MTCNA Exam Dumps - MikroTikCertified Network Associate Exam

When static ARP is configured, the router explicitly binds an IP address to a specific MAC address. This means:

If the MAC address of the device changes (as it does when a new network card is installed), and the IP remains the same, the router will not allow the device to communicate, because the MAC address in the ARP table no longer matches the new hardware.

Options explained:

A.✔Correct. The old ARP entry must be updated to reflect the new MAC address if the IP is reused.

B.✘Incorrect. The communication will fail if the ARP table still holds the outdated MAC for that IP.

C.✔Correct. Alternatively, if the new NIC supports MAC address modification, setting the MAC address to match the old one would make the static ARP entry valid again.

D.✘Incorrect. There's no need to change the IP if the static ARP entry is updated.

Extract from Official MTCNA Course Material – ARP Section:

"Static ARP entries tie IPs to MAC addresses. If the MAC changes but the static ARP entry remains unchanged, the device cannot communicate with the router."

Extract from René Meneses MTCNA Study Guide – ARP:

"When using static ARP, any MAC change must be reflected in the router's ARP table; otherwise, packets will be dropped."

Extract from MikroTik Wiki – ARP Modes:

"Static entries require matching MAC addresses. If the client's MAC changes, the ARP table must be updated or communication will fail."

===========

Static routing is a core feature of MikroTik RouterOS and is included in the default 'system' package. You do not need to install any additional packages (like the "routing" package) for simple static routing.

The routing package is only needed for advanced dynamic routing protocols like BGP, OSPF, and RIP. For manually configured static routes, the system package alone is sufficient.

Let’s evaluate:

A.✅Correct. Static routing is part of the default system.

B.❌advanced-tools are for diagnostics and tools like traceroute, bandwidth-test, etc.

C.❌routing package is for dynamic protocols (OSPF, BGP, etc.), not static routes

D.❌dhcp is unrelated to routing — used for dynamic host IP assignment

MTCNA Course Manual – Routing Fundamentals:

“Static routing requires no additional package — it is included in the base system.”

René Meneses Guide – Routing Overview:

“For static routes, you do not need the 'routing' package. That’s only for protocols like BGP or OSPF.”

Terry Combs Notes – Routing Concepts:

“No extra packages needed for static routes. Just use /ip route.”

Answer: AQUESTION NO: 40 [Tools]

You want to transfer existing '/ip firewall filter' configuration from one router to a new system.

Choose the best possible way to do:

A. Export global configuration and remove everything apart from '/ip firewall filter'

B. Export only '/ip firewall filter'

C. Create backup, edit backup file and restore on target router

D. Create backup only of '/ip firewall filter' rules

Answer: B

The best way to transfer only the firewall filter rules is to export just that section of the configuration. This avoids unrelated settings (like IP addresses, user accounts, etc.) that could cause issues on the new router.

MikroTik allows you to selectively export parts of the configuration using:

/ip firewall filter export

This command outputs the firewall filter rules in script format, which can then be copied and applied to another router using import or pasting into terminal.

Evaluations:

A.❌Inefficient and error-prone. Exporting everything then removing parts increases the chance of mistakes.

B.✅Best method. Selective export via command line is clean and precise.

C.❌Backups are binary and system-specific — cannot be safely edited or restored on different hardware.

D.❌Backup doesn’t work selectively per section; export is the proper method.

MTCNA Course Manual – Backup vs Export:

“Use export when you need partial configurations. Backup is for full system state and cannot be selectively restored.”

René Meneses Study Guide – Configuration Transfer:

“Export is human-readable and editable. Use it for transferring only desired parts.”

Terry Combs Notes – Best Practices for Configuration Migration:

“Don’t use backups for partial transfer. Use export for readable and editable results.”

Answer: BQUESTION NO: 41 [QoS – PCQ]

You want to use PCQ and allow 256k maximum download and upload for each client. Choose correct argument values for the required queue.

A. kind=pcq pcq-rate=256000 pcq-classifier=src-address

B. kind=pcq pcq-rate=1256000 pcq-classifier=dst-address

C. kind=pcq pcq-rate=256000 pcq-classifier=dst-address

D. kind=pcq pcq-rate=5000000 pcq-classifier=src-address

E. kind=pcq pcq-rate=5000000 pcq-classifier=dst-address

Answer: A, C

PCQ (Per Connection Queue) is used in MikroTik to enforce bandwidth fairness across multiple users. To limit each client to 256k:

pcq-rate=256000 → sets maximum bandwidth per client to 256,000 bps (256 kbps)

pcq-classifier=src-address → used in upload queues

pcq-classifier=dst-address → used in download queues

So:

A.✅Used for upload: src-address

C.✅Used for download: dst-address

The other options have incorrect rates or classifiers:

B.❌Incorrect rate (1256000 ≠ 256k)

D & E.❌Incorrect rate (5000000 = 5 Mbps)

MTCNA Course Manual – PCQ Explanation:

“Use pcq-classifier=src-address for upload, and dst-address for download. pcq-rate sets per-client limit.”

