The connection-state=established matcher in MikroTik’s firewall refers to packets that are part of an already active connection. These packets are neither new nor related — they are directly associated with a known connection that has been previously accepted or initiated.
MikroTik uses Connection Tracking (enabled by default) to determine the state of each packet:
new: Packet begins a new connection (e.g., TCP SYN)
established: Packet belongs to a previously established connection (reply or subsequent packets)
related: Packet is not part of the connection, but is related (e.g., FTP data channel)
invalid: Packet that does not match any known or valid connection
Therefore:
A. ✅ Correct. “Established” means part of an ongoing, known connection.
B. ❌ This describes “related”
C. ❌ This describes “invalid”
D. ❌ This describes “new”
MTCNA Course Manual – Firewall and Connection Tracking:
“Established – Packet that belongs to an existing connection. This includes replies and ongoing streams.”
René Meneses Study Guide – Firewall Fundamentals:
“Use connection-state=established to allow traffic that is part of previously accepted sessions.”
Terry Combs Notes – Connection States:
“Established = trusted, ongoing session. Essential for return traffic.”
Answer: A QUESTION NO: 32 [PPP]
PPP Secrets are used for:
A. PPPoE clients
B. L2TP clients
C. IPSec clients
D. PPP clients
E. PPTP clients
F. Router users
Answer: A, B, D, E
PPP Secrets is a user authentication mechanism used in MikroTik RouterOS for various PPP-based services. These include:
PPP (Point-to-Point Protocol)
PPPoE (PPP over Ethernet)
PPTP (Point-to-Point Tunneling Protocol)
L2TP (Layer 2 Tunneling Protocol)
Each client authenticates with a username/password combination defined under PPP → Secrets. PPP Secrets is not used for:
IPSec clients → ❌ They use peer configurations and policies
Router users (Winbox/WebFig) → ❌ Use system → users, not PPP secrets
MTCNA PPP Chapter – Secrets Authentication:
“PPP Secrets are used for all PPP services: PPP, PPPoE, L2TP, and PPTP. It defines usernames, passwords, profiles, and IP bindings.”
René Meneses Guide – Tunnels and PPP:
“Any PPP-based tunnel uses PPP secrets for login validation. This includes local dial-in and remote VPN tunnels.”
Terry Combs Notes – PPP Authentication Table:
“PPP Secrets = for PPP, PPPoE, PPTP, and L2TP. Not for IPSec or Winbox.”
Answer: A, B, D, E QUESTION NO: 33 [Licensing]
How long is level 1 (free) license valid?
A. 1 month
B. 24 hours
C. 1 year
D. Infinite time
Answer: D
Level 1 license in MikroTik RouterOS is a free license type. It is included with every installation but has very limited functionality. Despite the limitations, it is valid for an unlimited duration.
Features available in level 1:
Incorrect options:
A. 1 month → ❌ Not time-based
B. 24 hours → ❌ No expiration limit
C. 1 year → ❌ Invalid
D. ✅ Correct → Valid forever, but feature-limited
MTCNA Course Material – Licensing Section:
“Level 1 license is free and does not expire. It provides minimal feature access.”
René Meneses Study Guide – License Levels:
“Level 1 is permanent but restrictive. Great for evaluation or learning.”
Terry Combs Notes – RouterOS Licensing Table:
“Level 1 license = lifetime access to basic RouterOS functionality.”
Answer: D QUESTION NO: 34 [NAT]
What is the correct action for a NAT rule on a router that should intercept SMTP traffic and send it over to a specified mail server?
A. tarpit
B. dst-nat
C. passthrough
D. redirect
Answer: B
To forward traffic from one destination to another (such as from the public IP to an internal mail server), the dst-nat action is used in MikroTik NAT rules.
dst-nat: Modifies the destination IP address and/or port of the packet. Used to forward traffic to an internal resource.
tarpit: Captures and holds TCP connections (used for spam traps or slowing down bots) → ❌
passthrough: Used in mangle rules; allows the packet to be evaluated by the next rule → ❌
redirect: Redirects traffic to the router itself (e.g., proxy or DNS services) → ❌
So, for external SMTP traffic (e.g., TCP port 25), we use a dst-nat rule that forwards the traffic to the internal mail server.
MTCNA NAT Section – Destination NAT:
“To forward SMTP traffic from a public address to a private server, use dst-nat with appropriate port and IP.”
René Meneses Guide – Practical NAT Examples:
“Use dst-nat for port forwarding. Redirect is for internal services like DNS or web proxy.”
Terry Combs Notes – NAT Action Summary:
“dst-nat = most common for external-to-internal mapping (e.g., mail servers, web servers).”
