRS) series devices. It also covers interface settings, MAC learning in bridges and switches, and handling unicast, multicast, and broadcast traffic. The certification includes MTU-related operation in Layer2 environments, including MTU and L2 MTU concepts, jumbo frames, and common MTU mismatch scenarios. Candidates are expected to understand how MTU considerations interact with RouterOS bridge configuration and how to identify potential MTU issues in switched networks. VLAN implementation is a major area, covering IEEE 802.1Q and 802.1ad tagging concepts, RouterOS VLAN interfaces, and VLANs on both bridge interfaces and switch chips. This includes port-based VLAN (VLAN bridging), inter-VLAN routing using a “router on a stick” approach, and advanced classification methods such as MAC-based VLAN and protocol-based VLAN. QinQ (802.1ad) is included, with implementation using bridge VLAN filtering as well as implementation using VLAN interfaces. Spanning Tree topics cover STP concepts, bridge priority, port path cost, and comparison of STP and RSTP. Multiple Spanning Tree (MSTP) is included, including MSTP definition, MSTP regions, CST/CIST behavior, and BPDU (bridge protocol data unit) operation, along with spanning tree security considerations such as BPDU guard. The scope also includes link aggregation using RouterOS bonding, bonding modes, and interoperability considerations with other static link aggregation implementations. Port isolation is covered through RouterOS bridge horizon and switch port isolation. Layer2 QoS includes 802.1p, RouterOS bridge filter priority, CRS priority configuration, traffic shaping, bandwidth limiting in a bridge using queues, and bandwidth limiting in the switch chip. Layer2 security capabilities span IGMP snooping, DHCP snooping, loop protect, traffic storm control, Layer2 firewalling, RouterOS bridge filter features, switch access control list usage, ARP modes, port security, 802.1X, and broader switch security controls. Power over Ethernet (PoE) topics include RouterOS PoE modes and compatibility, PoE priority settings, and PoE monitoring. Operational tooling includes Layer2 diagnostic tools and port mirroring. The certification also covers SwitchOS (SwOS), including an introduction to SwOS, RouterBOARD dual-boot compatibility, installing and managing SwOS, and configuring Layer2 features in SwOS such as VLANs, (R)STP, port trunking, QoS, and Layer2 security.

Who Should Take This Exam?

Network Engineer, Network Technician, Network Administrator, NOC Technician, Systems Administrator, ISP Engineer, Field Network Engineer, Data Center Technician

Prerequisites

MTCNA certification or equivalent foundational MikroTik RouterOS and basic Layer2 networking knowledge (bridging, switching, VLAN fundamentals).

Topics Covered

  • Topics to be announced

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • True / False

MTCSWE Practice Questions

Our question bank contains 463+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomized questions from our full question bank.

Introduction

In RouterOS, which type of interface creates a single Layer 2 broadcast domain from multiple physical ports?
  • VLAN interface
  • Bonding interface
  • Bridge interface
  • EoIP tunnel
MikroTik Cloud Router Switch (CRS) series devices are distinguished from other RouterBOARD products primarily by their inclusion of which component?
  • Dual-core ARM CPU
  • Advanced switch chip with hardware offloading
  • Built-in wireless module
  • Redundant power supply
When a MikroTik bridge learns a new source MAC address from an incoming frame, where does it store this information?
  • In the ARP table
  • In the routing table
  • In the IP firewall address list
  • In the bridge host table

MTU

What is the default L2MTU value for standard Ethernet interfaces on MikroTik RouterOS devices?
  • 1500 bytes
  • 1518 bytes
  • 9000 bytes
  • 1522 bytes
In RouterOS, what does the L2MTU value represent?
  • The maximum size of the IP payload that can be transmitted
  • The maximum size of the complete Ethernet frame excluding the FCS that an interface can send
  • The maximum number of Layer 2 frames that can be queued on an interface
  • The maximum size of the MAC header including VLAN tags
Why is the L2MTU value important when configuring VLANs on a MikroTik bridge?
  • VLAN tagging adds 4 bytes to each frame, so the L2MTU must be large enough to accommodate the original frame plus the tag
  • VLANs require the L2MTU to be set to exactly 9000 bytes
  • The L2MTU determines how many VLANs can be configured on a single interface
  • VLAN filtering only works when the L2MTU is disabled

