A MAC (Media Access Control) address is a unique identifier assigned to network interfaces for communications at the data link layer (Layer 2 of the OSI model). A MAC address is:

Always 48 bits (6 bytes) long

Represented in 12 hexadecimal characters

Grouped into 6 pairs separated by colons or dashes (e.g., 00:1A:2B:3C:4D:5E)

Contains only hexadecimal characters (0-9, A-F)

Extract from René Meneses MTCNA Study Guide :

“A MAC address is a 48-bit value, represented as 6 groups of two hexadecimal digits (00 to FF). Any character outside this range is not valid. For example, 80:GF:AA:67:13:5D is invalid because ‘G’ is not a valid hexadecimal digit.”

Extract from Terry Combs MTCNA Notes – MAC Addressing Section :

“Valid MAC addresses contain only 0-9 and A-F. A common mistake in training exams is to insert an invalid character like G or H into a MAC, which instantly makes it incorrect.”

Extract from MikroTik Wiki – MAC Address Format Page :

“MAC addresses are six octets long and use hexadecimal format only. Hexadecimal numbers go from 0–9 and A–F. If a character appears outside that range, the address is invalid.”

Now let’s evaluate each option:

Option A: 80:GF:AA:67:13:5D ❌ Contains the letter "G" , which does not belong to the hexadecimal system . That makes this address invalid .

Option B: 95:B5:DD:EE:78:8A ✅ All characters are valid hex (9, 5, B, D, E, 7, 8, A)

Option C: 88:0C:00:99:5F:EF ✅ All valid characters.

Option D: EA:BA:AA:EE:FF:CB ✅ Hex only — valid.

Option E: 13:16:86:53:89:43 ✅ Also valid hex — no issue.

So, Option A is the only invalid MAC address .

In the PPP > Active Connections window in RouterOS, the letter "R" in the "Flags" column indicates the session is Running. This means the session is active and fully negotiated.

A. ✘ Radius – Not what "R" stands for in this context

B. ✔ Running – The connection is established and currently operating

C. ✘ Remote – Not relevant in this context

Extract from MTCNA Course Material – PPP Interface Flags:

“R indicates a Running state. The session is successfully established and data can be transmitted.”

Extract from MikroTik Wiki – PPP Flags Reference:

“R = Running. The session is active.”

A hub is a simple Layer 1 (Physical Layer) device that does not understand MAC addresses or IP addresses. It simply repeats electrical signals to all connected ports without inspection or filtering.

MTCNA Course Material – OSI Layer Device Roles:

“Hubs operate at the Physical Layer. They do not process frames or packets and function purely as repeaters.”

René Meneses MTCNA Study Guide – OSI Devices:

“Hubs are Layer 1 devices. They send bits — not frames — and have no concept of MAC addresses.”

Other options:

A: Session layer is Layer 5, handles sessions between applications

C: Switches/bridges operate at the Data Link layer (Layer 2)

D: Application layer (Layer 7) is for user-level software like HTTP, FTP, etc.

Final Answer: B QUESTION NO: 138 [Cisco IOS – Access List Verification]

Which command is used to determine if an IP access list is enabled on a particular interface?

A. show access-lists

B. show interface

C. show ip interface

D. show interface access-lists

Answer: C

The command show ip interface displays the status of IP-level interface parameters, including whether an access list (ACL) is applied inbound or outbound.

Cisco IOS Command Reference – Interface ACL Check:

“Use show ip interface to verify whether an access list is applied to the interface and in which direction (in or out).”

René Meneses MTCNA Study Guide – Cisco Access List Monitoring:

“To verify ACL assignment to an interface, use show ip interface. It provides ACL status along with IP addressing info.”

Breakdown:

A: show access-lists → shows ACL contents, not interface bindings

B: show interface → shows interface stats, not ACL usage

D: Invalid syntax in Cisco IOS

Final Answer: C QUESTION NO: 139 [RouterOS Introduction – Transport Protocols]

Which protocol does DHCP use at the Transport layer?

A. IP

B. TCP

C. UDP

D. ARP

Answer: C

DHCP (Dynamic Host Configuration Protocol) operates over UDP:

Client uses UDP port 68

Server uses UDP port 67

It is a connectionless protocol, and because clients typically do not yet have IP addresses, UDP is used due to its simplicity.

MTCNA Course Material – DHCP Protocol Layering:

“DHCP uses UDP for communication between clients and servers. TCP is not used due to the stateless, broadcast nature of DHCP discovery.”

René Meneses MTCNA Study Guide – Port Assignments:

“UDP 67/68 are used by DHCP. TCP is not used because clients lack IPs initially.”

