Pass the MikroTik MTCNA - MikroTik Training MTCNA Questions and answers with CertsForce

The PPPoE server functionality in RouterOS relies primarily on the PPP package, which includes support for protocols like PPP, PPPoE, PPTP, L2TP, SSTP, etc. The system package is also always required, as it contains the core OS components.

Option breakdown:

A.✔ppp – Required. Contains all PPP and PPPoE server/client implementations.

B.✘user-manager – Optional. Used for advanced AAA (authentication/accounting), not required for basic PPPoE.

C.✘radius – Optional. Used for external authentication, not essential unless RADIUS integration is needed.

D.✘synchronous – Used for legacy synchronous interfaces (e.g., serial or modem), not for PPPoE.

E.✔system – Required for all RouterOS functions.

Extract from Official MTCNA Course Material – RouterOS Packages:

“To enable PPPoE server functionality, you need the ppp and system packages. Radius and User Manager are optional.”

Extract from René Meneses MTCNA Study Guide – PPPoE Deployment:

“Only the ppp and system packages are strictly required. Additional features like radius are for centralized authentication.”

Extract from MikroTik Wiki – RouterOS Package Descriptions:

“ppp: required for PPP, PPTP, L2TP, PPPoE; system: required core package. user-manager and radius are optional.”

===========

The connect-list in RouterOS is used to define rules for wireless client behavior when connecting to available Access Points. You can define multiple entries in the connect-list, and RouterOS processes them in top-down order. This allows prioritization of APs based on criteria such as SSID, signal strength, and MAC address.

MTCNA Course Material – Wireless Client Settings:

“The connect-list determines the order in which the wireless client will try to associate with Access Points. Entries are processed from top to bottom, allowing prioritized connection attempts.”

René Meneses MTCNA Study Guide – Wireless & Connect-List Section:

“By placing the most preferred AP at the top of the connect-list, you ensure it is attempted first. Reordering entries is used to manage roaming behavior and priority.”

MikroTik Wiki – Wireless Client & Connect List:

“The client will attempt to connect to the first matching entry in the connect list. This means the connect list can be used to define AP priorities.”

Therefore, the statement is true.

Final Answer: BQUESTION NO: 98 [Hotspot]

What configuration is added by /ip Hot-Spot setup command? (Select all that apply)

A. /ip service

B. /ip Hot-Spot user

C. /ip Hot-Spot walled-garden

D. /ip dhcp-server

E. /queue tree

Answer: B, C, D

The /ip hotspot setup command is a wizard used to quickly deploy a HotSpot service on a selected interface. It automatically creates several configurations necessary for a functional HotSpot environment:

Creates a default user in /ip hotspot user

Adds entries in /ip hotspot walled-garden to allow access to login page

Configures a DHCP server on the selected interface if not present

MTCNA Course Material – HotSpot Setup Wizard:

“The hotspot setup creates a user, configures a DHCP server, and sets up walled garden entries. It does not touch system services or create queue trees by default.”

René Meneses MTCNA Guide – HotSpot Setup Section:

“After running hotspot setup, you will find new configurations in /ip hotspot user, /ip hotspot walled-garden, and /ip dhcp-server. The system automatically assigns IP pools and login pages.”

MikroTik Wiki – HotSpot Setup Overview:

“The setup creates a DHCP server, login page, user entry, and basic NAT and walled garden rules.”

Option A: /ip service is unrelated

Option E: /queue tree is not configured by the setup wizard

Final Answer: B, C, DQUESTION NO: 99 [PPP]

What kind of users are listed in the Secrets window of the PPP menu?

A. Hot-Spot users

B. wireless users

C. l2tp users

D. pptp users

E. pppoe users

F. winbox users

Answer: C, D, E

The /ppp secret menu is used in RouterOS to manage usernames and passwords for Point-to-Point Protocol (PPP) based services, including:

PPPoE (Point-to-Point Protocol over Ethernet)

PPTP (Point-to-Point Tunneling Protocol)

L2TP (Layer 2 Tunneling Protocol)

It does not include HotSpot users, wireless clients, or Winbox users.

