To block a client’s application traffic (like MSN Messenger) that is passing through the router (from LAN to WAN or vice versa), the forward chain must be used. This chain processes packets that are routed through the router.
Evaluation:
A. static →❌Not a valid firewall chain.
B.✅forward → Correct – used to filter traffic that passes through the router.
C.❌output → Filters traffic originating from the router itself.
D.❌input → Filters traffic destined for the router itself.
MTCNA Firewall Section – Chain Descriptions:
“forward – Used for filtering transit traffic (client to internet or internet to client).”
René Meneses Guide – Firewall Chains:
“To block client application traffic, use the forward chain. Input/output are for local router access.”
Terry Combs Notes – Chain Matching:
“forward = traffic passing through router, like client web or chat traffic.”
Answer: BQUESTION NO: 71 [Routing]
There are two routes in the routing table:
0 dst-addr=10.1.1.0/24 gateway=5.5.5.5
1 dst-addr=10.1.1.4/30 gateway=5.6.6.6
Which gateway will be used to get to the IP address 10.1.1.6?
A. both – half of the traffic will be routed through one gateway, half through the other
B. 5.5.5.5
C. the required route is not in the routing table
D. 5.6.6.6
Answer: D
Routing decisions are made based on the longest prefix match (most specific route).
10.1.1.6 falls within:→ 10.1.1.0/24 → range: 10.1.1.0 – 10.1.1.255 (prefix length: 24)→ 10.1.1.4/30 → range: 10.1.1.4 – 10.1.1.7 (prefix length: 30)
Because /30 is more specific than /24, it will be selected for routing the packet.
MTCNA Routing Module – Prefix Length Decision:
“Router chooses the route with the longest subnet mask (most specific match).”
René Meneses Study Guide – Longest Match Principle:
“10.1.1.6 falls within 10.1.1.4/30 → use gateway 5.6.6.6.”
Terry Combs Notes – Routing Table Resolution:
“Always check if multiple routes match. Use the one with the longest prefix.”
Answer: DQUESTION NO: 72 [Wireless Security]
In order to use dynamic keys in your wireless security profile for an AP, you MUST set up the DHCP server to provide the dynamic keys.
A. true
B. false
Answer: B
MikroTik RouterOS supports dynamic key exchange for wireless networks using WPA/WPA2 (with PSK or EAP). These dynamic keys are not provided by the DHCP server but are instead part of the wireless security profile configured under /interface wireless security-profiles.
DHCP only assigns IP addresses and other network configuration parameters — it does not provide encryption keys.
MTCNA Wireless Security Module – WPA/WPA2 Explained:
“Dynamic keys are negotiated during the WPA/WPA2 authentication process, not via DHCP.”
René Meneses Guide – Wireless Authentication:
“Security profiles define pre-shared or dynamic key exchange (WPA-EAP). DHCP is unrelated.”
Terry Combs Notes – Misconceptions in Wireless Setup:
“DHCP and wireless encryption are separate layers. Keys are not assigned through DHCP.”
Answer: BQUESTION NO: 73 [Firewall / Security]
Which firewall chain should you use to filter SSH access to the router itself?
A. output
B. input
C. prerouting
D. forward
Answer: B
SSH access to the router targets the router itself. Therefore, any packets destined for the router (for example, to TCP port 22) are evaluated in the input chain of the firewall.
Evaluation:
A. output →❌For packets originating from the router, not to it.
B.✅input → Correct – handles traffic destined for the router (like SSH, Winbox, etc.)
C.❌prerouting → Used for NAT and mangle operations, not filtering
D.❌forward → Used for traffic routed through the router (not for router itself)
MTCNA Firewall Section – Chain Functions:
“SSH access to the router is incoming traffic. Use input chain to filter or allow it.”
René Meneses Guide – Access Protection:
“input chain is responsible for traffic to the router’s IP – block/allow SSH, Winbox, etc.”
Terry Combs Notes – Firewall Management:
“Always use input chain for filtering incoming management protocols like SSH.”
