I85PREP
⌘ K
PCN PEP study materials
PCN PEP study resources

PCN PEP practice questions

One question at a time. Build your PCN PEP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Process Control Network Fundamentals

In the Purdue Enterprise Reference Architecture model, which level contains the basic process control system and controllers that directly manipulate the physical process?

  1. Level 1 Correct answer.
  2. Level 2
  3. Level 0
  4. Level 3

Explanation

Level 1 is the basic control layer, where controllers, PLCs, and DCS modules execute regulatory and discrete control on the process. Level 0 is the physical process itself with sensors and final elements, and Level 2 handles supervisory functions such as operator HMI and alarm management.

Question 2Process Control Network Fundamentals

What is the primary purpose of a DMZ in a process control network architecture?

  1. To provide an isolated buffer zone hosting shared services between IT and OT networks Correct answer.
  2. To terminate fieldbus segments before they reach the controllers
  3. To store historical process data replicated from the control system
  4. To replace the control network firewall with a passive monitoring device

Explanation

A DMZ sits between the enterprise IT zone and the OT control zone, hosting services such as remote access brokers and patch mirrors while preventing direct traffic between the two. This limits the blast radius if an IT-side host is compromised.

Question 3Process Control Network Fundamentals

Which protocol is a commonly deployed industrial Ethernet protocol for discrete and process control that runs over standard Ethernet and is maintained as an open standard?

  1. HART
  2. EtherNet/IP Correct answer.
  3. PROFIBUS DP
  4. Modbus RTU

Explanation

EtherNet/IP is an industrial Ethernet protocol that encapsulates the Common Industrial Protocol and runs over standard Ethernet hardware. Modbus RTU, PROFIBUS DP, and HART are serial fieldbus or analog signaling technologies, not Ethernet-based.

Question 4Process Control Network Fundamentals

A control engineer needs to segment a PCN so that a compromised engineering workstation cannot send traffic directly to enterprise email servers. Which control most directly enforces this?

  1. Replacing copper cabling with fiber within the control zone
  2. Enabling spanning tree on the core switches
  3. Increasing the polling rate on the historian
  4. Deploying a firewall with rules restricting conduits between zones Correct answer.

Explanation

Zone and conduit design, enforced by firewalls, restricts which traffic may cross between security zones. This directly blocks the workstation-to-enterprise path that the requirement describes.

Question 5Process Control Network Fundamentals

Which statement best describes the role of a safety instrumented system relative to the basic process control system?

  1. It independently performs protective functions to bring the process to a safe state Correct answer.
  2. It shares the same controllers as the BPCS to reduce hardware cost
  3. It only logs events and does not actuate any final elements
  4. It replaces the BPCS during normal steady-state operation

Explanation

A safety instrumented system is functionally independent of the BPCS and acts to place the process in a safe state when demand occurs. Independence is a core principle so that a BPCS failure does not disable protection.

Question 6Process Control Network Fundamentals

In the Purdue model, which level is typically where the site-level historian and production management systems reside?

  1. Level 3 Correct answer.
  2. Level 1
  3. Level 4
  4. Level 2

Explanation

Level 3 is the site operations layer, hosting functions such as historian aggregation, production scheduling, and maintenance management. Level 4 is the enterprise business network, and Levels 1 and 2 are control and supervisory layers.

Question 7Process Control Network Fundamentals

What does the term 'conduit' mean in the context of IEC 62443 zone and conduit design?

  1. A logical communication path that allows traffic between zones Correct answer.
  2. A redundant controller pair configuration
  3. A physical cable tray carrying field wiring
  4. A backup power feed to control cabinets

Explanation

In IEC 62443, a conduit is a logical grouping of communication channels that connects two zones and is subject to defined security controls. It is a security concept, not a physical raceway.

Question 8Process Control Network Fundamentals

Which characteristic distinguishes an industrial control protocol such as Modbus TCP from typical IT application protocols?

  1. It relies on directory services to locate devices
  2. It mandates TLS encryption on every connection
  3. It uses a compact request/response structure without built-in security Correct answer.
  4. It requires user authentication for every write command

Explanation

Many legacy industrial protocols were designed for determinism and simplicity, with compact messages and no native authentication or encryption. Security must therefore be added through network architecture and compensating controls.

Question 9Process Control Network Fundamentals

An engineer is designing a PCN and must choose a topology for the control-level network that provides deterministic behavior with managed switches. Which consideration is most relevant?

