MikroTik Updated MTCNA Exam Questions and Answers by efan

The redirect action is only valid in the dstnat chain. It is used to redirect traffic to a service running on the router itself (e.g., redirecting HTTP to a local proxy server).

A.✘srcnat – Not compatible with redirect

B.✘forward – Redirect doesn’t apply in this chain

C.✔dstnat – This is the correct and only supported chain for action=redirect

Extract from Official MTCNA Course Material – NAT Actions:

“The redirect action is used within the dstnat chain to forward packets to the router’s local services.”

Extract from MikroTik Wiki – NAT Rule Actions:

“Redirect is used in dstnat chain and changes destination address to a local router IP and port.”

===========

The hardware-coded address that uniquely identifies a device's network interface card (NIC) on the local network is called a MAC address. It is “burned in” by the hardware manufacturer and remains constant unless manually overridden.

MAC stands for Media Access Control, and it operates at Layer 2 of the OSI model. It is used to identify devices on a local area network.

A. FQDN (Fully Qualified Domain Name) refers to a human-readable name used in DNS.

B. IP Address is a logical address used for routing at Layer 3.

C. Interface Address is a generic term and not a standard identifier.

D. MAC Address is correct and refers to the physical, hardware-encoded address on an interface.

Extract from MTCNA Course Manual – RouterBOARD Overview:

“A MAC address is a globally unique hardware identifier assigned to each Ethernet or wireless interface. It is used by Layer 2 to ensure local delivery.”

René Meneses Study Guide – MAC & OSI Layering:

“The MAC address is a 48-bit physical identifier, hardcoded by the device vendor and located in the NIC chip.”

Terry Combs MTCNA Notes – Layer 2 Concepts:

“MAC = Physical Address = Layer 2 Identifier. It’s what switches use to forward Ethernet frames.”

===========

To route traffic from LAN1 (192.168.0.0/24) behind R1 to LAN2 (192.168.1.0/24) behind R2, R1 must know how to reach the destination network 192.168.1.0/24. The proper way is to add a static route on R1 pointing to the next hop IP address of R2’s interface (192.168.99.2) connected via their shared transit network (192.168.99.0/24).

According to:

René Meneses MTCNA Study Guide – Routing Section:

“A static route requires the destination prefix and the gateway (next-hop) IP address. The gateway should be reachable through a directly connected network interface.”

Terry Combs MTCNA Notes – Static Routing Example:

“To route packets to a remote network, configure a static route specifying the destination network (e.g., 192.168.50.0/24) and the gateway IP (e.g., 10.0.0.2). Ensure that the gateway is reachable via a locally connected interface.”

MikroTik Wiki – Static Routing:

“The most common usage of static routes is to forward packets for destination networks that are not directly connected. You must use the IP address of a reachable next-hop router.”

Option A incorrectly includes src-address, which is not part of a standard /ip route syntax.

Option B uses “Ether1” as a gateway, which is syntactically invalid unless using recursive routing, which this situation does not require.

Option C adds a route back to the local network — unnecessary and incorrect.

Option E routes all traffic to R2, which is inefficient and not specific.

Thus, only Option D adds the correct static route:

/ip route add dst-address=192.168.1.0/24 gateway=192.168.99.2

Final Answer: DQUESTION NO: 83 [Bridging]

For a Simple Queue to apply bandwidth restrictions on a bridged interface, the following must be done:

A. Configure an IP address on the bridge interface

B. Use mangle to mark the connections

C. Associate the Simple Queue to the bridge interface

D. Enable 'Use IP Firewall' in bridge settings

Answer: D

By default, RouterOS does not pass traffic on a bridge interface through the firewall or queue system. If you want to apply queueing (Simple Queues or other policies) on a bridge interface, you must enable the bridge to use the IP Firewall.

MTCNA Official Course Material – Bridging & IP Firewall Integration:

“If you want to apply queues or firewall rules to traffic flowing through a bridge, you must enable ‘use-ip-firewall’ under the bridge settings.”

René Meneses MTCNA Guide – Bridge Queuing Section:

“Simple Queues do not affect bridged traffic unless you activate the ‘Use IP Firewall’ setting in bridge configuration. This pushes the packets through the normal firewall and queueing engine.”

MikroTik Wiki – Bridge Settings:

“If use-ip-firewall is enabled, then all bridged traffic is also processed by firewall and queues.”

Options A and C are incorrect because assigning an IP or linking the queue alone does not enforce restrictions at Layer 2.

Option B refers to advanced queueing with mangle + Queue Trees, not Simple Queues.

Final Answer: DQUESTION NO: 84 [QoS (Simple Queues)]

In RouterOS queue configurations the word "total" usually represents:

A. download - upload

B. upload

C. upload + download

D. download

Answer: C

In Simple Queues, MikroTik uses the term “total” to refer to the sum of the incoming and outgoing traffic for a particular target. This includes both upload (TX) and download (RX) traffic.

MTCNA Course Material – Queues Overview:

“Total limit represents the combined limit of upload and download traffic. If both target-upload and target-download are defined, total-limit should be equal or higher.”

