MikroTik Updated MTCNA Exam Questions and Answers by lula

The action=masquerade is used exclusively in the srcnat chain. It dynamically hides internal IP addresses behind the router's public IP. It cannot be used in the dstnat chain.

A.✘Incorrect – masquerade is not allowed in dstnat regardless of parameters.

B.✘Incorrect – masquerade is not valid in the dstnat chain.

C.✘Incorrect – masquerade does not operate in dstnat, direction does not change this.

D.✔Correct – masquerade must only be used in chain=srcnat.

Extract from MTCNA Course Material – NAT Concepts:

“Masquerade is a special type of source NAT used only in the srcnat chain. It is invalid in dstnat.”

Extract from René Meneses Study Guide – NAT Actions:

“Use action=masquerade in chain=srcnat. RouterOS will not accept it in dstnat.”

Extract from MikroTik Wiki – NAT Rules:

“action=masquerade is not allowed in dstnat chain and will result in error if applied.”

===========

DNS primarily uses UDP port 53 for most query/response operations. However, TCP port 53 is also used, particularly for larger responses (such as DNS zone transfers or DNSSEC).

A.✔UDP – Used for standard DNS queries due to lower overhead.

B.✔TCP port 53 – Used when UDP is insufficient, especially for zone transfers (AXFR/IXFR).

Extract from MTCNA Course Material – DNS and Networking Services:

“DNS typically uses UDP/53, but falls back to TCP/53 for larger queries or zone transfers.”

Extract from MikroTik Wiki – DNS Settings:

“DNS uses UDP for general queries. TCP is used when UDP cannot accommodate the size of the response.”

===========

In the PPP > Active Connections window in RouterOS, the letter "R" in the "Flags" column indicates the session is Running. This means the session is active and fully negotiated.

A.✘Radius – Not what "R" stands for in this context

B.✔Running – The connection is established and currently operating

C.✘Remote – Not relevant in this context

Extract from MTCNA Course Material – PPP Interface Flags:

“R indicates a Running state. The session is successfully established and data can be transmitted.”

Extract from MikroTik Wiki – PPP Flags Reference:

“R = Running. The session is active.”

When using a hub, all connected devices share the total bandwidth. Since it’s a 10 Mbps half-duplex hub, all 10 users share the same collision domain and 10 Mbps. However, when calculating potential access to the server from any single host, each host can use the full 10 Mbps — as long as no other users are transmitting simultaneously.

More importantly, the connection to the server is also 10 Mbps half-duplex, so regardless of the internal collisions, each client could use the full 10 Mbps to the server — just not concurrently with others.

Cisco CCNA Curriculum – Hubs and Bandwidth Sharing:

“In a hub, all ports share bandwidth. However, each host is capable of utilizing the full bandwidth if no contention exists.”

René Meneses MTCNA Study Guide – Hub Limitations:

“A hub provides shared bandwidth, but each device can use the full rate momentarily, assuming no collisions.”

Hence, the correct answer is based on potential — not divided bandwidth.

Final Answer: DQUESTION NO: 146 [Cisco IOS – Configuration Management]

What command is used to create a backup configuration?

A. copy running backup

B. copy running-config startup-config

C. config mem

D. wr mem

Answer: B

The command copy running-config startup-config saves the current active configuration in RAM (running-config) to NVRAM (startup-config). This ensures that the configuration persists after a reboot.

Cisco IOS Configuration Guide – Saving Configs:

“To save the active configuration, use: copy running-config startup-config.”

René Meneses MTCNA Study Guide – IOS Management:

“Saving configuration ensures the device boots with the same settings. Use copy running-config startup-config or its shortcut: wr.”

Breakdown:

A: Invalid syntax — no such keyword as “backup”

C: config mem is outdated and not used in modern IOS

D: wr mem is a shortcut for “write memory” — still valid but less commonly used

Final Answer: BQUESTION NO: 147 [Cisco IOS – Access Control Lists]

What are the two main types of access control lists (ACLs)?

Standard

IEEE

Extended

Specialized

A. 1 and 3

B. 2 and 4

C. 3 and 4

D. 1 and 2

Answer: A

Cisco IOS supports two primary types of ACLs:

Standard ACLs: Filter traffic based only on source IP address

Extended ACLs: Filter traffic based on source, destination IP, protocol type, and port numbers

Cisco IOS Security Guide – ACL Fundamentals:

“Standard ACLs use only source IP for filtering. Extended ACLs can match based on source, destination, ports, and protocols.”

René Meneses MTCNA Study Guide – ACL Types:

“Two types of IP ACLs: standard and extended. IEEE or specialized ACLs do not exist in Cisco terminology.”

Other options:

IEEE: Refers to Ethernet or wireless standards, not ACLs

Specialized: Not a defined ACL type