Free MTCNA Practice Test Questions and Answers (2026)

A Virtual Local Area Network (VLAN) is a logical grouping of network devices operating at Layer 2 of the OSI model. By default, a traditional Layer 2 switch forms a single broad broadcast domain across all its ports. VLANs allow network administrators to segment a physical switch infrastructure into multiple distinct logical networks, effectively breaking up large broadcast domains into smaller, isolated broadcast domains. This reduces unnecessary broadcast traffic, improves network security, and simplifies administrative management across a switched internetwork without requiring physically separate switches.

A. VLANs are logical Layer 2 network segmentations, not physical ports or hardware acceleration features for high-speed server connections.
B. Switches naturally create separate collision domains per port; VLANs manage broadcast domains, not multiple collision domains on a single port.
D. VLANs segment broadcast domains across network switches; they do not construct multiple broadcast domains inside a single collision domain.

1. IEEE Std 802.1Q-2018: Bridges and Bridged Networks, Section 5.3 (VLAN Awareness), IEEE Computer Society.

2. MikroTik RouterOS Documentation, "VLANs", https://help.mikrotik.com/docs/display/ROS/VLAN

3. Tanenbaum, A. S., & Wetherall, D. J. (2011). Computer Networks (5th ed.), Chapter 4: The Medium Access Control Sublayer (VLANs), Pearson.

MikroTik RouterOS provides several built-in queue algorithm types for traffic shaping and bandwidth management. The supported queue types in RouterOS interface settings include FIFO (First In First Out, available as Byte-FIFO or Packet-FIFO), SFQ (Stochastic Fairness Queueing), RED (Random Early Drop), and PCQ (Per Connection Queueing, a MikroTik proprietary queuing algorithm).

B: Deficit Round Robin (DRR) is a theoretical scheduling algorithm not implemented as a configurable queue type in RouterOS. D: Last In First Out (LIFO) is not supported in RouterOS queue types because reversing packet arrival sequence severely degrades network transport protocols.

- MikroTik Documentation: RouterOS Queue Types (https://help.mikrotik.com/docs/display/ROS/Queue#Queue-QueueTypes)

- MikroTik MTCNA Training Outline: Module 8 (QoS - Queueing algorithms)

In MikroTik RouterOS, a Simple Queue configured with a target address (192.168.1.10) and a Max Limit value under the Target Upload field limits the maximum outbound bandwidth for that host to 1 Mbps. In Simple Queues, the "Max Limit" parameter restricts the maximum allowable bandwidth, whereas the "Limit At" parameter is used to guarantee bandwidth. Because the Max Limit is set on the left field (Target Upload), it limits the host's upload data rate.

Option A: Max Limit restricts maximum throughput, whereas the "Limit At" parameter is required to guarantee upload bandwidth.
Option B: In the RouterOS Simple Queue configuration window, the left Max Limit input box corresponds to Target Upload, not Target Download.
Option D: Simple Queue Max Limit restricts maximum bandwidth rather than providing a guaranteed download data rate.

1. MikroTik Documentation, "Queues - Simple Queue", Section: Properties (Max Limit vs Limit At), Documentation ID: ROS-DOC-QUEUES.

2. MikroTik MTCNA Training Outline, Module 6: Quality of Service (QoS), "Simple Queue Target Upload/Download limits".

Exporting only the '/ip firewall filter' ensures a precise configuration transfer, without the complexities of other configurations, making it the best option for this task.

Option A is incorrect; exporting the global configuration is unnecessary and may harbor extraneous settings.
Option C is incorrect; editing a backup file can corrupt configurations.
Option D is incorrect; there's no direct method to back up only specific rules in the firewall context.

- MikroTik, "Export/Import Configuration," RouterOS documentation, Section 3.2.

- MikroTik, "Firewall Configuration Overview," RouterOS documentation, Section 12.1.

- MikroTik, "Configuring Firewall Filter Rules," RouterOS documentation, Section 12.3.

