Free MikroTik MTCNA Practice Exam with Questions & Answers | Set: 3

An IP packet contains two critical IP addresses in its header:

Source IP address – the IP of the sending host

Destination IP address – the IP of the receiving host

These addresses allow routers to forward the packet from source to destination over Layer 3 (Network Layer).

Other values in the IP header include TTL, protocol type, and checksum — but not additional IP addresses.

A. 4 →❌Incorrect. Only 2 IPs are included

B. 2 →✅Correct: Source and Destination

C. 3 →❌Some protocols like NAT may temporarily associate more addresses, but not in header

D. 1 →❌Incomplete

MTCNA Course Manual – IP Packet Structure:

“An IP packet always contains a source and destination IP address in the Layer 3 header. This allows routing to function across networks.”

René Meneses Guide – Packet Flow:

“IP headers are designed to carry the minimal information necessary for routing. That includes the source and destination IPs.”

Terry Combs Notes – Header Fields:

“Two IPs: one for sender, one for receiver. That’s all you’ll find in the IP header.”

Answer: BQUESTION NO: 21 [Routing]

When viewing the routes in Winbox, some routes will show "DAC" in the first column. These flags mean:

A. Dynamic, Active, Console

B. Dynamic, Active, Connected

C. Direct, Available, Connected

D. Dynamic, Available, Created

Answer: B

MikroTik’s RouterOS assigns flags to routing table entries to describe how they were created and their status.

D = Dynamic (added automatically by the system)

A = Active (currently used by RouterOS)

C = Connected (directly connected subnet or interface)

Thus, "DAC" means:

→ Dynamic, Active, Connected✅

Other flags that may appear include:

S = Static (manually added)

R = RIP

O = OSPF

B = BGP

MTCNA Course Manual – Routing Flags:

“DAC means that the route is dynamically added by the system, is currently active, and is directly connected to the device.”

René Meneses MTCNA Guide – Routing Table Interpretation:

“Flags help identify how the route was installed and its type. DAC is common for directly connected interfaces.”

Terry Combs Notes – Route Flags Table:

“DAC = Dynamic + Active + Connected. Usually appears after setting IP address on interface.”

Answer: BQUESTION NO: 22 [RouterBOARD Hardware]

In which situations Netinstall can not be used to install RouterOS on a RouterBOARD?

A. The router is connected only to a secondary Ethernet port

B. The router does not have an operating system

C. The router is connected only to a wireless network

D. The password of the router is not known

Answer: C

Netinstall is a MikroTik utility used to reinstall or upgrade RouterOS. It requires a direct Ethernet connection to the router’s first Ethernet port and works via PXE (boot over Ethernet). It cannot function over wireless.

Let's review the options:

A. The router is connected only to a secondary Ethernet port →❌Netinstall works if booted over that port

B. The router does not have an operating system →❌This is the purpose of Netinstall

C. The router is connected only to a wireless network →✅Correct: Netinstall requires a wired Ethernet connection

D. The password of the router is not known →❌Netinstall bypasses current OS; password irrelevant

MTCNA Course Manual – RouterBOARD Recovery and Netinstall:

“Netinstall must be done over a wired Ethernet connection. Wireless booting is not supported.”

René Meneses Guide – System Recovery:

“Netinstall needs Layer 2 communication via Ethernet. It cannot operate over Wi-Fi.”

Terry Combs Notes – Netinstall Limitations:

“Netinstall does not support Wi-Fi. Must connect via Ethernet to first interface, preferably.”

Answer: CQUESTION NO: 23 [DHCP]

DHCP server is configured on a router’s ether1 interface. IP address 192.168.0.100/24 is assigned to the interface. Possible IP pools, that can be used by this DHCP server, are:

A. 192.168.0.1–192.168.0.255

B. 192.169.0.1–192.169.0.254

C. 192.168.0.1–192.168.0.99, 192.168.0.101–192.168.0.254

D. 192.168.0.1–192.168.0.14

Answer: C

The router’s interface IP is 192.168.0.100/24 → which belongs to the subnet 192.168.0.0–192.168.0.255.

However, 192.168.0.100 is already assigned to the router. So, this IP must be excluded from the DHCP pool to avoid conflicts.

C offers two valid ranges excluding .100:→ 192.168.0.1–192.168.0.99→ 192.168.0.101–192.168.0.254

Let’s evaluate other options:

A. 192.168.0.1–192.168.0.255 →❌Includes broadcast (.255) and router IP (.100) → Invalid

B. 192.169.0.1–192.169.0.254 →❌Completely wrong subnet

D. 192.168.0.1–192.168.0.14 →✅Valid but unnecessarily small

MTCNA DHCP Chapter – Address Pools:

“Make sure the pool does not include the router’s IP or the network’s broadcast address. Common errors involve overlapping pools.”