MTCNA Course Material – PPP User Authentication:

“The PPP secret database stores credentials for services like PPPoE, PPTP, and L2TP.”

René Meneses MTCNA Study Guide – PPP Configuration Section:

“Users for PPP-based protocols are configured under PPP → Secrets. This includes PPPoE, PPTP, and L2TP.”

MikroTik Wiki – PPP Secrets Window:

“Secrets are used to authenticate users for all PPP interfaces. HotSpot users are managed separately under /ip hotspot user.”

Option A: HotSpot users → /ip hotspot user

Option B: Wireless users connect via WPA/802.11 — not listed in PPP

Option F: Winbox users refer to /user under system user management

Final Answer: C, D, EQUESTION NO: 100 [RouterOS Introduction]

Select valid MAC-address:

A. G2:60:CF:21:99:H0

B. 00:00:5E:80:EE:B0

C. AEC8:21F1:AA44:54FF:1111:DDAE:0212:1201

D. 192.168.0.0/16

Answer: B

A valid MAC address must meet the following criteria:

Be 6 bytes (48 bits) in length

Consist of only hexadecimal digits (0–9, A–F)

Written in six groups separated by colons or hyphens (e.g., 00:1A:2B:3C:4D:5E)

MTCNA Course Material – RouterOS MAC Address Basics:

“MAC addresses are 48-bit identifiers written as six pairs of hexadecimal digits. Invalid characters or incorrect length disqualifies an address.”

René Meneses MTCNA Guide – MAC Addressing Section:

“Each MAC is made up of 12 hexadecimal characters (6 octets). If a character like ‘G’ appears, or if it’s longer than 6 bytes, it is invalid.”

MikroTik Wiki – MAC Addressing Rules:

“Valid MAC format: XX:XX:XX:XX:XX:XX using only 0-9 and A-F. 192.168.0.0/16 is an IP subnet, not a MAC.”

Option A: Invalid — “G” and “H” are not hexadecimal characters

Option B: Valid — proper format and hex content

Option C: Invalid — Too long (appears to be IPv6 or malformed)

Option D: Invalid — this is an IP network (CIDR notation), not a MAC

Only Option B is correct.

Subnet masks are used in IP networking to define the boundary between the network portion and the host portion of an IP address. A valid subnet mask must consist of a contiguous block of 1s followed by a contiguous block of 0s in its binary representation.

Let’s analyze the given options:

A. 255.192.0.0– This isnot a standard or valid subnet maskbecause the 1s are not contiguous beyond the second octet. This is typically used in class A subnetting but is not commonly considered valid in CIDR or MTCNA context. While technically binary-valid, it’s not recommended or standard for practical subnetting.

B. 255.255.192.255–Invalid, because the last octet is255, which implies all bits are 1s, but in the third octet only partial bits are set (192is11000000). This breaks the required rule of contiguous 1s followed by contiguous 0s.

C. 192.0.0.0–Invalid, as it doesn’t represent a valid subnet mask.192in the first octet (11000000) followed by zeros is not a valid mask – it's actually a network address, not a subnet mask.

D. 255.255.224.0–Valid subnet mask. This represents/19in CIDR notation. In binary:11111111.11111111.11100000.00000000, which follows the correct rule of contiguous 1s followed by contiguous 0s.

Extract from MTCNA Study Guide by René Meneses:

Subnet masks must be a continuous string of 1s followed by a continuous string of 0s. Any deviation or split between the blocks renders the mask invalid.

Extract from MTCNA Official Course Manual:

Valid subnet masks include values such as 255.0.0.0 (/8), 255.255.0.0 (/16), 255.255.255.0 (/24), and also non-classful masks like 255.255.224.0 (/19) are allowed and used for more flexible subnetting.

Conclusion:Option D is the only one meeting the criteria for a valid subnet mask as taught in the MTCNA curriculum.

===========

To redirect SMTP (port 25) traffic from users to a specific internal or external SMTP server, you must use dst-nat. This modifies the destination address and port to point to the desired mail server.