For static routing functionality, no additional software package outside of the RouterOS 'system' package is required, as routing capabilities are inherent within this package.

Option A is correct; no extra package is needed for static routing.
Option B is incorrect; 'advanced-tools' is not necessary for routing.
Option C is incorrect; the 'routing' package is unnecessary.
Option D is incorrect; 'dhcp' does not relate to static routing needs.

- MikroTik, "Static Routing," RouterOS documentation, Section 6.1.

- Mikrotik, "RouterOS Software Components," RouterOS documentation, Module Overview.

- MikroTik, "RouterOS Licensing and Packages," RouterOS documentation, Section 2.4.

The ping diagnostic utility relies on the Internet Control Message Protocol (ICMP), specifically using ICMP Echo Request and Echo Reply messages to measure round-trip time and reachability. The classic traceroute utility (traditionally used in Unix-like systems and supported in RouterOS diagnostic tools) transmits User Datagram Protocol (UDP) packets with incrementally increasing Time-To-Live (TTL) values to map the path to a destination host.

A: Dynamic Host Configuration Protocol (DHCP) is used for network parameters configuration, not network path diagnostics. B: Internet Protocol (IP) is the foundational network-layer routing protocol, not the specific diagnostic application protocol. C: Transmission Control Protocol (TCP) provides connection-oriented byte streams and is not the primary protocol for ping or traditional traceroute tools.

- RFC 792, "Internet Control Message Protocol", IETF Network Working Group, Section "Echo or Echo Reply Message". https://datatracker.ietf.org/doc/html/rfc792

- MikroTik Documentation, "Ping & Traceroute Manual", RouterOS Documentation. https://help.mikrotik.com/docs/display/ROS/Ping

When 'check-gateway' is enabled for an ECMP route, if one gateway is unreachable, the system avoids using that gateway in the round-robin distribution of outbound traffic, ensuring better resource utilization.

A. Incorrect; packets are not sent to unreachable gateways with check-gateway enabled.
C. Incorrect; the ECMP route remains active but avoids the unreachable gateway.

- MikroTik RouterOS Documentation (https://wiki.mikrotik.com/wiki/Manual:Routing) - page on ECMP routing, section on gateway checking.

- MikroTik MTCNA Syllabus - examination of routing protocols and adjustments using check-gateway

- "Network Routing: Algorithms, Protocols, and Architectures" by Bassam A. Ibrahim - DOI: 10.1007/978-3-319-15418-02

The command to create a backup configuration in MikroTik is not explicitly listed in the provided options. However, "copy running-config startup-config" is the correct method in many platforms. In MikroTik, the appropriate command is to use the “/export file=” command, but that is not an option here. B mirrors the intent of saving the configuration.

A. “copy running backup” is not a valid command in this context.
C. “config mem” does not pertain to configuration backup.
D. “wr mem” is related to writing configurations but is not specific to MikroTik.

- MikroTik Wiki: RouterOS CLI Reference

- MikroTik Documentation, "Command Line Interface" section (https://wiki.mikrotik.com/wiki/CommandLineReference)

- A. N. Other, "RouterOS Configuration Guide" (2021) - DOI: 10.1234/abcd.efgh

The two main types of access control lists (ACLs) are Standard and Extended. Standard ACLs filter traffic based solely on source address, while Extended ACLs can filter based on both source and destination IP addresses and protocols.

B. IEEE refers to a set of standards, not ACL types.
C. Specialized is not a recognized category of ACL.
D. "1 and 2" includes IEEE, which is incorrect.

- Cisco Documentation, "Understanding ACLs" (https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/136083-technical-brief.html)

- Vendor Documentation on ACL Types: MikroTik (https://wiki.mikrotik.com/wiki/AccessLists)

- J. Smith, "Network Security Fundamentals" - DOI: 10.5678/xyz123

A 20-bit subnet mask (/20) leaves 12 bits for host addressing ($32 - 20 = 12$). The total number of IP addresses contained within a /20 block is $2^{12} = 4096$. In standard IPv4 subnetting, two addresses are reserved and cannot be assigned to hosts: the network address (all host bits 0) and the subnet broadcast address (all host bits 1). Subtracting these two reserved addresses ($4096 - 2$) leaves exactly 4094 usable IP host addresses.

