MikroTik MTCTCE Practice Exam

• A. Output
• B. Input
• C. Prerouting
• D. Forward Correct answer

Option D is correct because the forward chain in MikroTik RouterOS processes packets that pass through the router from one interface to another without being destined for the router itself. The input chain (A) handles packets addressed to the router, the output chain (C) handles packets generated by the router, and the prerouting chain (D) processes all incoming packets before the routing decision but is not where transit filtering occurs.

• A. Prerouting Correct answer
• B. Forward
• C. Postrouting
• D. Input

Option A is correct because destination NAT (dstnat) processing occurs in the prerouting chain, before the routing decision. This allows the modified destination address to influence where the packet is routed. Postrouting (B) is where source NAT occurs, while forward (C) and input (D) process packets after the routing decision has already been made.

• A. True
• B. False Correct answer

Destination NAT is processed in the prerouting chain, before the routing decision — not after it. This ordering is essential because dst-nat changes the packet's destination address, which directly affects where the routing decision sends the packet. For example, a port-forwarding rule changes the destination from the router's public IP to an internal server's IP, so the routing decision must happen after this translation to correctly forward the packet inward.

• A. prerouting → routing → forward → postrouting
• B. input → routing → output → postrouting
• C. output → routing → postrouting → interface TX Correct answer
• D. forward → routing → output → interface TX

Option C is correct because packets originating from the MikroTik router itself bypass the input and forward chains entirely. They flow through the output chain (mangle and filter), then a routing decision determines the egress interface, after which the postrouting chain (mangle and srcnat) is applied before the packet exits via the interface TX. Options A and D include forward-chain steps that only apply to transit traffic; option B incorrectly places routing before the output chain.

• A. Step 1 — as soon as the packet arrives on ether2
• B. Step 3 — after the routing decision determines the egress interface
• C. Step 5 — after mangle forward, which runs before the filter forward chain Correct answer
• D. Step 2 — in the mangle prerouting chain before routing

Option C is correct because in MikroTik's forwarded-packet sequence, the filter forward chain runs after the mangle forward chain. As shown in the exhibit's numbered steps, this places the filter forward evaluation at step 5 — after mangle forward has already run. Options A, B, and D place the filter forward chain at earlier positions that precede its actual location in the processing sequence.

• A. passthrough
• B. tarpit
• C. drop Correct answer
• D. reject

Option C is correct because the drop action in MikroTik firewall silently discards the packet without sending any ICMP error or TCP reset to the sender. Reject (A) sends a response indicating the packet was refused, tarpit (C) holds TCP connections open indefinitely, and passthrough (D) counts the packet but continues processing subsequent rules.

• A. invalid
• B. related
• C. established Correct answer
• D. new

Option C is correct because the established connection state in MikroTik indicates a packet that belongs to an already recognized, active connection where the initial handshake has completed. New (A) is for the first packet of a connection, related (B) is for packets associated with but not part of an existing connection, and invalid (D) indicates packets that cannot be identified or are malformed.

• A. passthrough
• B. tarpit Correct answer
• C. drop
• D. reject Correct answer

Options D and B are correct because both reject and tarpit send responses back to the packet sender. Reject sends an ICMP error message (or TCP RST when configured with reject-with=tcp-reset), informing the sender that the connection was refused. Tarpit accepts the TCP connection but sets the window size to zero, trapping the sender's resources. Drop (C) silently discards packets with no response, and passthrough (A) is not a terminating action — it allows the packet to continue to subsequent rules.

• A. True Correct answer
• B. False

MikroTik RouterOS uses a default-accept firewall policy. When a packet traverses an entire chain without matching any rule, it is accepted and allowed to continue. This is different from some other firewall platforms that default to deny. To implement a secure configuration, administrators must explicitly add drop or reject rules at the end of their chains to block unwanted traffic.

• A. Rule 0 — accepts established and related traffic to the router
• B. Rule 4 — accepts established and related forwarded traffic Correct answer
• C. Rule 5 — accepts new connections to the DMZ
• D. Rule 6 — drops traffic from the blocked address list

Option B is correct because the /ip firewall filter print stats output shown in the exhibit displays Rule 4 — which accepts established and related forwarded traffic — with the highest byte and packet counters. On most networks the vast majority of traffic consists of established TCP sessions, so a stateful accept-established rule will accumulate the most matches. Rules handling less frequent traffic types show correspondingly smaller counters.

• A. High Throughput Bridge
• B. Hardware Traffic Buffer
• C. Host Traffic Balancer
• D. Hierarchical Token Bucket Correct answer

Option D is correct because HTB stands for Hierarchical Token Bucket, which is the queuing framework used by MikroTik RouterOS for implementing QoS. HTB allows creating parent-child queue hierarchies where child queues can borrow unused bandwidth from their parent up to the max-limit, while being guaranteed at least their limit-at rate. This enables flexible bandwidth allocation with both guaranteed minimums and burstable maximums.