A.✘passthrough – Allows the packet to be evaluated by other NAT rules; it doesn't alter traffic

B.✔dst-nat – Rewrites destination IP/port; this is what is needed to redirect SMTP to a specific server

C.✘redirect – Sends traffic to the router itself; not suitable for external redirection

D.✘tarpit – Used for slowing down malicious TCP connections, not redirection

Extract from MTCNA Course Material – NAT Types:

“Use dst-nat to change the destination IP address. This is suitable for port forwarding or service redirection.”

Extract from René Meneses Study Guide – NAT Rules:

“To redirect traffic to a specific server, use action=dst-nat and specify the new destination address.”

===========

An IP packet contains two critical IP addresses in its header:

Source IP address – the IP of the sending host

Destination IP address – the IP of the receiving host

These addresses allow routers to forward the packet from source to destination over Layer 3 (Network Layer).

Other values in the IP header include TTL, protocol type, and checksum — but not additional IP addresses.

A. 4 →❌Incorrect. Only 2 IPs are included

B. 2 →✅Correct: Source and Destination

C. 3 →❌Some protocols like NAT may temporarily associate more addresses, but not in header

D. 1 →❌Incomplete

MTCNA Course Manual – IP Packet Structure:

“An IP packet always contains a source and destination IP address in the Layer 3 header. This allows routing to function across networks.”

René Meneses Guide – Packet Flow:

“IP headers are designed to carry the minimal information necessary for routing. That includes the source and destination IPs.”

Terry Combs Notes – Header Fields:

“Two IPs: one for sender, one for receiver. That’s all you’ll find in the IP header.”

Answer: BQUESTION NO: 21 [Routing]

When viewing the routes in Winbox, some routes will show "DAC" in the first column. These flags mean:

A. Dynamic, Active, Console

B. Dynamic, Active, Connected

C. Direct, Available, Connected

D. Dynamic, Available, Created

Answer: B

MikroTik’s RouterOS assigns flags to routing table entries to describe how they were created and their status.

D = Dynamic (added automatically by the system)

A = Active (currently used by RouterOS)

C = Connected (directly connected subnet or interface)

Thus, "DAC" means:

→ Dynamic, Active, Connected✅

Other flags that may appear include:

S = Static (manually added)

R = RIP

O = OSPF

B = BGP

MTCNA Course Manual – Routing Flags:

“DAC means that the route is dynamically added by the system, is currently active, and is directly connected to the device.”

René Meneses MTCNA Guide – Routing Table Interpretation:

“Flags help identify how the route was installed and its type. DAC is common for directly connected interfaces.”

Terry Combs Notes – Route Flags Table:

“DAC = Dynamic + Active + Connected. Usually appears after setting IP address on interface.”

Answer: BQUESTION NO: 22 [RouterBOARD Hardware]

In which situations Netinstall can not be used to install RouterOS on a RouterBOARD?

A. The router is connected only to a secondary Ethernet port

B. The router does not have an operating system

C. The router is connected only to a wireless network

D. The password of the router is not known

Answer: C

Netinstall is a MikroTik utility used to reinstall or upgrade RouterOS. It requires a direct Ethernet connection to the router’s first Ethernet port and works via PXE (boot over Ethernet). It cannot function over wireless.

Let's review the options:

A. The router is connected only to a secondary Ethernet port →❌Netinstall works if booted over that port

B. The router does not have an operating system →❌This is the purpose of Netinstall

C. The router is connected only to a wireless network →✅Correct: Netinstall requires a wired Ethernet connection

D. The password of the router is not known →❌Netinstall bypasses current OS; password irrelevant

MTCNA Course Manual – RouterBOARD Recovery and Netinstall:

“Netinstall must be done over a wired Ethernet connection. Wireless booting is not supported.”

René Meneses Guide – System Recovery:

“Netinstall needs Layer 2 communication via Ethernet. It cannot operate over Wi-Fi.”

Terry Combs Notes – Netinstall Limitations:

“Netinstall does not support Wi-Fi. Must connect via Ethernet to first interface, preferably.”

