To upgrade or install a new Cisco IOS image on a router, you typically copy the IOS image file from a TFTP server into the router’s flash memory. The correct syntax is:

copy tftp flash

This command tells the router to copy the IOS image from a TFTP server into flash storage, where it can be booted.

Cisco IOS Documentation – Image Upgrade Process:

“Use the command copy tftp flash to transfer an IOS image from a TFTP server to the router’s flash memory.”

Other options:

A: copy tftp run – invalid; you cannot copy into the running-config that way

B: copy tftp start – used to copy configuration, not IOS image

C: config net – an older and deprecated command, not for IOS upgrades

Final Answer: D QUESTION NO: 122 [RouterOS Introduction – ICMP and Diagnostics]

Which protocol does Ping use?

A. TCP

B. ARP

C. ICMP

D. BootP

Answer: C

Ping is a diagnostic utility used to test reachability between devices. It sends ICMP Echo Request packets and waits for ICMP Echo Replies. ICMP (Internet Control Message Protocol) is used for these types of control messages and is encapsulated within IP.

MTCNA Course Material – Diagnostic Tools:

“Ping uses ICMP Echo Requests to verify if a destination is reachable. It does not use TCP or UDP.”

René Meneses MTCNA Study Guide – Ping and ICMP:

“Ping uses ICMP, not TCP or ARP. ICMP packets are used to check basic connectivity.”

MikroTik Wiki – Ping Tool Description:

“Ping works by sending ICMP packets. It cannot use TCP.”

Other options:

TCP: Used by protocols like HTTP, FTP

ARP: Resolves IP to MAC, not used for ping

BootP: DHCP-related protocol, not diagnostic

Final Answer: C QUESTION NO: 123 [Cisco – Frame Relay Troubleshooting]

What command will display the line, protocol, DLCI, and LMI information of an interface?

A. sh pvc

B. show interface

C. show frame-relay pvc

D. show run

Answer: C

In Cisco IOS, to display detailed Frame Relay virtual circuit information, including the line status, protocol status, DLCI (Data Link Connection Identifier), and LMI (Local Management Interface) details, the correct command is:

show frame-relay pvc

Cisco IOS Command Reference – Frame Relay:

“The show frame-relay pvc command displays information about PVC status, including DLCI numbers and LMI statistics.”

Breakdown:

A: sh pvc – shorthand and ambiguous, may not be recognized

B: show interface – general interface stats but lacks detailed LMI/DLCI info

C: show frame-relay pvc – ✔ correct, provides detailed DLCI/LMI info

D: show run – shows current configuration, not real-time PVC status

Final Answer: C QUESTION NO: 124 [Networking Fundamentals – Ethernet and Switching]

How many collision domains are created when you segment a network with a 12-port switch?

A. 1

B. 2

C. 5

D. 12

Answer: D

Each port on a switch creates its own collision domain. Unlike hubs (which extend a single collision domain), switches segment each interface, allowing full-duplex communication and eliminating collisions.

MTCNA Course Material – Ethernet Switching Concepts:

“Each switch port is a separate collision domain. A 24-port switch creates 24 separate collision domains.”

René Meneses MTCNA Study Guide – Collision and Broadcast Domains:

“Switches break up collision domains per port, unlike hubs.”

Therefore, a 12-port switch creates 12 individual collision domains.

To redirect SMTP (port 25) traffic from users to a specific internal or external SMTP server, you must use dst-nat. This modifies the destination address and port to point to the desired mail server.

A. ✘ passthrough – Allows the packet to be evaluated by other NAT rules; it doesn't alter traffic

B. ✔ dst-nat – Rewrites destination IP/port; this is what is needed to redirect SMTP to a specific server

C. ✘ redirect – Sends traffic to the router itself; not suitable for external redirection

D. ✘ tarpit – Used for slowing down malicious TCP connections, not redirection

Extract from MTCNA Course Material – NAT Types:

“Use dst-nat to change the destination IP address. This is suitable for port forwarding or service redirection.”

Extract from René Meneses Study Guide – NAT Rules:

“To redirect traffic to a specific server, use action=dst-nat and specify the new destination address.”

===========

Binary to Decimal:

10011101

= 1×2^7 + 0×2^6 + 0×2^5 + 1×2^4 + 1×2^3 + 1×2^2 + 0×2^1 + 1×2^0

= 128 + 0 + 0 + 16 + 8 + 4 + 0 + 1

= 157

Decimal to Hexadecimal:

157 ÷ 16 = 9 remainder 13 → 13 = D

So, 157 = 0x9D

MTCNA Course Material – Binary and Hex Conversion:

“Convert binary to decimal by summing powers of 2. Then convert decimal to hexadecimal by dividing by 16.”