  1. Disabling spanning tree to improve convergence speed
  2. Maximizing broadcast domains to simplify addressing
  3. Using managed switches with VLANs and IGMP snooping to control multicast traffic Correct answer.
  4. Relying on hubs to reduce latency

Explanation

Managed switches with VLANs and IGMP snooping keep multicast control traffic confined and reduce unnecessary load, supporting predictable behavior. Hubs and disabled spanning tree introduce collisions and loop risk that harm determinism.

Question 10Process Control Network Fundamentals

What is the primary function of a unidirectional gateway (data diode) in a PCN?

  1. To allow two-way replication of historian data between zones
  2. To translate between Modbus and EtherNet/IP
  3. To load-balance traffic across redundant control servers
  4. To enforce one-way data flow from the control zone to a less trusted zone Correct answer.

Explanation

A data diode physically enforces one-way communication, allowing telemetry or historian data to leave the control zone without permitting inbound traffic. This protects the control zone from external initiation of connections.

Question 11Process Control Network Fundamentals

A PLC at Level 1 must send process values to a historian at Level 3. Which approach best aligns with defense-in-depth principles?

  1. Use an intermediate server in the control zone that collects data and forwards it through a controlled conduit Correct answer.
  2. Place the historian directly on the Level 1 control network
  3. Open all ports between Level 1 and Level 3 to simplify troubleshooting
  4. Allow the PLC to initiate direct connections to the historian across all layers

Explanation

Collecting data through an intermediate server and a defined conduit limits direct paths and enforces the zone boundary. This preserves segmentation while still delivering the required data flow.

Question 12Process Control Network Fundamentals

Which element of IEC 62443 addresses the security requirements for the system integrator or asset owner rather than for a product?

  1. The 62443-3-3 system requirements
  2. The 62443-2-1 security management system requirements for asset owners Correct answer.
  3. The 62443-4-2 component requirements
  4. Security Level 1 through 4 for components

Explanation

IEC 62443-2-1 defines requirements for an asset owner's security management system, covering policies and organizational processes. The 4-2 and 3-3 parts address component and system requirements respectively.

Question 13Process Control Network Fundamentals

An operator reports that a control HMI is intermittently slow. Analysis shows a broadcast storm from a misconfigured device on the control VLAN. Which mitigation best addresses the root cause?

  1. Add a second firewall between Level 1 and Level 2
  2. Apply storm control and correct the device configuration on the control VLAN Correct answer.
  3. Increase the historian disk capacity
  4. Replace the HMI with a newer model

Explanation

Storm control limits broadcast and multicast flooding, and correcting the misconfigured device removes the source. Together they address the root cause rather than the symptom.

Question 14Process Control Network Fundamentals

Which practice best supports patch management in a PCN where uptime is critical?

  1. Disable all patching to avoid disruption
  2. Rely on antivirus alone to cover unpatched vulnerabilities
  3. Test patches in a representative staging environment before scheduled deployment windows Correct answer.
  4. Apply all vendor patches immediately on production controllers

Explanation

Validating patches in a representative test environment reduces the risk of destabilizing production control systems. Deployment is then scheduled in maintenance windows to protect availability.

Question 15Process Control Network Fundamentals

What is the main security concern with using remote access to a PCN for vendor support?

  1. It reduces the amount of process data available to the historian
  2. It creates an inbound path that can bypass zone boundaries if not brokered and logged Correct answer.
  3. It eliminates the need for a firewall at the IT/OT boundary
  4. It increases the need for local operator training

Explanation

Vendor remote access introduces an inbound channel that, if unmanaged, can cross zone boundaries and expose control assets. Brokered, authenticated, and logged access through a DMZ mitigates this risk.

Question 16Process Control Network Fundamentals

Which protocol is specifically designed for time-critical control and supports isochronous real-time communication on Ethernet?

  1. SNMP
  2. PROFINET with IRT Correct answer.
  3. Modbus TCP
  4. SMTP

Explanation

PROFINET with Isochronous Real-Time provides deterministic, time-synchronized communication suitable for motion control. It uses bandwidth reservation and time slots to achieve deterministic behavior.

Question 17Process Control Network Fundamentals

A security architect is mapping the PCN and needs to identify all communication paths that cross from Level 3 to Level 4. What should be documented for each path?

  1. The manufacturer of the endpoint hardware only
  2. Only the physical cable length
  3. The operating system version of the historian only
  4. Source, destination, protocol, port, and business justification Correct answer.

