MikroTik MTCNA - MikroTikCertified Network Associate Exam

Netinstall is a MikroTik utility used to reinstall or repair RouterOS on RouterBOARD devices. It can be used to:

Reinstall RouterOS while preserving the existing license (✔B)

Install a different version of RouterOS – either older or newer (✔C)

Limitations:

A.✘Incorrect – Netinstall will erase the configuration; it cannot recover a lost admin password without wiping the device.

D.✘Incorrect – You can only install software meant for the specific hardware architecture of the RouterBOARD.

Extract from Official MTCNA Course Material – Netinstall Tool:

“Netinstall can be used to reinstall RouterOS and change its version. It does not erase the license key.”

Extract from René Meneses MTCNA Study Guide – Recovery Tools:

“Netinstall allows you to load any RouterOS version compatible with your device. It does not delete the license.”

Extract from MikroTik Wiki – Netinstall Overview:

“Netinstall reinstalls the OS, can change versions, and retains license. It cannot recover configuration or passwords.”

When a router forwards traffic between two interfaces (such as from LAN to WAN), it uses the forward chain. HTTP traffic initiated by users destined to external servers passes through this chain.

A.✘prerouting – Used mainly for routing decisions and NAT, not filtering.

B.✔forward – Used to filter transit traffic.

C.✘output – For traffic originating from the router itself.

D.✘input – For traffic destined to the router itself.

Extract from MTCNA Course Material – Firewall Chains:

“Client-to-server traffic, like browsing the web, passes through the forward chain when routed through the router.”

Extract from René Meneses Study Guide – Firewall Structure:

“To block or allow traffic passing through the router (LAN to Internet), use the forward chain.”

Extract from MikroTik Wiki – Firewall Filtering Overview:

“forward: filters all transit traffic routed through the router.”

===========

MikroTik RouterOS supports running multiple dynamic routing protocols simultaneously, including RIP, OSPF, and BGP. They are independent processes and can be configured in parallel. This is commonly used in complex network environments or during routing migrations.

A.✔FALSE – You can run OSPF and RIP at the same time.

B.✘TRUE – Incorrect; both protocols are fully supported to coexist.

Extract from MTCNA Course Material – Dynamic Routing:

“RouterOS supports multiple dynamic routing protocols, including simultaneous use of RIP and OSPF.”

Extract from René Meneses Study Guide – Routing Protocols:

“You can configure both RIP and OSPF to run at the same time on a single router.”

Extract from MikroTik Wiki – Routing Overview:

“RouterOS allows multiple routing protocols to operate concurrently.”

===========

In IPv6, the Address Resolution Protocol (ARP) is not used. Instead, IPv6 uses the Neighbor Discovery Protocol (NDP), which is part of the ICMPv6 suite. NDP handles address resolution, router discovery, and reachability.

MTCNA Course Material – IPv6 Address Resolution:

“IPv6 replaces ARP with Neighbor Discovery Protocol. NDP uses ICMPv6 to perform tasks like address resolution and router discovery.”

René Meneses MTCNA Study Guide – IPv6 Fundamentals:

“There is no ARP in IPv6. It uses NDP messages for neighbor solicitation and advertisement.”

Thus, ARP is not used in IPv6.

Final Answer: AQUESTION NO: 152 [Monitoring and Management – SNMP Protocol]

Which of the following protocols / ports are used for SNMP (Simple Network Management Protocol)?

A. TCP 162

B. UDP 162

C. UDP 161

D. TCP 25

E. TCP 123

F. TCP 161

Answer: B, C

SNMP uses the following ports:

UDP 161: Used for SNMP agent queries (GET, SET, etc.)

UDP 162: Used by SNMP managers to receive trap notifications

MTCNA Course Material – SNMP and Monitoring:

“SNMP uses UDP 161 for polling devices and UDP 162 for traps.”

MikroTik Wiki – SNMP:

“SNMP communication uses UDP ports 161 (queries) and 162 (traps). TCP is not used for SNMP by default.”