René Meneses MTCNA Guide – DHCP Configuration:

“Exclude the router’s own IP from the range. Use address pools below and above the assigned IP.”

Terry Combs Notes – DHCP Pool Tips:

“Split the pool to avoid assigning the interface IP to clients. Also avoid .0 and .255.”

AMAC (Media Access Control) addressis aunique identifier assigned to network interfacesfor communications at the data link layer (Layer 2 of the OSI model). A MAC address is:

Always48 bits(6 bytes) long

Represented in12 hexadecimal characters

Grouped into6 pairsseparated by colons or dashes (e.g., 00:1A:2B:3C:4D:5E)

Contains onlyhexadecimal characters (0-9, A-F)

Extract fromRené Meneses MTCNA Study Guide:

“A MAC address is a 48-bit value, represented as 6 groups of two hexadecimal digits (00 to FF). Any character outside this range is not valid. For example, 80:GF:AA:67:13:5D is invalid because ‘G’ is not a valid hexadecimal digit.”

Extract fromTerry Combs MTCNA Notes – MAC Addressing Section:

“Valid MAC addresses contain only 0-9 and A-F. A common mistake in training exams is to insert an invalid character like G or H into a MAC, which instantly makes it incorrect.”

Extract fromMikroTik Wiki – MAC Address Format Page:

“MAC addresses are six octets long and use hexadecimal format only. Hexadecimal numbers go from 0–9 and A–F. If a character appears outside that range, the address is invalid.”

Now let’s evaluate each option:

Option A: 80:GF:AA:67:13:5D❌Contains the letter"G", whichdoes not belong to the hexadecimal system. That makes this addressinvalid.

Option B: 95:B5:DD:EE:78:8A✅All characters are valid hex (9, 5, B, D, E, 7, 8, A)

Option C: 88:0C:00:99:5F:EF✅All valid characters.

Option D: EA:BA:AA:EE:FF:CB✅Hex only — valid.

Option E: 13:16:86:53:89:43✅Also valid hex — no issue.

So,Option A is the only invalid MAC address.

To configure a MikroTik wireless interface as a basic access point (AP), the minimum required parameters are:

Mode → Must be set to ap-bridge or bridge

SSID → Defines the wireless network name to broadcast

Band → Determines which frequency ranges are used (e.g., 2.4GHz b/g/n or 5GHz a/n/ac)

Frequency → Specifies the actual channel used for broadcasting

Options reviewed:

A. radio name →✘Optional. A cosmetic label used to identify the radio in Winbox.

B. scan-list →✘Optional. Used to define which frequencies the interface should scan.

C.✔Required

D.✔Required

E.✔Required

F. DFS mode →✘Optional and auto-configured based on regulatory domain.

G. WDS →✘Only needed for bridging or extending networks.

Extract from Official MTCNA Course Material – Wireless Configuration:

“The minimal settings to enable an Access Point include: mode, SSID, band, and frequency. Without these, the interface won’t broadcast.”

Extract from René Meneses Study Guide – Wireless Basics:

“To turn on an AP: Set the mode to ap-bridge, define SSID, band, and frequency. Other settings are optional or advanced.”

Extract from Terry Combs Notes – Wireless Setup:

“Essential: mode, frequency, SSID, band. Others like WDS and DFS are situational.”

===========

Masquerading is a form of source NAT (src-nat) where the router dynamically replaces the source address of outgoing packets with the IP address of the router’s outgoing interface. This is commonly used when internal LAN clients access the internet through a single public IP.

Key points for masquerade configuration:

Use chain=src-nat (because it modifies the source address)

Use action=masquerade

Specify the out-interface (i.e., the WAN interface)

MTCNA Course Material – NAT Section:

“To configure masquerading, use chain=src-nat and action=masquerade. Specify out-interface to define the traffic direction.”

René Meneses MTCNA Study Guide – NAT Examples:

“Masquerade automatically uses the IP address of the specified out-interface. Required parameters: chain=src-nat, action=masquerade, out-interface.”

MikroTik Wiki – Source NAT / Masquerade:

“Masquerade is a special form of src-nat. You must use it in chain=src-nat and define the out-interface for which NAT will be applied.”

Option A: Incorrect action=accept (used in filter rules, not NAT)

Option C: in-interface is not applicable here

Option D: chain=dst-nat is used for destination NAT, not source NAT

Only Option B is fully correct.

Final Answer: BQUESTION NO: 94 [Tools]

In which situations can Netinstall NOT be used to install a RouterBOARD?

A. The router does not have an operating system

B. The router is connected only to a wireless network

C. You do not know the password of the router

D. The router is connected only to a secondary Ethernet port

Answer: B

Netinstall works over a wired Ethernet connection and uses PXE or Etherboot to install RouterOS over the network. It cannot function over wireless, as wireless interfaces do not support PXE booting or Netinstall protocols.

