MTCNA Exam Dumps : MikroTikCertified Network Associate Exam

MikroTik processes entries in the Access List and Connect List in the order they are listed — from top to bottom. This is referred to as “sequence order.” The first rule that matches the client’s MAC address and interface conditions will be applied, and no further rules are evaluated after a match.

Incorrect options:

A. Signal strength can be used as a condition, but is not the order of evaluation.

C. Random order is never used in rule-based systems.

D. Interface names are used as match conditions, not ordering criteria.

MTCNA Wireless Module – Access and Connect List Order:

“Rules are checked from the top of the list down. The first matching rule is applied, then processing stops.”

René Meneses Guide – Wireless Security and MAC Filtering:

“Sequence matters. If multiple rules could apply, only the first one is enforced.”

Terry Combs Notes – Wireless Filtering:

“Don’t misplace rules. Connect-list and access-list are evaluated in listed order.”

Answer: BQUESTION NO: 59 [Queues – QoS]

Simple Queue number 0 defines 2M for upload and download for target IP 10.10.0.33.

Simple Queue number 1 defines 4M for upload and download for the same target IP 10.10.0.33.

Client 10.10.0.33 will be able to obtain:

A. 6M upload/download

B. 0M upload/download

C. 4M upload/download

D. 2M upload/download

Answer: D

In MikroTik RouterOS, when multiple simple queues are configured for the same target (IP address), only the first matching queue in sequence is processed. This means that:

If queue 0 (2M) comes before queue 1 (4M), the 2M limit will be enforced.

The second queue is ignored, even if it provides a higher rate.

MikroTik does not sum the bandwidth of multiple queues. The first applicable queue (based on order) wins.

MTCNA Course Manual – Simple Queues:

“Simple Queues are matched top-down. Only the first matching queue is applied per packet.”

René Meneses MTCNA Guide – QoS Queue Behavior:

“Queue order matters. The first rule that matches is the one used. Lower queues override lower ones if placed first.”

Terry Combs Notes – Queue Troubleshooting:

“If two queues match the same IP, only the first is active. Don’t stack queues unless using a queue tree.”

Answer: DQUESTION NO: 60 [RouterOS Packages]

Which features are removed when the advanced-tools package is uninstalled?

A. neighbors

B. LCD support

C. ip-scan

D. ping

E. netwatch

F. bandwidth-test

Answer: C, E, F

The advanced-tools package in MikroTik RouterOS contains a set of diagnostic and monitoring tools. If this package is removed, the following features are lost:

ip-scan →✅Used for scanning IP ranges to discover hosts

netwatch →✅Monitors host availability and runs scripts on status changes

bandwidth-test →✅Used to measure throughput between MikroTik devices

Incorrect options:

A. neighbors → Part of the main system package (MAC discovery)

B. LCD support → Tied to specific hardware; not affected by advanced-tools

D. ping → Part of the base system package

MTCNA System Tools Section – Package Breakdown:

“The advanced-tools package includes netwatch, bandwidth-test, and ip-scan. These are not part of the base system.”

René Meneses Guide – Package Management:

“Removing advanced-tools disables several diagnostic commands like ip-scan and bandwidth-test.”

Terry Combs Notes – Tools Overview:

“Ping and neighbors are in core OS. Advanced-tools affects monitoring scripts and traffic tools.”

In MikroTik RouterOS, the masquerade action is used in source NAT (srcnat) rules to hide internal/private IP addresses behind a router’s public IP address. This is typically done for internet access from a LAN where the devices have private IP addresses (e.g., 192.168.x.x).

Masquerade dynamically changes the source IP of outgoing packets to the IP address of the router’s outbound interface, allowing multiple internal devices to share a single public IP.

Let’s evaluate the options:

A. masquerade →✅Correct. Used to perform source NAT for hiding private addresses.

B. allow →❌Not a valid NAT action.

C. passthrough →❌Used in mangle rules to continue processing additional rules, not for NAT.

D. tarpit →❌Used to delay TCP connections (often in firewall, not NAT).

MTCNA Course Manual – NAT Chapter:

“Masquerade is a special form of source NAT where the router replaces the source IP with the IP address of the outgoing interface.”

René Meneses Guide – NAT Configuration:

“Use masquerade on the router’s WAN interface to give internet access to private clients.”

Terry Combs Notes – NAT Rule Actions:

“Masquerade = dynamic src-nat. Useful when public IP is dynamic or unknown.”

Answer: AQUESTION NO: 62 [PPP / AAA]

Router A and B are both running as PPPoE servers on different broadcast domains of your network. It is possible to set Router A to use "/ppp secret" accounts from Router B to authenticate PPPoE customers.

A. true

B. false

Answer: B

/ppp secret accounts are local to each RouterOS device. These credentials are stored in the router’s own configuration and cannot be shared directly between routers.

To centralize authentication across multiple routers, a RADIUS server must be used. With RADIUS, multiple MikroTik routers can authenticate users against a single, centralized user database.

Without RADIUS or another external AAA system:

Each router maintains its own /ppp secret list

Router A cannot directly read or use the /ppp secrets from Router B

Evaluation:

A.❌False. There is no built-in mechanism for Router A to access secrets on Router B.

B.✅Correct. You must use RADIUS if you want shared authentication across routers.

MTCNA PPP Module – Authentication Methods:

“/ppp secrets are stored locally on the router. For shared user authentication, configure RADIUS.”

René Meneses Study Guide – PPPoE and RADIUS:

“To authenticate clients on multiple routers with a central database, RADIUS is required.”

Terry Combs Notes – PPP Secrets vs RADIUS:

“Local secrets cannot be accessed remotely. Use RADIUS to centralize authentication.”

Answer: B

Bridging loops occur when there are multiple active paths between switches or bridge interfaces, causing broadcast storms or MAC table instability. MikroTik RouterOS supports both STP (Spanning Tree Protocol) and RSTP (Rapid Spanning Tree Protocol) to detect and block redundant paths.

A.✔RSTP – Faster and preferred protocol to prevent loops.

B.✔STP – The original protocol, slower convergence but still effective.

C.✘Connection tracking – Not related to Layer 2 loop prevention.

D.✘UDP filter – Filters specific traffic types, doesn’t handle loops.

E.✘ICMP filter – Not relevant to Layer 2 loop protection.

Extract from Official MTCNA Course Material – Bridging and STP:

“STP or RSTP must be enabled to prevent bridging loops. RSTP is the recommended version due to faster convergence.”

Extract from René Meneses MTCNA Study Guide – Bridging:

“Always enable STP or RSTP when using bridges with multiple paths to prevent Layer 2 loops.”

Extract from MikroTik Wiki – STP / RSTP:

“STP and RSTP are loop prevention mechanisms for bridges. They dynamically block redundant links.”

===========