MikroTik MTCNA Dumps

To upgrade or install a new Cisco IOS image on a router, you typically copy the IOS image file from a TFTP server into the router’s flash memory. The correct syntax is:

copy tftp flash

This command tells the router to copy the IOS image from a TFTP server into flash storage, where it can be booted.

Cisco IOS Documentation – Image Upgrade Process:

“Use the command copy tftp flash to transfer an IOS image from a TFTP server to the router’s flash memory.”

Other options:

A: copy tftp run – invalid; you cannot copy into the running-config that way

B: copy tftp start – used to copy configuration, not IOS image

C: config net – an older and deprecated command, not for IOS upgrades

Final Answer: DQUESTION NO: 122 [RouterOS Introduction – ICMP and Diagnostics]

Which protocol does Ping use?

A. TCP

B. ARP

C. ICMP

D. BootP

Answer: C

Ping is a diagnostic utility used to test reachability between devices. It sends ICMP Echo Request packets and waits for ICMP Echo Replies. ICMP (Internet Control Message Protocol) is used for these types of control messages and is encapsulated within IP.

MTCNA Course Material – Diagnostic Tools:

“Ping uses ICMP Echo Requests to verify if a destination is reachable. It does not use TCP or UDP.”

René Meneses MTCNA Study Guide – Ping and ICMP:

“Ping uses ICMP, not TCP or ARP. ICMP packets are used to check basic connectivity.”

MikroTik Wiki – Ping Tool Description:

“Ping works by sending ICMP packets. It cannot use TCP.”

Other options:

TCP: Used by protocols like HTTP, FTP

ARP: Resolves IP to MAC, not used for ping

BootP: DHCP-related protocol, not diagnostic

Final Answer: CQUESTION NO: 123 [Cisco – Frame Relay Troubleshooting]

What command will display the line, protocol, DLCI, and LMI information of an interface?

A. sh pvc

B. show interface

C. show frame-relay pvc

D. show run

Answer: C

In Cisco IOS, to display detailed Frame Relay virtual circuit information, including the line status, protocol status, DLCI (Data Link Connection Identifier), and LMI (Local Management Interface) details, the correct command is:

show frame-relay pvc

Cisco IOS Command Reference – Frame Relay:

“The show frame-relay pvc command displays information about PVC status, including DLCI numbers and LMI statistics.”

Breakdown:

A: sh pvc – shorthand and ambiguous, may not be recognized

B: show interface – general interface stats but lacks detailed LMI/DLCI info

C: show frame-relay pvc –✔correct, provides detailed DLCI/LMI info

D: show run – shows current configuration, not real-time PVC status

Final Answer: CQUESTION NO: 124 [Networking Fundamentals – Ethernet and Switching]

How many collision domains are created when you segment a network with a 12-port switch?

A. 1

B. 2

C. 5

D. 12

Answer: D

Each port on a switch creates its own collision domain. Unlike hubs (which extend a single collision domain), switches segment each interface, allowing full-duplex communication and eliminating collisions.

MTCNA Course Material – Ethernet Switching Concepts:

“Each switch port is a separate collision domain. A 24-port switch creates 24 separate collision domains.”

René Meneses MTCNA Study Guide – Collision and Broadcast Domains:

“Switches break up collision domains per port, unlike hubs.”

Therefore, a 12-port switch creates 12 individual collision domains.

Wireless encryption modes differ in how they authenticate clients:

WPA/WPA2 PSK (Pre-Shared Key): Uses a passphrase shared by all clients. No external authentication server (like RADIUS or 802.1X) is required. Simple and suitable for home or small networks.

WPA/WPA2 EAP: Uses 802.1X (Enterprise mode) and requires a centralized authentication server.

Option analysis:

A.✔Correct – Pre-Shared Key does not require 802.1X server

B.✘Incorrect – Requires EAP-based authentication with 802.1X infrastructure

Extract from Official MTCNA Course Material – Wireless Security:

“WPA PSK/WPA2 PSK uses a pre-shared password. WPA/WPA2 EAP requires 802.1X authentication with a RADIUS server.”

Extract from René Meneses MTCNA Study Guide – Wireless Encryption:

“To use a simple password for connecting wireless clients, select WPA2-PSK. It does not require server-based authentication.”

Extract from Terry Combs Notes – Wireless Security Profiles:

“WPA2 PSK = password-based; WPA2 EAP = 802.1X based. Use PSK for fast, simple authentication.”

The connection-state=established matcher in MikroTik’s firewall refers to packets that are part of an already active connection. These packets are neither new nor related — they are directly associated with a known connection that has been previously accepted or initiated.