René Meneses MTCNA Study Guide – Number Systems:

“For binary 10011101, the decimal is 157, and hex is 9D.”

Only Option B is correct: 157, 0x9D.

Final Answer: B QUESTION NO: 110 [RouterOS Introduction]

If you use either Telnet or FTP, which is the highest layer you are using to transmit data?

A. Application

B. Presentation

C. Session

D. Transport

Answer: A

Protocols like Telnet and FTP are considered Application Layer protocols in the OSI model. They operate at Layer 7, providing interfaces for user-level interaction and command control.

MTCNA Course Material – TCP/IP vs OSI Model:

“Telnet, FTP, HTTP are Application Layer protocols. They operate at the top of the OSI stack (Layer 7).”

René Meneses MTCNA Study Guide – Protocol Layers:

“Telnet and FTP reside at the Application Layer. They initiate data exchange between hosts.”

Presentation and Session layers are not separately used in the TCP/IP model and are merged into the Application Layer.

Transport (Layer 4) is used by these protocols (via TCP), but the protocol itself resides at the Application Layer.

Final Answer: A QUESTION NO: 111 [RouterOS Introduction – IP Addressing]

Which class of IP address provides a maximum of only 254 host addresses per network ID?

A. Class A

B. Class B

C. Class C

D. Class D

Answer: C

Class C networks are defined as IP addresses with the first octet in the range of 192 to 223. Their default subnet mask is 255.255.255.0 (/24), which provides:

2^8 = 256 total addresses

Minus 2 (1 for network address, 1 for broadcast)

→ 254 usable host addresses

MTCNA Course Material – IP Address Classes:

“Class C has a default mask of /24. This allows for 254 hosts per network.”

René Meneses MTCNA Study Guide – IP Classes:

“Class C = 192.0.0.0 to 223.255.255.255, 254 usable hosts per subnet.”

Other classes:

Class A: ~16 million hosts

Class B: ~65,000 hosts

Class D: used for multicast (not host assignment)

Final Answer: C QUESTION NO: 112 [RouterOS Introduction – Protocols]

Which of the following services use UDP?

DHCP

SMTP

SNMP

FTP

HTTP

TFTP

A. 1, 3 and 6

B. 2 and 4

C. 1, 2 and 4

D. All of the above

Answer: A

UDP is a connectionless protocol used by several lightweight or stateless network services. Among the listed services:

DHCP: Uses UDP (Ports 67 and 68)

SNMP: Uses UDP (Ports 161/162)

TFTP: Uses UDP (Port 69)

Other protocols:

SMTP: Uses TCP (Port 25)

FTP: Uses TCP (Ports 20 and 21)

HTTP: Uses TCP (Port 80)

MTCNA Course Material – Protocols and Ports:

“UDP is used for DHCP, SNMP, TFTP. TCP is used for SMTP, FTP, HTTP.”

René Meneses MTCNA Study Guide – Port Assignments:

“TCP: FTP, SMTP, HTTP. UDP: DHCP, SNMP, TFTP.”

Only 1, 3, and 6 use UDP.

In traditional IPv4 subnetting, a /30 is often used to connect two hosts directly, giving two usable IPs. However, MikroTik RouterOS (and as per RFC 3021) supports the use of /31 subnet masks for point-to-point links. A /31 provides exactly two IP addresses — which are both usable — and is ideal for conserving IP space on router-to-router links.

Subnet details for /31:

Total addresses: 2

Usable addresses: 2 (both can be assigned to endpoints, no broadcast)

Evaluation:

A. /31 → ✅ Supported by MikroTik for point-to-point links (2 hosts only)

B. /29 → Provides 6 usable IPs; more than needed for 2 hosts

C. /32 → Single host only; no communication possible with second device

D. /30 → Valid, but less efficient than /31

MTCNA Course Manual – IP Addressing and Point-to-Point Communication:

“MikroTik RouterOS allows the use of /31 subnets for point-to-point communication. Both IPs are usable.”

René Meneses MTCNA Guide – IP & Routing Concepts:

“For links between exactly two devices, /31 saves address space and is supported by MikroTik.”

Terry Combs Notes – Subnet Efficiency:

“Use /30 or /31 for point-to-point links. MikroTik supports /31 fully, unlike older systems.”