Explanation

Conduit documentation should capture source, destination, protocol, port, and the justification for the flow so that rules can be reviewed and minimized. This supports least-privilege firewall configuration.

Question 18Process Control Network Fundamentals

Which statement about the difference between a DCS and a PLC-based control system is most accurate?

  1. A PLC cannot communicate over Ethernet
  2. A DCS does not use any fieldbus protocols
  3. A DCS typically integrates distributed controllers with a unified engineering and operator environment, while PLCs are often discrete-logic oriented Correct answer.
  4. A DCS is inherently immune to network attacks

Explanation

A DCS is characterized by tightly integrated distributed control with a common engineering and operator interface, whereas PLCs originated for discrete logic and are often integrated with separate SCADA. Neither architecture is inherently secure.

Question 19Process Control Network Fundamentals

What is the purpose of a firewall rule that permits only a specific source, destination, and port for historian replication between zones?

  1. To eliminate the need for a DMZ
  2. To enforce least-privilege communication for that conduit Correct answer.
  3. To maximize throughput across the boundary
  4. To allow all protocols on that port

Explanation

A narrowly scoped rule that names source, destination, and port implements least privilege for that conduit. Broad rules increase exposure and should be avoided.

Question 20Process Control Network Fundamentals

An organization wants to detect unauthorized changes to PLC logic. Which control most directly supports this?

  1. Increasing the HMI screen refresh rate
  2. Comparing running program checksums against a known-good baseline Correct answer.
  3. Adding more operator accounts with shared credentials
  4. Disabling logging to reduce disk usage

Explanation

Comparing program checksums to a trusted baseline reveals unauthorized logic modifications. This integrity monitoring is a direct detective control for PLC program changes.

Question 21Process Control Network Fundamentals

A PCN spans multiple physical sites connected by a WAN. Which design choice best preserves zone separation across the WAN?

  1. Using unmanaged switches at each site to reduce cost
  2. Bridging all control VLANs across the WAN into one flat domain
  3. Routing all control traffic through the enterprise internet gateway
  4. Using encrypted tunnels with firewalls at each site boundary and defined conduits Correct answer.

Explanation

Encrypted tunnels combined with site firewalls and defined conduits maintain zone boundaries while protecting traffic in transit. Flattening the network across the WAN erodes segmentation.

Question 22Process Control Network Fundamentals

During a risk assessment, a team determines that a Level 2 supervisory server has a conduit to Level 3 for patch distribution. Which compensating control best reduces risk while keeping the flow?

  1. Use an internal patch repository in the DMZ with authenticated, logged transfers Correct answer.
  2. Allow the server to browse the internet for patches
  3. Disable logging on the patch server to improve performance
  4. Open all ports between Levels 2 and 3 for flexibility

Explanation

An internal repository in the DMZ with authenticated and logged transfers limits exposure while preserving the needed patch flow. It removes direct internet browsing and keeps the conduit scoped.

Question 23Process Control Network Fundamentals

An engineer observes that a legacy serial Modbus device must be integrated into an Ethernet-based PCN. Which approach preserves security and functionality?

  1. Expose the serial device directly to the enterprise network
  2. Use a protocol gateway placed in the appropriate zone with scoped firewall rules Correct answer.
  3. Bridge the serial line onto the enterprise LAN without filtering
  4. Replace the device with an internet-connected controller

Explanation

A protocol gateway translates serial Modbus to Ethernet while remaining in the correct zone, and scoped firewall rules limit who may reach it. This preserves both functionality and segmentation.

Question 24Process Control Network Fundamentals

Which scenario best illustrates the principle of functional independence in safety design?

  1. The SIS relies on the BPCS HMI for alarm annunciation
  2. The SIS uses separate sensors, logic solver, and final elements from the BPCS Correct answer.
  3. The SIS is configured on the same controller as the BPCS to save space
  4. The SIS and BPCS share a single power supply and network switch

Explanation

Functional independence means the SIS has its own sensors, logic solver, and final elements so a BPCS fault cannot impair protection. Shared components create common-cause failure paths.

Question 25Process Control Network Fundamentals

A team is evaluating whether to allow direct RDP from the enterprise network to Level 2 operator stations. Which analysis is most defensible?

  1. Allow it because RDP is encrypted by default
  2. Allow it only during business hours to reduce risk
  3. Allow it from any source as long as a password is required
  4. Deny it and require brokered access through a jump host in the DMZ with logging and MFA Correct answer.