VLANs

What is the IEEE standard that defines VLAN tagging for Ethernet frames?
  • 802.3
  • 802.1Q
  • 802.11
  • 802.1X
In RouterOS, which menu path is used to configure bridge VLAN entries when VLAN filtering is enabled?
  • /interface vlan
  • /interface bridge filter
  • /interface bridge vlan
  • /ip address vlan
What is the purpose of the PVID (Port VLAN ID) setting on a RouterOS bridge port?
  • It specifies the VLAN ID assigned to untagged frames received on that port
  • It defines the maximum number of VLANs allowed on the port
  • It sets the port's STP priority value
  • It determines which VLAN tags are stripped on egress

Spanning Tree Protocol

What is the primary purpose of the Spanning Tree Protocol (STP) in a switched network?
  • To encrypt traffic between switches
  • To prevent Layer 2 loops by blocking redundant paths while maintaining backup connectivity
  • To assign IP addresses to bridge ports
  • To filter VLAN tags on trunk ports
What is the default bridge priority value in RouterOS when a new bridge is created?
  • 0
  • 4096
  • 32768
  • 65535
Which STP port role is assigned to the port that provides the best path to the root bridge?
  • Designated port
  • Alternate port
  • Backup port
  • Root port

Link Aggregation

What is the primary purpose of Link Aggregation (bonding) in RouterOS?
  • To encrypt traffic between two switches
  • To combine multiple physical links into a single logical interface for increased bandwidth and redundancy
  • To create VLANs across multiple switches
  • To enable routing between different subnets
In RouterOS, which menu is used to create a bonding interface for link aggregation?
  • /interface bonding
  • /interface bridge bond
  • /interface link-aggregation
  • /interface etherchannel
Which RouterOS bonding mode uses the IEEE 802.3ad standard (LACP) for dynamic link aggregation?
  • balance-rr
  • active-backup
  • 802.3ad
  • balance-xor

Port Isolation

What is the primary purpose of port isolation (private VLAN) on a RouterOS bridge?
  • To encrypt traffic between bridge ports
  • To prevent direct Layer 2 communication between specific bridge ports while still allowing them to communicate through a designated uplink port
  • To assign different IP addresses to each bridge port
  • To enable load balancing across multiple bridge ports
In RouterOS, which bridge port setting is used to configure port isolation by grouping ports with a shared uplink?
  • port-group
  • horizon
  • isolation-id
  • private-vlan
How does the 'horizon' setting work for port isolation on a RouterOS bridge?
  • Ports with the same non-zero horizon value cannot forward traffic to each other, while ports with horizon=none (the default) can communicate with all ports
  • Ports with different horizon values are grouped together and can communicate freely
  • Horizon creates VLAN tags on outgoing frames to isolate traffic
  • Horizon limits the number of MAC addresses that can be learned on a port

QoS

What does QoS (Quality of Service) primarily control in a network switch?
  • The encryption strength of network traffic
  • The prioritization and handling of network traffic to ensure critical traffic receives preferential treatment during congestion
  • The physical speed of the network interfaces
  • The number of VLANs that can be configured on a switch
In RouterOS, which field in an 802.1Q VLAN tag is used to carry QoS priority information?
  • VLAN ID field
  • PCP (Priority Code Point) field, also known as the 802.1p priority bits
  • EtherType field
  • DEI (Drop Eligible Indicator) field
How many priority levels does the 802.1p PCP field support in VLAN-tagged frames?
  • 4 (values 0-3)
  • 8 (values 0-7)
  • 16 (values 0-15)
  • 64 (values 0-63)