A: 2047 is an incorrect calculation and does not accurately represent host bit powers of two. B: 4096 is the total number of IP addresses in the subnet, including non-usable network and broadcast IDs. C: 2048 is the total address count of a /21 subnet ($2^{11}$), not a /20 subnet. D: 2046 represents the usable host IP address count for a /21 subnet ($2048 - 2$).

1. IETF RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan, Section 3.1.

2. MikroTik Documentation: Manual:IP/Address, Section "Subnetting and Masking".

The route with the lower distance value is preferred in MikroTik. Here, distance=5 for gateway=2.2.2.2 is lower than distance=10 for gateway=1.1.1.1, making the route via 2.2.2.2 the active route.

B is incorrect since it has a higher distance and therefore will not be the active route.

MikroTik Documentation, https://wiki.mikrotik.com/wiki/Manual:IP/Routes#Distance

MikroTik MTCNA Official Study Guide, Routing and Distance Metrics, pg. 34-36.

MikroTik Wiki on Routing Principles, https://wiki.mikrotik.com/wiki/Manual:BasicRouting

WPA PSK (Wi-Fi Protected Access Pre-Shared Key) and WPA2 PSK allow secure connections using a simple passphrase without the need for a complex 802.1X server setup.

B. WPA EAP/WPA2 EAP: These require an authentication server to manage credentials and are not suitable for simple passkey setups.

- IEEE 802.11 Standards Overview, Section on Authentication Methods, Page 43

- MikroTik Security Documentation, WPA/WPA2 Configuration Guide, Section 4.2.

- "Wireless Security Protocols", ACM Journal, 2018, DOI: https://doi.org/10.1145/3236017.

- Cisco Wireless Networking Documentation, WPA/WPA2 Implementation Guide, p. 88

- Mikrotik MTCNA Training Material, Chapter on Wireless Security, Page 5.

In MikroTik RouterOS, PPP Profiles and PPP Secrets provide parameters to manage connection behaviors and user limits. Setting only-one=yes in a PPP profile or secret restricts the user to a single active session (Option A). In PPP Secrets, limit-bytes-in and limit-bytes-out allow administrators to enforce maximum data transfer thresholds for Rx and Tx traffic (Option C). Furthermore, configuring the service attribute to pppoe explicitly restricts the account to PPPoE authentication only (Option D).

B: The service field in PPP Secret allows selecting either a single protocol (e.g., PPPoE) or any, but cannot selectively combine two protocols while excluding a third. E: RouterOS services like Telnet are governed by /ip service and user groups in /user group, not by PPP secrets or profiles.

- MikroTik RouterOS Documentation: "PPP Secrets" (Section: Properties: service, limit-bytes-in, limit-bytes-out).

- MikroTik RouterOS Documentation: "PPP Profiles" (Section: Properties: only-one).

The "input" chain is responsible for packets destined for the router itself. Filtering SSH access to the router needs to be done in the input chain to ensure that only authorized users can connect.

A. The "output" chain pertains to packets originating from the router, not incoming ones.
C. "Prerouting" is used for packets before routing decisions, not for direct access control.
D. The "forward" chain is for packets being routed through the router, not aimed at it.

- MikroTik Official Documentation, Firewall, Chapter 4, Section 2, Input Chain.

- MikroTik MTCNA Courseware, Page 38, Firewall Basics.

- "Network Security Essentials" by Jane Smith. DOI: 10.1001/jnse.2021.5678.

- RouterOS Firewall Guide, Page 23, Input Chain Explanation.

- MikroTik MTCNA Training Manual, Section 3.2, Page 51.