Answer: A QUESTION NO: 17 [Monitoring and Logging]

Which of the following protocols/ports are used for SNMP (Simple Network Management Protocol)?

A. TCP 25

B. TCP 161

C. UDP 162

D. TCP 162

E. TCP 123

F. UDP 161

Answer: C, F

SNMP uses UDP as its transport protocol. The standard ports are:

UDP port 161 → used for SNMP queries (polling)

UDP port 162 → used for SNMP traps (asynchronous alerts)

Incorrect options:

A. TCP 25 → SMTP (email), not related to SNMP

B. TCP 161 → SNMP does not use TCP

D. TCP 162 → Incorrect; SNMP traps use UDP

E. TCP 123 → NTP (Network Time Protocol)

Correct answers:

C. UDP 162 ✅

F. UDP 161 ✅

MTCNA Course – Monitoring Tools & SNMP:

“SNMP operates over UDP. Port 161 is used for polling, and port 162 is used for traps.”

René Meneses MTCNA Guide – SNMP Overview:

“SNMP uses UDP 161 and 162 for communication between manager and agents.”

Terry Combs Notes – Protocol and Port Summary:

“Remember: SNMP = UDP 161/162. Do not confuse with TCP-based protocols.”

Answer: C, F QUESTION NO: 18 [RouterOS Introduction]

Which of the following are valid IP addresses?

A. 10.10.14.0

B. 192.168.256.1

C. 192.168.13.255

D. 1.27.14.254

Answer: A, C, D

An IPv4 address is a 32-bit number divided into 4 octets. Each octet must be between 0 and 255.

Let’s evaluate:

A. 10.10.14.0 → ✅ Valid; .0 is legal, may represent a network or host depending on subnet

B. 192.168.256.1 → ❌ Invalid; 256 exceeds the max octet value (0–255)

C. 192.168.13.255 → ✅ Valid broadcast or host IP, depending on subnet

D. 1.27.14.254 → ✅ All octets are within valid range

MTCNA Training Manual – IP Basics:

“Each octet must be between 0 and 255. Addresses like 192.168.256.1 are invalid.”

René Meneses Guide – Valid IP Criteria:

“Watch for octets above 255 — they are illegal in IPv4.”

Terry Combs Notes – Address Format Validation:

“Decimal format must be checked — 256, 999, or negative values break IPv4 standards.”

Answer: A, C, D QUESTION NO: 19 [Routing]

The network address is:

A. The first address of the subnet

B. The first usable address of the subnet

C. The last address of the subnet

Answer: A

The network address is the first IP address in a subnet. It identifies the entire network segment and cannot be assigned to any host.

For example, in 192.168.1.0/24:

192.168.1.0 → Network Address (non-assignable) ✅

192.168.1.1 – 192.168.1.254 → Usable host addresses

192.168.1.255 → Broadcast address

Clarifying:

A. First address of the subnet → ✅ Correct

B. First usable address → ❌ That would be second address

C. Last address of the subnet → ❌ That’s the broadcast

MTCNA Course Manual – Subnet Addressing:

“The first address in a subnet is reserved as the network ID. It cannot be assigned to a host.”

René Meneses Guide – Network and Broadcast Addresses:

“Network address = first IP in block, broadcast = last. Usable range lies in between.”

Terry Combs Notes – Host and Network Addressing:

“Always subtract 2 IPs: one for network and one for broadcast. Never assign .0 (network address) to a host.”

MikroTik’s NAT (Network Address Translation) is part of the connection tracking mechanism. NAT rules are applied only to the first packet of a connection. Subsequent packets belonging to the same connection are automatically handled by the connection tracking module using the same translation mappings established by that first packet.

Option Analysis:

A. ✔ True – NAT is evaluated only on the first packet of a new connection.

B. ✘ False – Subsequent packets are not re-evaluated against NAT rules.

Extract from Official MTCNA Course Material – Firewall & NAT Section:

“NAT rules apply to the first packet in a connection. After that, RouterOS uses the tracked connection entry.”

Extract from René Meneses MTCNA Study Guide – NAT & Firewall Concepts:

“Once the initial packet matches a NAT rule, connection tracking applies it to the whole session.”

Extract from MikroTik Wiki – NAT Implementation:

“NAT is evaluated on the first packet. Other packets in the same connection follow the established NAT mapping.”