Layer 2 Security

What is the primary purpose of DHCP snooping on a RouterOS bridge?
  • To increase DHCP lease assignment speed
  • To protect against rogue DHCP servers by filtering DHCP server responses on untrusted ports
  • To assign static IP addresses to all bridge ports
  • To encrypt DHCP traffic between client and server
What does IGMP snooping do on a RouterOS bridge?
  • It blocks all multicast traffic on the bridge
  • It monitors IGMP messages to learn which ports have multicast group members, forwarding multicast only to those ports instead of flooding to all
  • It encrypts multicast traffic to prevent eavesdropping
  • It converts multicast traffic to unicast for better performance
What is the purpose of Loop Protect on a RouterOS bridge?
  • To prevent routing loops between different subnets
  • To detect and react to Layer 2 loops by sending special frames and disabling ports that receive their own loop protect frames back
  • To limit the number of MAC addresses on each port
  • To enable STP on all ports automatically

Power over Ethernet (PoE)

What is the maximum power per port that IEEE 802.3af (PoE) can deliver?
  • 15.4 W
  • 30 W
  • 60 W
  • 90 W
A MikroTik CRS switch port is configured for PoE output but the connected device does not power on. The PoE status shows 'waiting-for-load'. What is the most likely cause?
  • The port's PoE priority is set too low
  • The connected device is not a valid PoE PD — the switch's detection phase did not find a valid signature resistance
  • The switch's total PoE budget has been exceeded
  • The Ethernet cable is longer than 50 meters
On a MikroTik CRS3xx switch, which setting controls whether a PoE port uses 802.3af/at auto-detection or forces power on regardless of PD detection?
  • poe-priority
  • poe-voltage
  • poe-out (auto-on / forced-on / off)
  • poe-budget

Tools

Which RouterOS tool provides a real-time display of traffic passing through an interface, broken down by protocol and source/destination?
  • Packet Sniffer
  • Torch (/tool torch)
  • Bandwidth Test
  • Netwatch
An administrator wants to diagnose packet loss on a specific VLAN between two MikroTik switches. Which tool is most appropriate for capturing and analyzing the actual frames on the bridge port?
  • Torch — it shows per-flow traffic rates which reveal where loss occurs
  • Bandwidth Test — it measures throughput and reports packet loss percentage
  • Packet Sniffer (/tool sniffer) — it captures raw frames for detailed analysis, optionally filtered by VLAN ID
  • Cable Test — it checks the physical layer for faults that cause loss
What does the cable test feature on a MikroTik CRS switch report for each pair of an Ethernet cable?
  • The data throughput capacity of each pair in Mbps
  • The status of each pair (open, short, or OK) and the estimated cable length to the fault
  • The VLAN assignment and PoE power delivery status of each pair
  • The electromagnetic interference level on each pair in decibels

SwOS

How is a MikroTik switch running SwOS primarily configured?
  • Through a command-line interface accessed via SSH
  • Through a web browser interface — SwOS provides a web-based management GUI
  • Through WinBox only — SwOS does not support any other management method
  • Through SNMP SET commands exclusively
Which MikroTik product line is designed to run SwOS as its primary operating system?
  • The CRS (Cloud Router Switch) series
  • The CCR (Cloud Core Router) series
  • The CSS (Cloud Smart Switch) series, formerly known as the SwOS switch line
  • The hAP (home Access Point) series
What is a key difference between SwOS and RouterOS on MikroTik switch hardware?
  • SwOS provides only Layer 2 switching features with a simple web interface, while RouterOS offers full routing, firewall, and advanced configuration via CLI and WinBox
  • SwOS supports more VLANs than RouterOS
  • SwOS includes a built-in firewall while RouterOS does not support bridge-level filtering
  • SwOS requires a license key while RouterOS is free on all MikroTik hardware

Frequently Asked Questions

How many questions are on the exam?

The MTCSWE exam contains 25 questions.

What is the passing score?

You need 60% to pass.

How long is the exam?

You have 60 minutes to complete the exam.

Practice with realistic mock exams to prepare for your MikroTik certification.

This platform provides independent practice questions and mock exams. It is not affiliated with, endorsed by, or sponsored by any certification vendor. All trademarks, certification names, and exam codes are the property of their respective owners and are used for identification purposes only.