Answer: CQUESTION NO: 23 [DHCP]

DHCP server is configured on a router’s ether1 interface. IP address 192.168.0.100/24 is assigned to the interface. Possible IP pools, that can be used by this DHCP server, are:

A. 192.168.0.1–192.168.0.255

B. 192.169.0.1–192.169.0.254

C. 192.168.0.1–192.168.0.99, 192.168.0.101–192.168.0.254

D. 192.168.0.1–192.168.0.14

Answer: C

The router’s interface IP is 192.168.0.100/24 → which belongs to the subnet 192.168.0.0–192.168.0.255.

However, 192.168.0.100 is already assigned to the router. So, this IP must be excluded from the DHCP pool to avoid conflicts.

C offers two valid ranges excluding .100:→ 192.168.0.1–192.168.0.99→ 192.168.0.101–192.168.0.254

Let’s evaluate other options:

A. 192.168.0.1–192.168.0.255 →❌Includes broadcast (.255) and router IP (.100) → Invalid

B. 192.169.0.1–192.169.0.254 →❌Completely wrong subnet

D. 192.168.0.1–192.168.0.14 →✅Valid but unnecessarily small

MTCNA DHCP Chapter – Address Pools:

“Make sure the pool does not include the router’s IP or the network’s broadcast address. Common errors involve overlapping pools.”

René Meneses MTCNA Guide – DHCP Configuration:

“Exclude the router’s own IP from the range. Use address pools below and above the assigned IP.”

Terry Combs Notes – DHCP Pool Tips:

“Split the pool to avoid assigning the interface IP to clients. Also avoid .0 and .255.”

To configure a MikroTik wireless interface as a basic access point (AP), the minimum required parameters are:

Mode → Must be set to ap-bridge or bridge

SSID → Defines the wireless network name to broadcast

Band → Determines which frequency ranges are used (e.g., 2.4GHz b/g/n or 5GHz a/n/ac)

Frequency → Specifies the actual channel used for broadcasting

Options reviewed:

A. radio name →✘Optional. A cosmetic label used to identify the radio in Winbox.

B. scan-list →✘Optional. Used to define which frequencies the interface should scan.

C.✔Required

D.✔Required

E.✔Required

F. DFS mode →✘Optional and auto-configured based on regulatory domain.

G. WDS →✘Only needed for bridging or extending networks.

Extract from Official MTCNA Course Material – Wireless Configuration:

“The minimal settings to enable an Access Point include: mode, SSID, band, and frequency. Without these, the interface won’t broadcast.”

Extract from René Meneses Study Guide – Wireless Basics:

“To turn on an AP: Set the mode to ap-bridge, define SSID, band, and frequency. Other settings are optional or advanced.”

Extract from Terry Combs Notes – Wireless Setup:

“Essential: mode, frequency, SSID, band. Others like WDS and DFS are situational.”

===========

RouterBOARD devices (such as RB1000) typically do not have a battery-backed hardware clock (RTC). This means the system time resets after each reboot. To keep time accurate, you must configure the router to synchronize with an external NTP (Network Time Protocol) server.

A.✘Inefficient and non-scalable solution.

B.✘The /system ntp server is used to act as an NTP server for others — not for receiving time.

C.✔Correct – You must enable /system ntp client and point to a reachable NTP server to get the correct time on boot.

D.✘Irrelevant – RouterBOARDs do not have CMOS batteries for timekeeping like traditional PCs.

Extract from MTCNA Course Material – Time Synchronization:

“To maintain correct system time, configure NTP client to sync with a public or internal time server after reboot.”

Extract from René Meneses Study Guide – Clock and Scheduler:

“RouterBOARD devices don’t have battery-backed RTC. Use the NTP client to update time after reboot.”

Extract from MikroTik Wiki – NTP Setup:

“Use /system ntp client to sync time. /system clock alone will reset on reboot without NTP.”

===========

Setting "forwarding=no" on a wireless interface prevents communication between connected clients on that interface and between that interface and other interfaces in the same bridge. This means:

Stations connected to wlan1 cannot talk to each other

Stations on wlan1 cannot talk to stations on wlan2 (even if bridged)

Stations on wlan2 can talk to each other normally

Evaluation:

A.✅Correct – forwarding=no does not affect wlan2

B.❌Incorrect – forwarding=no blocks this

C.✅Correct – clients on wlan1 cannot talk to each other either

D.❌Bridge filters can be used but this scenario is about forwarding settings

E.❌Blocked by forwarding=no

MTCNA Wireless Module – Wireless Forwarding Behavior:

“Forwarding=no disables client-to-client communication on the interface and across bridges.”

