MTCNA Exam Dumps - MikroTikCertified Network Associate Exam

IP addresses are categorized as either public or private. According to the IANA (Internet Assigned Numbers Authority), the following are reserved for private use:

10.0.0.0 to 10.255.255.255 (Class A Private)

172.16.0.0 to 172.31.255.255 (Class B Private)

192.168.0.0 to 192.168.255.255 (Class C Private)

Any IP outside of these ranges is considered public and routable on the global internet.

Evaluation of each option:

A. 172.168.254.2 → This is in the 172.16.0.0 – 172.31.255.255 range → Private

B. 172.28.73.21 → Also falls in the same private 172.16.0.0/12 range → Private

C. 11.63.72.21 → Outside all private ranges → Public✅

D. 10.110.50.37 → In the 10.0.0.0/8 range → Private

E. 192.168.0.1 → In the 192.168.0.0/16 private range → Private

Extract from René Meneses MTCNA Study Guide:

“Private IP ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These are non-routable over the public internet.”

Extract from Terry Combs Notes:

“Only IPs outside of the above ranges are considered public and routable. Watch out for 172.X.X.X — not all are public; only 172.0.0.0–172.15.255.255 and 172.32.0.0+ are public.”

MikroTik Wiki – IP Addressing Reference:

“Private addresses are not globally routable. They are used inside local networks and must be NATed for internet access.”

===========

The local PPP database in MikroTik allows control over authentication and access for PPP-based services such as PPTP, L2TP, PPPoE, and SSTP. Several configuration options can be specified per user or profile.

A.✔Correct – You can use the "only-one" setting in PPP profiles to allow/deny multiple logins for the same user.

B.✔Correct – Under the "service" parameter in /ppp secret, you can restrict allowed protocols (e.g., enable PPPoE, PPTP, and disable L2TP).

C.✘Incorrect – Data transfer limits (Rx/Tx) are not enforced directly in PPP profiles or secrets. This is usually handled via queues or hotspot limitations.

D.✔Correct – By setting the "service" to only "pppoe", all other PPP types will be denied.

E.✘Incorrect – Access to services like telnet is managed via firewall rules or user groups, not in PPP profiles.

Extract from Official MTCNA Course Material – PPP Profiles:

“PPP Profiles control session parameters. You can limit simultaneous logins, restrict service types (e.g., PPPoE), and set IP pools.”

Extract from René Meneses MTCNA Study Guide – PPP Configuration:

“Use the ‘only-one’ flag to control concurrent logins. The ‘service’ field allows or restricts protocol types per user.”

Extract from Terry Combs MTCNA Notes – PPP Features:

“To allow a user access only via PPPoE or PPTP, adjust the service types in /ppp secret.”

===========

The “Area” parameter is a user-defined tag in the wireless interface configuration that works with the Access List in MikroTik RouterOS. It allows grouping of clients or APs for filtering or configuration logic.

When an Access List rule includes an area name, it will only apply to devices matching that area.

Option breakdown:

A. Connect List → Incorrect. Area is not used here.

B. Access List →✔Correct. “Area” is matched directly in Access List rules.

C. None of these → Incorrect.

D. Security Profile → Incorrect. Security Profiles control authentication/encryption, not area filtering.

Extract from Official MTCNA Course Material – Wireless Access List:

"The Area field allows you to group wireless interfaces and filter clients based on Access List rules that include this tag."

Extract from Terry Combs Notes – Wireless Configuration:

“Area is a label that can be referenced in Access List rules to apply rules selectively.”

Extract from MikroTik Wiki – Wireless Access List Section:

"Area is used in Access List to assign rules based on interface groups or locations."