Other options:

A: IP is the network layer, not transport

B: TCP is used by reliable services (FTP, HTTP)

D: ARP resolves IP-to-MAC; unrelated to DHCP transport

Final Answer: C QUESTION NO: 140 [Cisco IOS – Remote Access Configuration]

Which of the following commands will allow you to set your Telnet password on a Cisco router?

A. line telnet 0 4

B. line aux 0 4

C. line vty 0 4

D. line con 0

Answer: C

The correct line configuration for remote Telnet (or SSH) access in Cisco IOS is via the virtual terminal (vty) lines. Typically, Cisco routers reserve 5 lines: vty 0 4. You then apply the password and login commands under this context.

Cisco IOS Configuration Guide – Telnet/VTY Setup:

“Use line vty 0 4 to configure access for Telnet sessions. Then use password and login to enforce authentication.”

René Meneses MTCNA Study Guide – Cisco Access Configuration:

“VTY lines (virtual terminal) handle Telnet and SSH sessions. Console and aux lines are for local access.”

Other options:

A: line telnet is not a valid command

B: line aux → used for modem or auxiliary port access

D: line con 0 → used for console (local) access, not remote

────────────────────────────────────────────────────────────

MikroTik processes entries in the Access List and Connect List in the order they are listed — from top to bottom. This is referred to as “sequence order.” The first rule that matches the client’s MAC address and interface conditions will be applied, and no further rules are evaluated after a match.

Incorrect options:

A. Signal strength can be used as a condition, but is not the order of evaluation.

C. Random order is never used in rule-based systems.

D. Interface names are used as match conditions, not ordering criteria.

MTCNA Wireless Module – Access and Connect List Order:

“Rules are checked from the top of the list down. The first matching rule is applied, then processing stops.”

René Meneses Guide – Wireless Security and MAC Filtering:

“Sequence matters. If multiple rules could apply, only the first one is enforced.”

Terry Combs Notes – Wireless Filtering:

“Don’t misplace rules. Connect-list and access-list are evaluated in listed order.”

Answer: B QUESTION NO: 59 [Queues – QoS]

Simple Queue number 0 defines 2M for upload and download for target IP 10.10.0.33.

Simple Queue number 1 defines 4M for upload and download for the same target IP 10.10.0.33.

Client 10.10.0.33 will be able to obtain:

A. 6M upload/download

B. 0M upload/download

C. 4M upload/download

D. 2M upload/download

Answer: D

In MikroTik RouterOS, when multiple simple queues are configured for the same target (IP address), only the first matching queue in sequence is processed. This means that:

If queue 0 (2M) comes before queue 1 (4M), the 2M limit will be enforced.

The second queue is ignored, even if it provides a higher rate.

MikroTik does not sum the bandwidth of multiple queues. The first applicable queue (based on order) wins.

MTCNA Course Manual – Simple Queues:

“Simple Queues are matched top-down. Only the first matching queue is applied per packet.”

René Meneses MTCNA Guide – QoS Queue Behavior:

“Queue order matters. The first rule that matches is the one used. Lower queues override lower ones if placed first.”

Terry Combs Notes – Queue Troubleshooting:

“If two queues match the same IP, only the first is active. Don’t stack queues unless using a queue tree.”

Answer: D QUESTION NO: 60 [RouterOS Packages]

Which features are removed when the advanced-tools package is uninstalled?

A. neighbors

B. LCD support

C. ip-scan

D. ping

E. netwatch

F. bandwidth-test

Answer: C, E, F

The advanced-tools package in MikroTik RouterOS contains a set of diagnostic and monitoring tools. If this package is removed, the following features are lost:

ip-scan → ✅ Used for scanning IP ranges to discover hosts

netwatch → ✅ Monitors host availability and runs scripts on status changes

bandwidth-test → ✅ Used to measure throughput between MikroTik devices

Incorrect options:

A. neighbors → Part of the main system package (MAC discovery)

B. LCD support → Tied to specific hardware; not affected by advanced-tools

D. ping → Part of the base system package

MTCNA System Tools Section – Package Breakdown:

“The advanced-tools package includes netwatch, bandwidth-test, and ip-scan. These are not part of the base system.”

René Meneses Guide – Package Management:

“Removing advanced-tools disables several diagnostic commands like ip-scan and bandwidth-test.”

Terry Combs Notes – Tools Overview:

“Ping and neighbors are in core OS. Advanced-tools affects monitoring scripts and traffic tools.”