===========

PPPoE (Point-to-Point Protocol over Ethernet) relies on Ethernet broadcast and discovery mechanisms. It uses a discovery stage (PPPoE Active Discovery Initiation – PADI) which is sent as a broadcast. Therefore, PPPoE only works within the same Layer 2 broadcast domain.

If a router (Layer 3 device) exists between the client and PPPoE server, it breaks the Layer 2 broadcast domain, making it impossible for the client to reach the server.

A. ✘ False – Routers break the broadcast domain; PPPoE will fail.

B. ✔ True – PPPoE requires L2 adjacency.

Extract from Official MTCNA Course Material – PPPoE Concepts:

“PPPoE operates only over Ethernet broadcast domains. If routed, PADI packets will not reach the PPPoE server.”

Extract from René Meneses MTCNA Study Guide – PPPoE:

“PPPoE discovery is broadcast-based and does not traverse routers.”

Extract from MikroTik Wiki – PPPoE Limitations:

“PPPoE cannot function over routed networks. Server and client must be in the same broadcast domain.”

===========

Simple Queues in MikroTik are the most straightforward way to manage bandwidth per IP address or subnet. To apply bandwidth limitations, you primarily need:

target-address (the IP address or subnet you're shaping)

max-limit (the maximum allowable upload/download bandwidth)

Other fields like dst-address can be used for advanced matching, but they are not required for basic bandwidth limiting.

A. Correct. This is the minimum required configuration.

B. Incorrect. dst-address is optional and unnecessary unless shaping traffic only to specific destinations.

C. Incorrect. Lacks max-limit, which is essential for any bandwidth cap.

D. Incorrect. Without target-address, the queue doesn’t know which host or network to apply the rule to.

Extract from Official MTCNA Course Material – QoS Section:

"To shape traffic in a simple queue, the most basic configuration requires target-address and max-limit. Target-address specifies which host or network to affect. Max-limit defines upload/download caps."

Extract from René Meneses MTCNA Study Guide – QoS:

"A simple queue needs at least two values: target (the IP or range) and max-limit (limits for up/down in bits per second). Everything else is optional for basic shaping."

Extract from Terry Combs Notes – Queues:

“Without a max-limit value, the queue does not restrict bandwidth. dst-address is rarely used in simple queues unless traffic is routed externally.”

===========

The connect-list in RouterOS is used to define rules for wireless client behavior when connecting to available Access Points. You can define multiple entries in the connect-list, and RouterOS processes them in top-down order. This allows prioritization of APs based on criteria such as SSID, signal strength, and MAC address.

MTCNA Course Material – Wireless Client Settings:

“The connect-list determines the order in which the wireless client will try to associate with Access Points. Entries are processed from top to bottom, allowing prioritized connection attempts.”

René Meneses MTCNA Study Guide – Wireless & Connect-List Section:

“By placing the most preferred AP at the top of the connect-list, you ensure it is attempted first. Reordering entries is used to manage roaming behavior and priority.”

MikroTik Wiki – Wireless Client & Connect List:

“The client will attempt to connect to the first matching entry in the connect list. This means the connect list can be used to define AP priorities.”

Therefore, the statement is true.

Final Answer: B QUESTION NO: 98 [Hotspot]

What configuration is added by /ip Hot-Spot setup command? (Select all that apply)

A. /ip service

B. /ip Hot-Spot user

C. /ip Hot-Spot walled-garden

D. /ip dhcp-server

E. /queue tree

Answer: B, C, D

The /ip hotspot setup command is a wizard used to quickly deploy a HotSpot service on a selected interface. It automatically creates several configurations necessary for a functional HotSpot environment:

Creates a default user in /ip hotspot user

Adds entries in /ip hotspot walled-garden to allow access to login page

Configures a DHCP server on the selected interface if not present

MTCNA Course Material – HotSpot Setup Wizard:

“The hotspot setup creates a user, configures a DHCP server, and sets up walled garden entries. It does not touch system services or create queue trees by default.”

René Meneses MTCNA Guide – HotSpot Setup Section:

“After running hotspot setup, you will find new configurations in /ip hotspot user, /ip hotspot walled-garden, and /ip dhcp-server. The system automatically assigns IP pools and login pages.”

MikroTik Wiki – HotSpot Setup Overview:

“The setup creates a DHCP server, login page, user entry, and basic NAT and walled garden rules.”

Option A: /ip service is unrelated

Option E: /queue tree is not configured by the setup wizard

Final Answer: B, C, D QUESTION NO: 99 [PPP]

What kind of users are listed in the Secrets window of the PPP menu?