AMAC (Media Access Control) addressis aunique identifier assigned to network interfacesfor communications at the data link layer (Layer 2 of the OSI model). A MAC address is:

Always48 bits(6 bytes) long

Represented in12 hexadecimal characters

Grouped into6 pairsseparated by colons or dashes (e.g., 00:1A:2B:3C:4D:5E)

Contains onlyhexadecimal characters (0-9, A-F)

Extract fromRené Meneses MTCNA Study Guide:

“A MAC address is a 48-bit value, represented as 6 groups of two hexadecimal digits (00 to FF). Any character outside this range is not valid. For example, 80:GF:AA:67:13:5D is invalid because ‘G’ is not a valid hexadecimal digit.”

Extract fromTerry Combs MTCNA Notes – MAC Addressing Section:

“Valid MAC addresses contain only 0-9 and A-F. A common mistake in training exams is to insert an invalid character like G or H into a MAC, which instantly makes it incorrect.”

Extract fromMikroTik Wiki – MAC Address Format Page:

“MAC addresses are six octets long and use hexadecimal format only. Hexadecimal numbers go from 0–9 and A–F. If a character appears outside that range, the address is invalid.”

Now let’s evaluate each option:

Option A: 80:GF:AA:67:13:5D❌Contains the letter"G", whichdoes not belong to the hexadecimal system. That makes this addressinvalid.

Option B: 95:B5:DD:EE:78:8A✅All characters are valid hex (9, 5, B, D, E, 7, 8, A)

Option C: 88:0C:00:99:5F:EF✅All valid characters.

Option D: EA:BA:AA:EE:FF:CB✅Hex only — valid.

Option E: 13:16:86:53:89:43✅Also valid hex — no issue.

So,Option A is the only invalid MAC address.

Winbox is the graphical configuration utility for MikroTik routers. By default, Winbox connects to RouterOS over TCP port 8291.

A.✘UDP/5678 – Used for Winbox neighbor discovery, not for connecting.

B.✘TCP/22 – SSH service.

C.✔TCP/8291 – Default and official port for Winbox connections.

D.✘TCP/8080 – Often used for HTTP proxy; unrelated to Winbox.

Extract from MTCNA Course Material – RouterOS Access Methods:

“Winbox uses TCP port 8291 to establish connections to RouterOS.”

Extract from René Meneses MTCNA Study Guide – Access Tools:

“Winbox connects via TCP 8291. Neighbor discovery uses UDP 5678.”

Extract from MikroTik Wiki – Winbox Port Info:

“TCP/8291 is the default port for Winbox. Ensure it is not blocked by firewall.”

When a router forwards traffic between two interfaces (such as from LAN to WAN), it uses the forward chain. HTTP traffic initiated by users destined to external servers passes through this chain.

A.✘prerouting – Used mainly for routing decisions and NAT, not filtering.

B.✔forward – Used to filter transit traffic.

C.✘output – For traffic originating from the router itself.

D.✘input – For traffic destined to the router itself.

Extract from MTCNA Course Material – Firewall Chains:

“Client-to-server traffic, like browsing the web, passes through the forward chain when routed through the router.”

Extract from René Meneses Study Guide – Firewall Structure:

“To block or allow traffic passing through the router (LAN to Internet), use the forward chain.”

Extract from MikroTik Wiki – Firewall Filtering Overview:

“forward: filters all transit traffic routed through the router.”

===========

ICMP (Internet Control Message Protocol) is used for diagnostics and error reporting in IP networks. It is encapsulated directly within IP datagrams and not over UDP or TCP. It does not guarantee delivery — it merely provides feedback about problems (e.g., host unreachable, time exceeded).

MTCNA Course Material – ICMP and Network Tools:

“ICMP is used for error messages and operational queries such as ping and destination unreachable. It is encapsulated in IP and does not use TCP or UDP.”

René Meneses MTCNA Study Guide – ICMP Section:

“ICMP provides diagnostic information. It is a Layer 3 protocol encapsulated directly in IP. It does not provide guaranteed delivery.”

MikroTik Wiki – ICMP Overview:

“ICMP packets are carried in IP packets and used for control messages. They are not transported using TCP or UDP.”