Nstreme is a proprietary point-to-point wireless protocol developed by MikroTik to improve performance on long-distance wireless links. It enhances frame aggregation, reduces latency, and replaces standard 802.11 MAC timing behavior with a custom approach. Because of its specific mechanism, it imposes certain compatibility restrictions:

A. WDS between two station-wds devices is not compatible with Nstreme. This setup doesn't conform to proper AP-client architecture required by Nstreme, which operates in a master/slave role — typically ap-bridge and station.

B. Encryption (e.g., using WEP or WPA) is supported in Nstreme; however, MikroTik recommends encryption at higher layers like IPsec when performance is critical.

C. WDS between ap-bridge and station-wds is compatible with Nstreme. This is the standard pairing used when bridging two networks via wireless.

D. Bridging a station with an ap-bridge device using standard station mode (not station-wds or station-bridge) is not compatible for full Layer 2 bridging. Only station-wds or station-bridge supports bridging with ap-bridge mode.

Extract from Official MTCNA Course Material – Wireless Section:

"Nstreme is supported only between a device in ap-bridge mode and a device in station or station-wds mode. Both ends must support Nstreme. WDS is supported with station-wds and ap-bridge combinations. Encryption is supported, although optional."

Extract from Terry Combs MTCNA Notes – Nstreme Notes:

"Only ap-bridge < - > station-wds (or station-bridge in RouterOS v6+) is valid for bridging over Nstreme. Encryption like WPA2 is supported but optional."

Extract from René Meneses Study Guide – Wireless Features:

“Nstreme does not support station-station WDS. Proper implementation requires ap-bridge on one side and station-wds or station-bridge on the other. Basic encryption (WEP/WPA) is allowed.”

===========

/27 subnet = 255.255.255.224 → block size of 32

To determine the subnet range:

Start by finding block base: 15.242.55.62 falls in the 15.242.55.32/27 subnet Range: 15.242.55.32 – 15.242.55.63 Network Address = 15.242.55.32 Broadcast Address = 15.242.55.63 Usable Host Range = 15.242.55.33 to 15.242.55.62

Evaluation:

A. 15.242.55.33 – 15.242.55.62 → ✅ Valid host range

B. 15.242.55.32 – 15.242.55.63 → ❌ Includes network and broadcast addresses

C. 15.242.55.31 – 15.242.55.62 → ❌ 15.242.55.31 is outside this subnet

D. 15.242.55.33 – 15.242.55.63 → ❌ Includes broadcast address

MTCNA Course Slides – Subnetting:

“In a /27 subnet (block size 32), the first address is the network, last is broadcast. Only the IPs in between are valid host addresses.”

René Meneses Guide – Subnetting Examples:

“A /27 includes 32 addresses. For subnet 192.168.1.32/27, usable IPs are 192.168.1.33–62.”

Terry Combs Notes – Addressing Exercises:

“Subtract 2 from total IPs in subnet for host count. Don't use .0 (network) or .255 (broadcast) equivalents.”

Answer: A  

The only wireless mode that allows bridging (Layer 2) over a connection to a non-MikroTik (standard 802.11) access point is station-pseudobridge. It fakes (spoofs) a bridge by using the wireless interface's MAC address for Ethernet clients behind it.

A. ✔ station-pseudobridge – Works with any AP and can bridge Ethernet → WiFi for one client.

B. ✘ station – Only works at Layer 3 (routing or NAT).

C. ✘ station-wds – Requires WDS support, which only MikroTik devices support.

D. ✘ bridge – Not a wireless mode; it’s an interface type used in Layer 2.

Extract from Official MTCNA Course Material – Wireless Bridging:

“station-pseudobridge allows bridging to non-MikroTik APs. Suitable for simple Layer 2 extension with one client.”

Extract from René Meneses MTCNA Study Guide – Wireless Modes:

“For compatibility with standard APs, use station-pseudobridge mode. Other bridge modes require MikroTik AP.”

Extract from MikroTik Wiki – Wireless Bridging:

“station-pseudobridge is used when connecting to a standard access point while still wanting to bridge to local Ethernet.”

===========

Only tunnel types built on PPP support authentication with username and password:

A. ✔ PPPoE – Built on PPP, uses CHAP, PAP authentication.

B. ✔ OpenVPN – Supports user/password login for client authentication.

C. ✘ IPIP – A stateless Layer 3 tunnel; no authentication support.

D. ✔ PPTP/L2TP – Both are PPP-based and support username/password authentication.

E. ✘ EoIP – MikroTik proprietary Layer 2 tunnel; no username/password authentication.

Extract from MTCNA Course Material – Tunnel Types:

“PPPoE, PPTP, and L2TP are PPP-based and support user/password authentication. IPIP and EoIP do not.”