MTCNA Course Material – Netinstall Overview:

“Netinstall requires a direct Ethernet connection between the PC and the router. Wireless interfaces are not supported for Netinstall procedures.”

René Meneses MTCNA Guide – Netinstall:

“Netinstall only works over Ethernet. You cannot Netinstall a device connected only through Wi-Fi.”

MikroTik Wiki – Netinstall Prerequisites:

“Router must be connected via Ethernet. Wireless and USB interfaces are not supported.”

Other options:

A: This is a typical use case (installing RouterOS when OS is missing)

C: Netinstall bypasses password (not needed)

D: Netinstall can work via any Ethernet port, provided it's accessible

Final Answer: BQUESTION NO: 95 [Monitoring and Logging]

MikroTik RouterOS is sending logs to an external syslog server. Which protocol and port is used by RouterOS for sending logs (by default)?

A. UDP 514

B. UDP 21

C. UDP 113

D. TCP 110

Answer: A

RouterOS uses the industry-standard syslog protocol for remote logging. By default, syslog uses UDP port 514.

MTCNA Course Material – Logging Section:

“For sending logs to a remote syslog server, RouterOS uses the syslog protocol on UDP port 514 by default.”

René Meneses MTCNA Guide – Monitoring & Logging:

“External logging is done using UDP port 514, which is the standard syslog protocol port.”

MikroTik Wiki – Logging Configuration:

“To send logs to a remote server, configure an action of type remote with a remote address and use UDP port 514 unless otherwise changed.”

Other ports:

UDP 21 = FTP (not logging)

UDP 113 = Ident protocol

TCP 110 = POP3

Only UDP 514 is correct.

Final Answer: AQUESTION NO: 96 [RouterBOARD Hardware]

Can you manually add drivers to RouterOS in case your PCI Ethernet card is not recognized, and you suspect it is a driver issue?

A. Yes

B. No

Answer: B

RouterOS is a closed, embedded Linux-based system. It does not support adding custom drivers or compiling modules manually. You must use supported hardware that is natively compatible with RouterOS.

MTCNA Course Material – RouterBOARD Compatibility:

“RouterOS supports a fixed set of drivers. You cannot install third-party drivers or modules.”

René Meneses MTCNA Guide – Hardware Limitations:

“Custom drivers cannot be added to RouterOS. Use only supported network interface cards as listed by MikroTik.”

MikroTik Wiki – Hardware Support:

“RouterOS does not allow manual driver installation. All drivers are precompiled and built into the system image.”

Therefore, if your PCI Ethernet card is not recognized, you must replace it with a compatible model — you cannot add a driver manually.

In this configuration, the wireless interface (wlan1) on the AP is in ap-bridge mode, and on the CPE it's in station-bridge mode. This mode allows full Layer 2 bridging over wireless, supporting all Ethernet-based protocols and services, including:

IPv4, IPv6, DHCP, ARP, PPPoE, and routing protocols like BGP (which use TCP/IP).

Protocols like USB or Firewire are hardware-level or local bus protocols and cannot be transmitted over Ethernet frames or wireless.

Option Review:

A.✔IPv4 – supported

B.✔ARP – Layer 2 protocol, supported

C.✘USB – not a network protocol, not transmitted over bridges

D.✔BGP – Layer 3 protocol, supported over bridged links

E.✘Firewire – not a Layer 2 or network protocol

F.✔IPv6 – fully supported

G.✔DHCP – Layer 3 broadcast protocol, works over bridges

H.✔PPPoE – Ethernet-based protocol, passes over Layer 2 bridge

Extract from Official MTCNA Course Material – Wireless Bridging:

“station-bridge mode allows transparent Layer 2 bridging, supporting all Ethernet protocols including IPv4, IPv6, ARP, DHCP, PPPoE, and more.”

Extract from René Meneses MTCNA Study Guide – Wireless Modes:

“Use station-bridge with ap-bridge to pass full Layer 2 traffic. This allows DHCP, PPPoE, and other protocols to work transparently.”

Extract from MikroTik Wiki – Station Bridge:

“station-bridge mode is used with MikroTik-only links and allows full Layer 2 protocol support, including dynamic IP assignments and bridging.”

Nstreme is a proprietary point-to-point wireless protocol developed by MikroTik to improve performance on long-distance wireless links. It enhances frame aggregation, reduces latency, and replaces standard 802.11 MAC timing behavior with a custom approach. Because of its specific mechanism, it imposes certain compatibility restrictions:

A. WDS between two station-wds devices is not compatible with Nstreme. This setup doesn't conform to proper AP-client architecture required by Nstreme, which operates in a master/slave role — typically ap-bridge and station.

B. Encryption (e.g., using WEP or WPA) is supported in Nstreme; however, MikroTik recommends encryption at higher layers like IPsec when performance is critical.