Breakdown:

Statement 1: False – ICMP does not guarantee delivery

Statement 2: True – provides network problem feedback

Statement 3: True – encapsulated in IP

Statement 4: False – ICMP is not encapsulated in UDP

Correct set: 2 and 3

Final Answer: BQUESTION NO: 106 [RouterOS Introduction]

Which Layer 4 protocol is used for a Telnet connection?

A. IP

B. TCP

C. TCP/IP

D. UDP

Answer: B

Telnet is a protocol used to access remote devices via command-line over the network. It operates over TCP at Layer 4, using port 23.

MTCNA Course Material – Layer 4 Protocols:

“Telnet uses TCP port 23 for remote shell access. TCP ensures ordered and reliable delivery of commands and responses.”

René Meneses MTCNA Study Guide – TCP/IP Protocols:

“Telnet is an Application Layer protocol using TCP as its transport protocol.”

MikroTik Wiki – Telnet Access:

“Telnet communicates over TCP. It does not use UDP.”

Other options:

A. IP is a Layer 3 protocol

C. TCP/IP is a model, not a single protocol

D. Telnet does not use UDP

Final Answer: BQUESTION NO: 107 [RouterOS Introduction]

Which of the following are layers in the TCP/IP model?

Application

Session

Transport

Internet

Data Link

Physical

A. 1 and 2

B. 1, 3 and 4

C. 2, 3 and 5

D. 3, 4 and 5

Answer: B

The TCP/IP model has four layers:

Application

Transport

Internet

Network Access (includes Data Link & Physical in OSI terms)

Session is part of the OSI model, not TCP/IP.

MTCNA Course Material – TCP/IP vs OSI Model:

“The TCP/IP model has Application, Transport, Internet, and Network Access layers. Application includes OSI’s Session, Presentation, and Application layers.”

René Meneses MTCNA Guide – Model Comparison:

“The TCP/IP model consists of: Application, Transport, Internet, and Network Access (which covers Data Link and Physical). Session layer is part of OSI.”

So, correct TCP/IP layers from the given list:

Application (✔)

Transport (✔)

Internet (✔)

Session is not part of TCP/IP model.

Final Answer: BQUESTION NO: 108 [RouterOS Introduction]

Which statements are true regarding ICMP packets?

They acknowledge receipt of a TCP segment.

They guarantee datagram delivery.

They can provide hosts with information about network problems.

They are encapsulated within IP datagrams.

A. 1 only

B. 2 and 3

C. 3 and 4

D. 2, 3 and 4

Answer: C

Reiterating from earlier:

ICMP does not acknowledge TCP segments; that’s TCP’s job.

ICMP does not guarantee delivery; it’s an unreliable protocol.

ICMP does provide diagnostics (e.g., unreachable, TTL exceeded).

ICMP is encapsulated directly in IP, not over TCP/UDP.

MTCNA Course Material – ICMP Behavior:

“ICMP is used for control messages like ping and unreachable. It provides feedback and is encapsulated in IP.”

René Meneses MTCNA Study Guide – ICMP & IP Layer:

“ICMP is a Layer 3 protocol, not used to acknowledge TCP, and is wrapped in IP datagrams.”

Correct:

Statement 3: True

Statement 4: True

MikroTik’s NAT (Network Address Translation) is part of the connection tracking mechanism. NAT rules are applied only to the first packet of a connection. Subsequent packets belonging to the same connection are automatically handled by the connection tracking module using the same translation mappings established by that first packet.

Option Analysis:

A.✔True – NAT is evaluated only on the first packet of a new connection.

B.✘False – Subsequent packets are not re-evaluated against NAT rules.

Extract from Official MTCNA Course Material – Firewall & NAT Section:

“NAT rules apply to the first packet in a connection. After that, RouterOS uses the tracked connection entry.”

Extract from René Meneses MTCNA Study Guide – NAT & Firewall Concepts:

“Once the initial packet matches a NAT rule, connection tracking applies it to the whole session.”

Extract from MikroTik Wiki – NAT Implementation:

“NAT is evaluated on the first packet. Other packets in the same connection follow the established NAT mapping.”

===========