René Meneses MTCNA Study Guide – Queues Chapter:

“In Simple Queues, ‘max-limit’ and ‘limit-at’ can be set individually for upload and download, or together as ‘total’ which combines both directions.”

Terry Combs Notes – Queue Definitions:

“Total in RouterOS queues means sum of upload and download. Always consider total bandwidth used in both directions when using ‘total-limit’.”

Therefore, the correct and verified answer is C: upload + download.

In traditional IPv4 subnetting, a /30 is often used to connect two hosts directly, giving two usable IPs. However, MikroTik RouterOS (and as per RFC 3021) supports the use of /31 subnet masks for point-to-point links. A /31 provides exactly two IP addresses — which are both usable — and is ideal for conserving IP space on router-to-router links.

Subnet details for /31:

Total addresses: 2

Usable addresses: 2 (both can be assigned to endpoints, no broadcast)

Evaluation:

A. /31 →✅Supported by MikroTik for point-to-point links (2 hosts only)

B. /29 → Provides 6 usable IPs; more than needed for 2 hosts

C. /32 → Single host only; no communication possible with second device

D. /30 → Valid, but less efficient than /31

MTCNA Course Manual – IP Addressing and Point-to-Point Communication:

“MikroTik RouterOS allows the use of /31 subnets for point-to-point communication. Both IPs are usable.”

René Meneses MTCNA Guide – IP & Routing Concepts:

“For links between exactly two devices, /31 saves address space and is supported by MikroTik.”

Terry Combs Notes – Subnet Efficiency:

“Use /30 or /31 for point-to-point links. MikroTik supports /31 fully, unlike older systems.”

Answer: AQUESTION NO: 17 [Monitoring and Logging]

Which of the following protocols/ports are used for SNMP (Simple Network Management Protocol)?

A. TCP 25

B. TCP 161

C. UDP 162

D. TCP 162

E. TCP 123

F. UDP 161

Answer: C, F

SNMP uses UDP as its transport protocol. The standard ports are:

UDP port 161 → used for SNMP queries (polling)

UDP port 162 → used for SNMP traps (asynchronous alerts)

Incorrect options:

A. TCP 25 → SMTP (email), not related to SNMP

B. TCP 161 → SNMP does not use TCP

D. TCP 162 → Incorrect; SNMP traps use UDP

E. TCP 123 → NTP (Network Time Protocol)

Correct answers:

C. UDP 162✅

F. UDP 161✅

MTCNA Course – Monitoring Tools & SNMP:

“SNMP operates over UDP. Port 161 is used for polling, and port 162 is used for traps.”

René Meneses MTCNA Guide – SNMP Overview:

“SNMP uses UDP 161 and 162 for communication between manager and agents.”

Terry Combs Notes – Protocol and Port Summary:

“Remember: SNMP = UDP 161/162. Do not confuse with TCP-based protocols.”

Answer: C, FQUESTION NO: 18 [RouterOS Introduction]

Which of the following are valid IP addresses?

A. 10.10.14.0

B. 192.168.256.1

C. 192.168.13.255

D. 1.27.14.254

Answer: A, C, D

An IPv4 address is a 32-bit number divided into 4 octets. Each octet must be between 0 and 255.

Let’s evaluate:

A. 10.10.14.0 →✅Valid; .0 is legal, may represent a network or host depending on subnet

B. 192.168.256.1 →❌Invalid; 256 exceeds the max octet value (0–255)

C. 192.168.13.255 →✅Valid broadcast or host IP, depending on subnet

D. 1.27.14.254 →✅All octets are within valid range

MTCNA Training Manual – IP Basics:

“Each octet must be between 0 and 255. Addresses like 192.168.256.1 are invalid.”

René Meneses Guide – Valid IP Criteria:

“Watch for octets above 255 — they are illegal in IPv4.”

Terry Combs Notes – Address Format Validation:

“Decimal format must be checked — 256, 999, or negative values break IPv4 standards.”

Answer: A, C, DQUESTION NO: 19 [Routing]

The network address is:

A. The first address of the subnet

B. The first usable address of the subnet

C. The last address of the subnet

Answer: A

The network address is the first IP address in a subnet. It identifies the entire network segment and cannot be assigned to any host.

For example, in 192.168.1.0/24:

192.168.1.0 → Network Address (non-assignable)✅

192.168.1.1 – 192.168.1.254 → Usable host addresses

192.168.1.255 → Broadcast address

Clarifying:

A. First address of the subnet →✅Correct

B. First usable address →❌That would be second address

C. Last address of the subnet →❌That’s the broadcast

MTCNA Course Manual – Subnet Addressing:

“The first address in a subnet is reserved as the network ID. It cannot be assigned to a host.”

René Meneses Guide – Network and Broadcast Addresses:

“Network address = first IP in block, broadcast = last. Usable range lies in between.”

Terry Combs Notes – Host and Network Addressing:

“Always subtract 2 IPs: one for network and one for broadcast. Never assign .0 (network address) to a host.”