Option breakdown:

A: TCP 162 → incorrect (SNMP traps use UDP)

B:✔UDP 162

C:✔UDP 161

D: TCP 25 = SMTP

E: TCP 123 = NTP (incorrect protocol and transport)

F: TCP 161 = incorrect transport

Final Answer: B, CQUESTION NO: 153 [ARP – MikroTik Specific Behavior]

If arp=reply-only is configured on an interface, what will this interface do?

A. Accept all IP/MAC combinations listed in /ip arp as static entries

B. Accept all IP addresses listed in /ip arp as static entries

C. Add new MAC addresses in /ip arp list

D. Accept all MAC addresses listed in /ip arp as static entries

E. Add new IP addresses in /ip arp list

Answer: A

Setting arp=reply-only on an interface disables the normal dynamic ARP process. The router will only respond to ARP requests for IP/MAC pairs that are explicitly listed in /ip arp with type=static. No dynamic entries will be added.

MikroTik Wiki – ARP Modes:

“reply-only – the interface will only reply to ARP requests if there is a static entry. It will not add any new entries.”

MTCNA Course Material – ARP Configuration:

“When reply-only is set, the interface will not send ARP requests and will only respond to those IP/MAC combinations configured as static entries.”

Option breakdown:

A:✔Correct—replies only to statically configured IP/MAC pairs

B: Incorrect — ARP entries must have both IP and MAC

C/E: No new dynamic entries are added in reply-only mode

D: MAC addresses alone are not matched — ARP matches IP/MAC pairs

Final Answer: AQUESTION NO: 154 [RouterOS Tools – Configuration Export]

Mark all correct statements about /export (rsc file).

A. Exports logs from /log print

B. Exports full configuration of the router

C. Exports only part of the configuration (for example /ip firewall)

D. Exports scripts from /system script

E. Exported files could not be edited

Answer: B, C, D

The /export command in RouterOS allows exporting configuration as a script (.rsc file). It can:

Export the full configuration

Export a specific section (e.g., /ip firewall)

Include scripts under /system script if specified

It does not export logs and the exported .rsc file is plain text and can be edited.

MTCNA Course Material – Configuration Management:

“/export outputs configuration to a text file. You can export the full config or a specific menu, and it includes scripts if present.”

MikroTik Wiki – Export Command:

“You can use /export to generate editable .rsc files. Use /export file=name or /ip firewall export.”

Option breakdown:

A:❌Logs are not exported

B:✔Full config export is default

C:✔You can target specific sections (e.g., /ip dhcp-server)

D:✔Scripts are included if present

E:❌Exported files are editable text files

Final Answer: B, C, D

The action=masquerade is used exclusively in the srcnat chain. It dynamically hides internal IP addresses behind the router's public IP. It cannot be used in the dstnat chain.

A.✘Incorrect – masquerade is not allowed in dstnat regardless of parameters.

B.✘Incorrect – masquerade is not valid in the dstnat chain.

C.✘Incorrect – masquerade does not operate in dstnat, direction does not change this.

D.✔Correct – masquerade must only be used in chain=srcnat.

Extract from MTCNA Course Material – NAT Concepts:

“Masquerade is a special type of source NAT used only in the srcnat chain. It is invalid in dstnat.”

Extract from René Meneses Study Guide – NAT Actions:

“Use action=masquerade in chain=srcnat. RouterOS will not accept it in dstnat.”

Extract from MikroTik Wiki – NAT Rules:

“action=masquerade is not allowed in dstnat chain and will result in error if applied.”

===========

Let’s evaluate each statement:

A.✘Incorrect – /ip firewall filter can block traffic after association/authentication but cannot directly prevent wireless authentication. Association happens before IP-level filtering.

B.✔Correct – Wireless access-list allows or denies associations based on MAC address and other parameters (signal strength, etc.).

C.✔Correct – Access-list rules can enable/disable default-forwarding per client (overriding global setting).

D.✘Incorrect – Disabling the wireless interface is not the only way. You can use access-list or disable SSID broadcast.

Extract from MTCNA Course Material – Wireless Access List:

“Access List provides client control based on MAC address. You can accept, reject, and even override default-forwarding per client.”

Extract from René Meneses MTCNA Study Guide – Access Control:

“Wireless Access List can selectively allow or deny clients and enforce individual settings like forwarding.”