Extract from René Meneses Study Guide – Tunnel Protocols:

“Authentication (PAP/CHAP) is part of PPP. Use PPPoE, PPTP, L2TP, or OpenVPN for user logins.”

Extract from MikroTik Wiki – Tunnel Protocols Overview:

“Only PPP-based tunnels support authentication via username/password.”

===========

IPv4 Class B addresses have their first two bits as 10 in binary. The range for Class B starts at 128.0.0.0 and goes up to 191.255.255.255, which in binary representation begins with 10xxxxxx.

MTCNA Course Material – IP Addressing and Classes:

“Class B IP addresses are identified by the first two bits being 10. This corresponds to IP addresses from 128.0.0.0 to 191.255.255.255.”

René Meneses MTCNA Study Guide – Address Classes:

“Class B: 128.0.0.0 – 191.255.255.255. Binary pattern: 10xxxxxx.”

Terry Combs MTCNA Notes – IP Addressing:

“The first octet of a Class B address starts with binary 10, followed by 6 variable bits.”

Other options:

A. 01xxxxxx: incorrect (used for experimental/reserved ranges)

B. 0xxxxxxx: represents Class A

D. 110xxxxx: indicates Class C

Final Answer: C QUESTION NO: 102 [RouterOS Introduction – Protocols]

Which of the following protocols uses both TCP and UDP?

A. FTP

B. SMTP

C. Telnet

D. DNS

Answer: D

DNS (Domain Name System) can use both UDP and TCP. Typically:

UDP port 53 is used for standard DNS queries due to its lower overhead.

TCP port 53 is used for DNS zone transfers and when DNS responses exceed the UDP packet size (e.g., DNSSEC).

MTCNA Course Material – Protocol Overview:

“DNS uses UDP port 53 for standard queries and TCP port 53 for zone transfers or large responses.”

René Meneses MTCNA Study Guide – Protocol Functions:

“DNS can operate over UDP and TCP. UDP is faster and used for most lookups. TCP is used when the payload is too large or for zone transfers.”

MikroTik Wiki – DNS Protocols:

“DNS primarily uses UDP 53. For zone transfers (AXFR), TCP 53 is used.”

Other options:

A. FTP uses TCP (ports 20/21)

B. SMTP uses TCP (port 25)

C. Telnet uses TCP (port 23)

Only DNS uses both TCP and UDP.

Final Answer: D QUESTION NO: 103 [RouterOS Introduction – IP Fundamentals]

What protocol is used to find the hardware address of a local device?

A. RARP

B. ARP

C. IP

D. ICMP

Answer: B

ARP (Address Resolution Protocol) is used to resolve IP addresses to MAC (hardware) addresses on a local network.

MTCNA Course Material – ARP & Layer 2 Communication:

“ARP translates an IP address to a MAC address on local networks. It is necessary for IP communication within a broadcast domain.”

René Meneses MTCNA Study Guide – ARP Explanation:

“When sending to a local IP, the host first uses ARP to determine the hardware address. This is done through broadcast ARP requests.”

MikroTik Wiki – ARP Functionality:

“RouterOS uses ARP to associate IP addresses with hardware (MAC) addresses in the LAN.”

Other options:

A. RARP is Reverse ARP, outdated and rarely used.

C. IP is the higher-layer addressing protocol.

D. ICMP is used for ping and diagnostics.

Only ARP (Option B) is correct.

Final Answer: B QUESTION NO: 104 [RouterOS Introduction]

Which of the following are TCP/IP protocols used at the Application layer of the OSI model?

IP

TCP

Telnet

FTP

TFTP

A. 1 and 3

B. 1, 3 and 5

C. 3, 4 and 5

D. All of the above

Answer: C

In the OSI model:

Application layer protocols include Telnet, FTP, and TFTP.

IP is a Network Layer (Layer 3) protocol.

TCP is a Transport Layer (Layer 4) protocol.

MTCNA Course Material – OSI Model and Protocols:

“Application layer protocols provide services to user applications. Examples include FTP, TFTP, Telnet. TCP and IP operate at lower layers.”

René Meneses MTCNA Study Guide – TCP/IP Stack:

“Telnet, FTP, and TFTP are Application layer protocols. IP belongs to Layer 3. TCP is at Layer 4.”

Terry Combs MTCNA Notes – OSI Reference Model:

“Layer 7 (Application): FTP, HTTP, Telnet, TFTP.

Layer 4: TCP, UDP

Layer 3: IP”

Only Options 3 (Telnet), 4 (FTP), and 5 (TFTP) are Application layer protocols.

────────────────────────────────────────────────────────────