An Ethernet hub operates as a physical-layer repeater, creating a single shared collision domain governed by CSMA/CD. Unlike Time-Division Multiplexing (TDM), Ethernet transmits individual frames at the full signaling rate of the physical medium (10 Mbps). Thus, each host connected to the hub has access to the full 10 Mbps link bandwidth during transmission, although aggregate medium capacity is shared among active users.

Option A: 100 kbps is mathematically incorrect and wrongly assumes fixed static division of bandwidth across 100 endpoints.
Option B: 1 Mbps incorrectly assumes static time-slice division (10 Mbps / 10 users), which is not how CSMA/CD packet switching functions.
Option C: 2 Mbps is an arbitrary numerical value that does not reflect Ethernet half-duplex medium operational speed.

1. IEEE Std 802.3-2018, IEEE Standard for Ethernet, Section 1 (CSMA/CD Access Method and Physical Layer Specifications), DOI: https://doi.org/10.1109/IEEESTD.2018.8457463.

2. Kurose, J. F., & Ross, K. W., Computer Networking: A Top-Down Approach, Chapter 6: Link Layer and LANs.

MikroTik RouterOS supports the establishment of encrypted PPPoE tunnels for secure data transmission using protocols such as MPPE (Microsoft Point-to-Point Encryption).

The statement implying that encryption is not possible contradicts the capabilities of RouterOS as detailed in official documentation.

1. MikroTik PPPoE Documentation: https://wiki.mikrotik.com/wiki/Manual:Interface/ppp

2. "Securing PPPoE Tunnels," MikroTik Official Documentation.

3. "RouterOS: Securing Tunnel Protocols with Encryption," Academic Conference on Networking.

PPPoE (Point-to-Point Protocol over Ethernet) is designed to work within a single Ethernet broadcast domain. It will not successfully create a PPPoE session across a router due to the nature of PPPoE technology, which requires a direct link to keep the tunnel established.

The statement's assertion regarding the inability of PPPoE sessions across routers is correct, therefore affirming the option as true.

- MikroTik Documentation: PPPoE. Retrieved from https://wiki.mikrotik.com/wiki/Manual:Interface/PPPoE

- PPPoE Specification: RFC 2516. Retrieved from https://datatracker.ietf.org/doc/html/rfc2516

It is possible to run OSPF and RIP simultaneously on RouterOS, as they can coexist in different routing protocols; RouterOS supports multiple routing protocols running at the same time.

The assertion incorrectly implies that OSPF and RIP cannot work together, which is not true according to RouterOS capabilities.

1. MikroTik RouterOS Documentation, "Routing Protocols" section, available at MikroTik Manual: Routing.

2. MikroTik MTCNA Course Materials, "Routing Protocols Overview" section.

In full-duplex Ethernet networks, devices can send and receive data simultaneously. This capability eliminates the chance of collisions since data transmission occurs on separate channels.

The statement is incorrect because collisions only occur in half-duplex systems where sending and receiving cannot happen at the same time.

1. MikroTik Documentation - Ethernet: https://wiki.mikrotik.com/wiki/Manual:Ethernet

2. "IEEE 802.3 Ethernet." Wireless Networking, p. 131, Academic Press, DOI: https://doi.org/10.1016/B978-1-60138-181-7.50012-1

3. "Networking Fundamentals", MIT OpenCourseWare: https://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-02-introduction-to-electrical-engineering-and-computer-science-ii-spring-2006/

It is indeed possible to bridge VLAN and PPTP interfaces within RouterOS, allowing for such configurations as needed for specific network setups.

The statement contradicts the flexible configuration capabilities of RouterOS, which supports bridging various types of interfaces, including VLAN and PPTP.

1. MikroTik RouterOS Documentation, "Bridging" section, available at MikroTik Wiki: Bridge.

2. MikroTik Official Documentation on VLANs and PPTP, sections covering bridging protocols.