René Meneses Study Guide – Queue Management:

“To cap clients to 256k, configure pcq-rate=256000. Adjust classifiers based on traffic direction.”

Terry Combs Notes – PCQ Parameters:

“Classifier is the key. src-address = upload, dst-address = download. Don’t mix.”

Answer: A, CQUESTION NO: 42 [Routing]

Which of the following Route statuses are possible?

A. A = Active

B. C = Connected

C. S = Static

D. D = Drop

Answer: A, B, C

In the MikroTik routing table, route status flags describe the type and status of each route:

A = Active → The route is being used to forward packets✅

C = Connected → The route is to a directly connected subnet✅

S = Static → The route was added manually by the administrator✅

D = Drop →❌There is no such routing flag; “drop” may be an action in firewall or route rules but not a route status

Correct route flags in MikroTik include:

D = Dynamic

A = Active

C = Connected

S = Static

r = RIP

o = OSPF

b = BGP

MTCNA Routing Section – Route Flags Overview:

“Static routes show as S, connected routes as C, and routes in use are marked with A.”

René Meneses Guide – Routing Table Flags:

“Check route flags: A (Active), C (Connected), S (Static). Drop is not a valid route flag.”

Terry Combs Notes – Route Status Flags:

“Drop = firewall action, not route flag. Don’t confuse it with routing status.”

DNS primarily uses UDP port 53 for most query/response operations. However, TCP port 53 is also used, particularly for larger responses (such as DNS zone transfers or DNSSEC).

A.✔UDP – Used for standard DNS queries due to lower overhead.

B.✔TCP port 53 – Used when UDP is insufficient, especially for zone transfers (AXFR/IXFR).

Extract from MTCNA Course Material – DNS and Networking Services:

“DNS typically uses UDP/53, but falls back to TCP/53 for larger queries or zone transfers.”

Extract from MikroTik Wiki – DNS Settings:

“DNS uses UDP for general queries. TCP is used when UDP cannot accommodate the size of the response.”

===========

Nstreme is a proprietary point-to-point wireless protocol developed by MikroTik to improve performance on long-distance wireless links. It enhances frame aggregation, reduces latency, and replaces standard 802.11 MAC timing behavior with a custom approach. Because of its specific mechanism, it imposes certain compatibility restrictions:

A. WDS between two station-wds devices is not compatible with Nstreme. This setup doesn't conform to proper AP-client architecture required by Nstreme, which operates in a master/slave role — typically ap-bridge and station.

B. Encryption (e.g., using WEP or WPA) is supported in Nstreme; however, MikroTik recommends encryption at higher layers like IPsec when performance is critical.

C. WDS between ap-bridge and station-wds is compatible with Nstreme. This is the standard pairing used when bridging two networks via wireless.

D. Bridging a station with an ap-bridge device using standard station mode (not station-wds or station-bridge) is not compatible for full Layer 2 bridging. Only station-wds or station-bridge supports bridging with ap-bridge mode.

Extract from Official MTCNA Course Material – Wireless Section:

"Nstreme is supported only between a device in ap-bridge mode and a device in station or station-wds mode. Both ends must support Nstreme. WDS is supported with station-wds and ap-bridge combinations. Encryption is supported, although optional."

Extract from Terry Combs MTCNA Notes – Nstreme Notes:

"Only ap-bridge <-> station-wds (or station-bridge in RouterOS v6+) is valid for bridging over Nstreme. Encryption like WPA2 is supported but optional."

Extract from René Meneses Study Guide – Wireless Features:

“Nstreme does not support station-station WDS. Proper implementation requires ap-bridge on one side and station-wds or station-bridge on the other. Basic encryption (WEP/WPA) is allowed.”

===========

The action=masquerade is used exclusively in the srcnat chain. It dynamically hides internal IP addresses behind the router's public IP. It cannot be used in the dstnat chain.

A.✘Incorrect – masquerade is not allowed in dstnat regardless of parameters.

B.✘Incorrect – masquerade is not valid in the dstnat chain.

C.✘Incorrect – masquerade does not operate in dstnat, direction does not change this.

D.✔Correct – masquerade must only be used in chain=srcnat.

Extract from MTCNA Course Material – NAT Concepts:

“Masquerade is a special type of source NAT used only in the srcnat chain. It is invalid in dstnat.”

Extract from René Meneses Study Guide – NAT Actions:

“Use action=masquerade in chain=srcnat. RouterOS will not accept it in dstnat.”

Extract from MikroTik Wiki – NAT Rules:

“action=masquerade is not allowed in dstnat chain and will result in error if applied.”

===========