C. WDS between ap-bridge and station-wds is compatible with Nstreme. This is the standard pairing used when bridging two networks via wireless.

D. Bridging a station with an ap-bridge device using standard station mode (not station-wds or station-bridge) is not compatible for full Layer 2 bridging. Only station-wds or station-bridge supports bridging with ap-bridge mode.

Extract from Official MTCNA Course Material – Wireless Section:

"Nstreme is supported only between a device in ap-bridge mode and a device in station or station-wds mode. Both ends must support Nstreme. WDS is supported with station-wds and ap-bridge combinations. Encryption is supported, although optional."

Extract from Terry Combs MTCNA Notes – Nstreme Notes:

"Only ap-bridge <-> station-wds (or station-bridge in RouterOS v6+) is valid for bridging over Nstreme. Encryption like WPA2 is supported but optional."

Extract from René Meneses Study Guide – Wireless Features:

“Nstreme does not support station-station WDS. Proper implementation requires ap-bridge on one side and station-wds or station-bridge on the other. Basic encryption (WEP/WPA) is allowed.”

===========

TTL (Time to Live) is a field in the IP header that limits the number of hops a packet can travel. Each router that processes the packet decrements the TTL by 1. When TTL reaches 0, the packet is dropped.

Default TTL values vary by operating system, but in RouterOS and many Linux-based systems, the default TTL is 64.

A. 60 → Incorrect, used in some systems but not the MikroTik default

B. 30 → Incorrect

C. 1 → Incorrect; would allow only one hop

D. 64 →✔Correct

Extract from Official MTCNA Course Material – TTL Field Explanation:

"The default TTL in RouterOS and most Unix-like systems is 64. Each router decrements this by 1 until the packet is discarded."

Extract from René Meneses Study Guide – IP Protocol Details:

“TTL is initialized to 64 by default in MikroTik RouterOS.”

Extract from MikroTik Wiki – IP Protocol Section:

"RouterOS sets default TTL of 64 unless manually configured otherwise."

===========

The OSI Layer 1, also known as the Physical Layer, is responsible for the transmission and reception of raw binary data over a physical medium. The most fundamental unit at this layer is the bit.

Bit = Binary Digit (0 or 1)

It is transmitted over physical media (cables, radio signals, etc.)

Frames (A) exist at Layer 2 (Data Link Layer), not Layer 1.

Bytes (C) are groups of 8 bits, but bits are still the smallest indivisible transmission unit.

Headers (D) are metadata used at Layers 2–7; not relevant to Layer 1.

MTCNA Official Training Manual – OSI Model Chapter:

“Layer 1 transmits raw bits over a transmission medium. These bits form the foundation for higher-layer data structures.”

René Meneses MTCNA Guide – OSI Model Breakdown:

“Physical Layer (Layer 1) carries bits, not frames or bytes. It's concerned with voltages, cables, connectors, and signal encoding.”

Terry Combs Notes – OSI Layers:

“Layer 1 = Bits. Nothing more. Frames come into play in Layer 2.”

Answer: B 

RouterOS Level 1 license is the demo license that comes with all RouterOS installations (particularly on x86 or CHR before activation). It is unrestricted in time, meaning it never expires, but functionality is extremely limited.

A. 24 hours → Incorrect. There is no such time-limited restriction.

B. Infinite time → Correct. Level 1 license is perpetual but has limited features.

C. 1 month → Incorrect. MikroTik does not impose monthly timeouts on license levels.

D. 1 year → Incorrect. No temporary time-bound license is assigned by default.

Extract from Official MTCNA Course Material – Licensing Section:

“Level 1 (demo) license is unlimited in time but has very limited functionality. It is designed for testing purposes only.”

Extract from René Meneses MTCNA Study Guide – RouterOS Licensing:

“The Level 1 license is not time-limited, but it cannot be used in production due to its lack of key features.”

Extract from MikroTik Wiki – Licensing Model:

“License level 1 is a free demo license that does not expire.”

===========

In MikroTik queues (especially in simple queues), the "total" limit typically refers to the combined rate of upload and download traffic — i.e., the total bandwidth usage. This is useful when you want to control the full traffic flow for a client or subnet.

A.✘Incorrect – Not just download

B.✔Correct – Total = Download + Upload combined

C.✘Incorrect

D.✘Incorrect – Upload alone is not referred to as "total"

Extract from MTCNA Course Material – Simple Queues:

“The total max-limit or total rate represents both upload and download combined.”

Extract from René Meneses MTCNA Study Guide – Queue Types:

“Use total max-limit to limit overall bandwidth. Individual directions can also be configured.”

Extract from MikroTik Wiki – Simple Queue Options:

“total-max-limit defines the sum of incoming and outgoing traffic rates.”