Extract from MikroTik Wiki – Wireless Access List:

“The firewall filter is not involved in authentication. Access control must be done at the wireless layer using access-lists.”

===========

The “Max Limit” value in MikroTik Simple Queues defines the maximum allowed bandwidth. In this case:

Target Address: 192.168.1.10

Target Upload = 1M → The host can upload at a maximum of 1 Mbps

Target Download = unlimited → No restriction on download

This does not “guarantee” bandwidth — it enforces a ceiling. A guaranteed rate would require "Limit-at" to be set.

Evaluation:

A.❌This queue limits, it does not guarantee a minimum bandwidth.

B.❌Download is set to unlimited — no limitation.

C.✅Upload is limited to 1 Mbps — correct.

D.❌Download rate is unlimited — no guarantee or limit.

MTCNA Course Manual – Simple Queue Explanation:

“Max-limit sets the maximum throughput for upload/download. It’s a ceiling, not a guarantee.”

René Meneses Guide – Simple Queues Explained:

“In this case, upload is capped at 1M. No burst or download limit is applied.”

Terry Combs Notes – Queue Properties:

“Always distinguish between 'limit-at' (minimum guarantee) and 'max-limit' (maximum cap).”

Only tunnel types built on PPP support authentication with username and password:

A.✔PPPoE – Built on PPP, uses CHAP, PAP authentication.

B.✔OpenVPN – Supports user/password login for client authentication.

C.✘IPIP – A stateless Layer 3 tunnel; no authentication support.

D.✔PPTP/L2TP – Both are PPP-based and support username/password authentication.

E.✘EoIP – MikroTik proprietary Layer 2 tunnel; no username/password authentication.

Extract from MTCNA Course Material – Tunnel Types:

“PPPoE, PPTP, and L2TP are PPP-based and support user/password authentication. IPIP and EoIP do not.”

Extract from René Meneses Study Guide – Tunnel Protocols:

“Authentication (PAP/CHAP) is part of PPP. Use PPPoE, PPTP, L2TP, or OpenVPN for user logins.”

Extract from MikroTik Wiki – Tunnel Protocols Overview:

“Only PPP-based tunnels support authentication via username/password.”

===========

MikroTik uses connection tracking to assign states to packets that pass through the router’s firewall. When a packet initiates a connection that is not previously tracked, it is marked as new.

Connection states:

new: First packet of a new connection

established: Part of an existing tracked connection

related: New connection related to an existing one (e.g., FTP data channel)

invalid: Unrecognized or malformed connection

unknown: Used in very specific or rare circumstances (not common in IP-based networks)

Therefore:

A.✘Incorrect – All packets entering the firewall are tracked

B.✔Correct – This is a new connection

C.✘Incorrect – "unknown" is not used for typical traffic

D.✘Incorrect – Not invalid unless malformed or contextless

E.✘Incorrect – This is not an existing connection

Extract from Official MTCNA Course Material – Firewall Connection States:

“A packet that begins a new connection is marked as ‘new’. Connection tracking then continues monitoring that session.”

Extract from René Meneses MTCNA Study Guide – Connection Tracking:

“New connections receive the 'new' state. Firewall rules often start by permitting or blocking 'new' and 'established' states.”

Extract from MikroTik Wiki – Firewall and Connection States:

“State=new is assigned when no existing connection entry matches the incoming packet.”

===========

To redirect SMTP (port 25) traffic from users to a specific internal or external SMTP server, you must use dst-nat. This modifies the destination address and port to point to the desired mail server.

A.✘passthrough – Allows the packet to be evaluated by other NAT rules; it doesn't alter traffic

B.✔dst-nat – Rewrites destination IP/port; this is what is needed to redirect SMTP to a specific server

C.✘redirect – Sends traffic to the router itself; not suitable for external redirection

D.✘tarpit – Used for slowing down malicious TCP connections, not redirection

Extract from MTCNA Course Material – NAT Types:

“Use dst-nat to change the destination IP address. This is suitable for port forwarding or service redirection.”

Extract from René Meneses Study Guide – NAT Rules:

“To redirect traffic to a specific server, use action=dst-nat and specify the new destination address.”

===========