A. Hot-Spot users

B. wireless users

C. l2tp users

D. pptp users

E. pppoe users

F. winbox users

Answer: C, D, E

The /ppp secret menu is used in RouterOS to manage usernames and passwords for Point-to-Point Protocol (PPP) based services, including:

PPPoE (Point-to-Point Protocol over Ethernet)

PPTP (Point-to-Point Tunneling Protocol)

L2TP (Layer 2 Tunneling Protocol)

It does not include HotSpot users, wireless clients, or Winbox users.

MTCNA Course Material – PPP User Authentication:

“The PPP secret database stores credentials for services like PPPoE, PPTP, and L2TP.”

René Meneses MTCNA Study Guide – PPP Configuration Section:

“Users for PPP-based protocols are configured under PPP → Secrets. This includes PPPoE, PPTP, and L2TP.”

MikroTik Wiki – PPP Secrets Window:

“Secrets are used to authenticate users for all PPP interfaces. HotSpot users are managed separately under /ip hotspot user.”

Option A: HotSpot users → /ip hotspot user

Option B: Wireless users connect via WPA/802.11 — not listed in PPP

Option F: Winbox users refer to /user under system user management

Final Answer: C, D, E QUESTION NO: 100 [RouterOS Introduction]

Select valid MAC-address:

A. G2:60:CF:21:99:H0

B. 00:00:5E:80:EE:B0

C. AEC8:21F1:AA44:54FF:1111:DDAE:0212:1201

D. 192.168.0.0/16

Answer: B

A valid MAC address must meet the following criteria:

Be 6 bytes (48 bits) in length

Consist of only hexadecimal digits (0–9, A–F)

Written in six groups separated by colons or hyphens (e.g., 00:1A:2B:3C:4D:5E)

MTCNA Course Material – RouterOS MAC Address Basics:

“MAC addresses are 48-bit identifiers written as six pairs of hexadecimal digits. Invalid characters or incorrect length disqualifies an address.”

René Meneses MTCNA Guide – MAC Addressing Section:

“Each MAC is made up of 12 hexadecimal characters (6 octets). If a character like ‘G’ appears, or if it’s longer than 6 bytes, it is invalid.”

MikroTik Wiki – MAC Addressing Rules:

“Valid MAC format: XX:XX:XX:XX:XX:XX using only 0-9 and A-F. 192.168.0.0/16 is an IP subnet, not a MAC.”

Option A: Invalid — “G” and “H” are not hexadecimal characters

Option B: Valid — proper format and hex content

Option C: Invalid — Too long (appears to be IPv6 or malformed)

Option D: Invalid — this is an IP network (CIDR notation), not a MAC

Only Option B is correct.

The OSI Layer 1, also known as the Physical Layer, is responsible for the transmission and reception of raw binary data over a physical medium. The most fundamental unit at this layer is the bit.

Bit = Binary Digit (0 or 1)

It is transmitted over physical media (cables, radio signals, etc.)

Frames (A) exist at Layer 2 (Data Link Layer), not Layer 1.

Bytes (C) are groups of 8 bits, but bits are still the smallest indivisible transmission unit.

Headers (D) are metadata used at Layers 2–7; not relevant to Layer 1.

MTCNA Official Training Manual – OSI Model Chapter:

“Layer 1 transmits raw bits over a transmission medium. These bits form the foundation for higher-layer data structures.”

René Meneses MTCNA Guide – OSI Model Breakdown:

“Physical Layer (Layer 1) carries bits, not frames or bytes. It's concerned with voltages, cables, connectors, and signal encoding.”

Terry Combs Notes – OSI Layers:

“Layer 1 = Bits. Nothing more. Frames come into play in Layer 2.”

Answer: B  

When a router forwards traffic between two interfaces (such as from LAN to WAN), it uses the forward chain. HTTP traffic initiated by users destined to external servers passes through this chain.

A. ✘ prerouting – Used mainly for routing decisions and NAT, not filtering.

B. ✔ forward – Used to filter transit traffic.

C. ✘ output – For traffic originating from the router itself.

D. ✘ input – For traffic destined to the router itself.

Extract from MTCNA Course Material – Firewall Chains:

“Client-to-server traffic, like browsing the web, passes through the forward chain when routed through the router.”

Extract from René Meneses Study Guide – Firewall Structure:

“To block or allow traffic passing through the router (LAN to Internet), use the forward chain.”

Extract from MikroTik Wiki – Firewall Filtering Overview:

“forward: filters all transit traffic routed through the router.”

===========