René Meneses Study Guide – Wireless Access Config:

“Use forwarding=no to isolate clients on the same AP. Affects bridging too.”

Terry Combs Notes – Wireless Isolation:

“Setting forwarding=no isolates all clients on that wireless card.”

Answer: A, CQUESTION NO: 81 [Wireless]

Consider a wireless access point with mode=ap-bridge. What is the maximum number of concurrent clients that can connect to it?

A. 2007

B. 2012

C. 2048

D. 1024

Answer: C

In MikroTik RouterOS, the theoretical maximum number of clients that can associate with an AP in ap-bridge mode is 2048. However, practical limits depend on hardware performance and network stability, and most real-world setups use far fewer clients.

Let’s review:

A. 2007 →❌Close, but not the actual hard limit

B. 2012 →❌Incorrect

C.✅2048 → Correct per MikroTik’s AP mode specification

D. 1024 →❌Lower than the actual maximum

MTCNA Wireless Module – AP Behavior:

“In ap-bridge mode, the maximum theoretical client limit is 2048. Actual stable operation may be lower.”

René Meneses Guide – Wireless Scaling:

“2048 is the upper limit for client associations on a MikroTik AP in bridge mode.”

Terry Combs Notes – Client Capacity:

“2048 clients = maximum. Performance may degrade before that in high-traffic environments.”

PAT (Port Address Translation) is a subtype of NAT that maps multiple private IP addresses to a single public IP address using different port numbers. It is the most common form of NAT used in home and business networks to allow multiple internal hosts to access the internet using one public IP address.

MTCNA Course Material – NAT Concepts:

“PAT (also known as NAT overload) allows multiple devices to share a single public IP address. It uses different port numbers to distinguish sessions.”

Cisco IOS NAT Configuration Guide:

“PAT translates multiple local IP addresses to one public IP address by assigning different port numbers to each session.”

Other options:

A: Generic term — not specific enough

B: Static NAT maps one private IP to one public IP

C: Dynamic NAT maps private IPs to a pool of public IPs, not one-to-many

Final Answer: DQUESTION NO: 149 [IPv6 – Addressing Standards]

How long is an IPv6 address?

A. 32 bits

B. 128 bytes

C. 64 bits

D. 128 bits

Answer: D

IPv6 addresses are 128 bits in length, represented as eight groups of four hexadecimal digits separated by colons (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). This allows for a vastly larger address space compared to IPv4 (32 bits).

MTCNA Course Material – IPv6 Basics:

“An IPv6 address is 128 bits long, providing 3.4×10^38 possible addresses. It is written in hexadecimal format.”

René Meneses MTCNA Study Guide – IPv6 Addressing:

“IPv6 = 128 bits, not bytes. Address includes a 64-bit network prefix and 64-bit interface identifier.”

Other options:

A: 32 bits is IPv4

B: 128 bytes = 1024 bits — incorrect

C: 64 bits = only half of an IPv6 address

Final Answer: DQUESTION NO: 150 [IP Addressing – Subnetting]

How many usable IP addresses are there in a 23-bit (255.255.254.0) subnet?

A. 512

B. 510

C. 508

D. 254

Answer: B

A /23 subnet provides 2^9 = 512 total addresses.

Subtract 2 (network address + broadcast address)

512 – 2 = 510 usable IP addresses

MTCNA Course Material – Subnet Calculations:

“For any subnet, usable hosts = 2^(32 – subnet mask bits) – 2.”

René Meneses MTCNA Study Guide – IP Subnetting:

“/23 provides 512 total addresses; usable = 510 after subtracting network and broadcast.”

Option Breakdown:

A: Total addresses (512)

B:✔Usable addresses (510)

C: Incorrect (508 is for /23 minus 4 — not relevant here)

D: 254 is usable for /24