MikroTik uses Connection Tracking (enabled by default) to determine the state of each packet:

new: Packet begins a new connection (e.g., TCP SYN)

established: Packet belongs to a previously established connection (reply or subsequent packets)

related: Packet is not part of the connection, but is related (e.g., FTP data channel)

invalid: Packet that does not match any known or valid connection

Therefore:

A.✅Correct. “Established” means part of an ongoing, known connection.

B.❌This describes “related”

C.❌This describes “invalid”

D.❌This describes “new”

MTCNA Course Manual – Firewall and Connection Tracking:

“Established – Packet that belongs to an existing connection. This includes replies and ongoing streams.”

René Meneses Study Guide – Firewall Fundamentals:

“Use connection-state=established to allow traffic that is part of previously accepted sessions.”

Terry Combs Notes – Connection States:

“Established = trusted, ongoing session. Essential for return traffic.”

Answer: AQUESTION NO: 32 [PPP]

PPP Secrets are used for:

A. PPPoE clients

B. L2TP clients

C. IPSec clients

D. PPP clients

E. PPTP clients

F. Router users

Answer: A, B, D, E

PPP Secrets is a user authentication mechanism used in MikroTik RouterOS for various PPP-based services. These include:

PPP (Point-to-Point Protocol)

PPPoE (PPP over Ethernet)

PPTP (Point-to-Point Tunneling Protocol)

L2TP (Layer 2 Tunneling Protocol)

Each client authenticates with a username/password combination defined under PPP → Secrets. PPP Secrets is not used for:

IPSec clients →❌They use peer configurations and policies

Router users (Winbox/WebFig) →❌Use system → users, not PPP secrets

MTCNA PPP Chapter – Secrets Authentication:

“PPP Secrets are used for all PPP services: PPP, PPPoE, L2TP, and PPTP. It defines usernames, passwords, profiles, and IP bindings.”

René Meneses Guide – Tunnels and PPP:

“Any PPP-based tunnel uses PPP secrets for login validation. This includes local dial-in and remote VPN tunnels.”

Terry Combs Notes – PPP Authentication Table:

“PPP Secrets = for PPP, PPPoE, PPTP, and L2TP. Not for IPSec or Winbox.”

Answer: A, B, D, EQUESTION NO: 33 [Licensing]

How long is level 1 (free) license valid?

A. 1 month

B. 24 hours

C. 1 year

D. Infinite time

Answer: D

Level 1 license in MikroTik RouterOS is a free license type. It is included with every installation but has very limited functionality. Despite the limitations, it is valid for an unlimited duration.

Features available in level 1:

Basic configuration

One active user session

Ideal for lab/testing with CHR

Incorrect options:

A. 1 month →❌Not time-based

B. 24 hours →❌No expiration limit

C. 1 year →❌Invalid

D.✅Correct → Valid forever, but feature-limited

MTCNA Course Material – Licensing Section:

“Level 1 license is free and does not expire. It provides minimal feature access.”

René Meneses Study Guide – License Levels:

“Level 1 is permanent but restrictive. Great for evaluation or learning.”

Terry Combs Notes – RouterOS Licensing Table:

“Level 1 license = lifetime access to basic RouterOS functionality.”

Answer: DQUESTION NO: 34 [NAT]

What is the correct action for a NAT rule on a router that should intercept SMTP traffic and send it over to a specified mail server?

A. tarpit

B. dst-nat

C. passthrough

D. redirect

Answer: B

To forward traffic from one destination to another (such as from the public IP to an internal mail server), the dst-nat action is used in MikroTik NAT rules.

dst-nat: Modifies the destination IP address and/or port of the packet. Used to forward traffic to an internal resource.

tarpit: Captures and holds TCP connections (used for spam traps or slowing down bots) →❌

passthrough: Used in mangle rules; allows the packet to be evaluated by the next rule →❌

redirect: Redirects traffic to the router itself (e.g., proxy or DNS services) →❌

So, for external SMTP traffic (e.g., TCP port 25), we use a dst-nat rule that forwards the traffic to the internal mail server.

MTCNA NAT Section – Destination NAT:

“To forward SMTP traffic from a public address to a private server, use dst-nat with appropriate port and IP.”

René Meneses Guide – Practical NAT Examples:

“Use dst-nat for port forwarding. Redirect is for internal services like DNS or web proxy.”

Terry Combs Notes – NAT Action Summary:

“dst-nat = most common for external-to-internal mapping (e.g., mail servers, web servers).”