Which of the following services use UDP? DHCP SMTP SNMP FTP HTTP TFTP
Correct Answer: C
Question 17
Consider the following network diagram. In R1, you have the following configuration: /ip route add dst-address=192.168.1.0/24 gateway=192.168.99.2 /ip firewall nat add chain=srcnat out-interface=Ether1 action=masquerade On R2, if you wish to prevent all access to a server located at 192.168.1.10 from LAN1 devices, which of the following rules would be needed?
Correct Answer: B
The key requirement is to block traffic from LAN1 to the internal server at 192.168.1.10. Given that R1 uses masquerade (srcnat), all packets arriving at R2 from LAN1 will appear as if they come from R1's IP (192.168.99.1). Therefore, filtering by the original IP (LAN1 clients like 192.168.0.x) won't work unless you stop the traffic before it's NATed. So the correct way is to drop the packets before they reach the server by identifying the original subnet (LAN1), which is 192.168.0.0/24, in the forward chain. * A. Wrong: You're filtering based on the post-NAT address (192.168.99.1), not the source LAN subnet. * B. Correct: Block traffic coming from 192.168.0.0/24 (LAN1) before it hits the NAT rule.# * C. Wrong chain: input is only for traffic destined to the router itself. * D. Incorrect chain: dstnat is for translating destination IP, not filtering. MTCNA Firewall Module - NAT and Forwarding Concepts: "Filter before NAT to match pre-NAT source addresses. Masquerade masks real source IP." Rene Meneses MTCNA Guide - Practical Firewall Rules: "When masquerade is applied, forward chain rules using original IP must be placed before the NAT rule." Terry Combs Notes - Firewall Filtering: "Forward chain handles routed traffic. Use it to block routed traffic between subnets."
Question 18
Where can you monitor (see addresses and ports) real-time connections which are processed by the router?
Correct Answer: A
Firewall Connection Tracking (also known as conntrack) is used to monitor real-time connections that pass through the router. It shows source and destination IPs, ports, protocols, connection states (established, new, related), and more. Let's evaluate the options: * A.#Correct - Shows live connection table with IPs, ports, and statuses * B.#Shows rule match counters only - no detailed connection info * C.#Torch shows per-interface traffic; useful for bandwidth, but not a connection list * D.#Queue Tree is used for traffic shaping, not for viewing connections MTCNA Course Manual - Firewall Concepts: "Connection tracking shows all active sessions through the router with IP and port details." Rene Meneses Guide - Firewall Tools: "Use connection tracking to diagnose connection states and NAT behavior." Terry Combs Notes - Monitoring Tools: "conntrack is your real-time connection monitor. Torch is per-interface, not per-flow."
Question 19
How long is an IPv6 address?
Correct Answer: C
Question 20
One host on an internal network is accessing an external web page through a MikroTik router that is doing source NAT. Select correct statement about the packets that flow from that web page to the host ?