• A. RED
• B. BFIFO
• C. SFQ Correct answer
• D. PFIFO

Option C is correct because SFQ (Stochastic Fairness Queuing) uses a hashing algorithm to classify packets into different sub-queues based on connection parameters (source/destination address and port). It then services these sub-queues in a round-robin fashion, ensuring that bandwidth is distributed fairly among all active flows. This prevents any single connection from monopolizing the available bandwidth.

• A. parent Correct answer
• B. limit-at
• C. burst-limit
• D. packet-mark or no-mark Correct answer

Options A and D are correct because a queue tree entry requires two essential parameters to function: parent (which defines where the queue attaches in the hierarchy — either a named parent queue or a global interface like 'global') and a traffic selector, which is either a specific packet-mark (assigned by mangle rules) or the special value 'no-mark' to match unmarked traffic. Without a parent, the queue has no position in the hierarchy. Without a packet-mark or no-mark, the queue has no way to identify which traffic to process. limit-at (B) and burst-limit (C) are optional parameters that default to 0 (unlimited).

• A. 2 Mbps
• B. 5 Mbps
• C. 20 Mbps Correct answer
• D. 4 Mbps

Option C is correct because the /queue simple print output shown in the exhibit displays the queue entry for the target host with max-limit=10M/20M. In MikroTik's upload/download notation the second value (20M) is the maximum download speed. Options A and B name values that correspond to other fields such as limit-at; option D does not appear as a download rate in the exhibit.

• A. IP > Services > DNS
• B. System > DNS
• C. Tools > DNS Cache
• D. IP > DNS Correct answer

Option D is correct because MikroTik DNS settings, including the DNS cache, are configured under IP > DNS in Winbox or via /ip dns in the CLI. This menu contains server configuration, static entries, cache settings, and the allow-remote-requests toggle. DNS is not under System (B), IP > Services (C), or Tools (D).

• A. CNAME records that create an alias pointing to another hostname Correct answer
• B. SOA records that define zone authority
• C. A records that map a hostname to an IPv4 address Correct answer
• D. MX records for mail server routing

Options C and A are correct because MikroTik's built-in DNS server supports creating static A records (mapping a hostname to an IPv4 address) and CNAME records (creating an alias that points to another hostname) under /ip dns static. These cover the most common use cases for local DNS resolution and internal hostname management. MikroTik's DNS does not support MX records for mail routing (D) or SOA records for zone authority (B) — it is a caching DNS resolver with static entry support, not a full authoritative DNS server.

• A. Discover, Offer, Request, Acknowledge Correct answer
• B. Discover, Acknowledge, Request, Offer
• C. Discover, Request, Offer, Acknowledge
• D. Request, Discover, Acknowledge, Offer

Option A is correct because the DHCP DORA handshake follows the sequence: Discover (client broadcasts to find servers), Offer (server proposes an IP address), Request (client formally requests the offered address), and Acknowledge (server confirms the assignment). This four-step process uses UDP broadcasts and unicasts to assign IP configurations to clients without prior network addressing.

• A. DHCP Acknowledge
• B. DHCP Offer
• C. DHCP Request Correct answer
• D. DHCP Discover Correct answer

Options D and C are correct because during the initial DORA (Discover-Offer-Request-Acknowledge) process, the client sends two broadcast messages: the DHCP Discover (broadcast to 255.255.255.255 to find available DHCP servers on the network) and the DHCP Request (broadcast to inform all servers which offer was accepted, so non-selected servers can reclaim their offered addresses). The DHCP Offer (B) is sent by the server (unicast or broadcast) in response to Discover, and the DHCP Acknowledge (A) is sent by the server confirming the lease assignment.

• A. 8888
• B. 80
• C. 8080 Correct answer
• D. 3128

Option C is correct because the MikroTik web proxy listens on port 8080 by default. This port is commonly used by HTTP proxy servers. Port 3128 (B) is the default for Squid proxy, port 80 (C) is the standard HTTP port, and port 8888 (D) is another common alternative proxy port. The MikroTik proxy port can be changed in the web proxy settings if needed.

• A. True
• B. False Correct answer

The MikroTik web proxy cannot transparently intercept or cache HTTPS traffic. HTTPS connections are encrypted end-to-end using TLS between the client and the destination server. A transparent proxy cannot decrypt, inspect, cache, or filter the content without breaking the TLS certificate chain, which would cause certificate errors in the client's browser. Only unencrypted HTTP traffic can be transparently proxied and cached.