Explanation

Direct RDP from enterprise to control stations creates a broad inbound path and exposes interactive sessions. Brokering through a DMZ jump host with MFA and logging enforces least privilege and accountability.

Question 26Process Control Network Fundamentals

In the Purdue model, which level contains the physical process equipment such as sensors, actuators, and drives that interact directly with the manufacturing process?

  1. Level 3
  2. Level 0 Correct answer.
  3. Level 2
  4. Level 1

Explanation

Level 0 is the process level, where physical sensing and actuation hardware such as sensors, actuators, and motor drives reside. Level 1 holds the controllers that read and command those devices, and higher levels handle supervision and operations management.

Question 27Process Control Network Fundamentals

Which statement best describes the role of a demilitarized zone (DMZ) between a PCN and the enterprise network?

  1. It provides a shared domain where control and enterprise hosts authenticate to the same directory.
  2. It replaces the need for firewalls by physically isolating the control network from all external links.
  3. It terminates and brokers all traffic between the two networks so no direct path exists between them. Correct answer.
  4. It encrypts every packet on the control network to protect process data in transit.

Explanation

A DMZ sits between the PCN and enterprise zones and hosts brokered services such as replicated historians or jump hosts, so traffic is terminated rather than passing directly between zones. This preserves zone separation and limits which hosts can initiate connections into the control network.

Question 28Process Control Network Fundamentals

A control protocol uses a master that polls each slave in turn over a shared serial bus, and a slave only transmits when addressed. Which design property does this polling scheme provide?

  1. Deterministic access to the shared medium with no possibility of collisions Correct answer.
  2. Automatic encryption of each poll and response frame
  3. Guaranteed delivery with retransmission handled by the physical layer
  4. Peer-to-peer routing between slaves without involving the master

Explanation

In a polled master-slave bus, only the addressed slave may transmit, so access to the shared medium is scheduled and collisions are avoided. This determinism is a key reason such protocols remain common in control networks.

Question 29Process Control Network Fundamentals

An engineer must connect a Level 2 supervisory server to a Level 3 historian while limiting exposure. Which control most directly enforces that only the historian replication service can reach the supervisory server?

  1. An intrusion detection sensor monitoring the Level 3 uplink
  2. A VLAN that places both servers in the same broadcast domain
  3. A host-based antivirus agent installed on the historian
  4. A stateful firewall rule permitting only the historian's address and the replication port toward the server Correct answer.

Explanation

A stateful rule that restricts source address, destination address, and port to the replication service is the most direct enforcement of least-privilege conduit design. Monitoring and endpoint protection provide visibility but do not restrict which traffic is allowed.

Question 30Process Control Network Fundamentals

A site plans to deploy wireless sensors on the plant floor for condition monitoring. Which analysis best reflects PCN security principles before the deployment is approved?

  1. Treat the wireless segment as a new zone with defined conduits, assess its exposure, and restrict what it can reach. Correct answer.
  2. Rely on the wireless link's native encryption as the sole compensating control.
  3. Place the wireless access point on the enterprise network so IT can manage it directly.
  4. Reuse the existing control VLAN credentials so commissioning is faster and consistent.

Explanation

Any new communication path should be modeled as a zone with explicit conduits, risk-assessed, and constrained to the minimum reachable destinations. Native link encryption protects only the air interface and does not address segmentation or authorization.

Question 31Industrial Networking and Protocols

A PCN engineer is documenting an industrial Ethernet deployment. Which IEEE standard defines the Ethernet frame format and MAC addressing used at Layer 2 of that deployment?

  1. IEEE 802.11
  2. IEEE 802.15.4
  3. IEEE 802.1Q
  4. IEEE 802.3 Correct answer.

Explanation

IEEE 802.3 is the standard that specifies Ethernet framing, MAC addressing, and CSMA/CD operation at the data link and physical layers. The other standards listed address wireless LAN, VLAN tagging, and low-rate wireless personal area networks respectively.

Question 32Industrial Networking and Protocols

An operator needs to reach a managed industrial switch from a laptop on the plant network for initial configuration. Which protocol provides a command-line session over TCP port 22 with encrypted authentication and data?

  1. Telnet
  2. SNMPv2c
  3. TFTP
  4. SSH Correct answer.

Explanation

SSH (Secure Shell) runs over TCP port 22 and encrypts both authentication and session traffic, which is why it is the standard for secure CLI management. Telnet offers a similar CLI but transmits credentials in cleartext.

Question 33Industrial Networking and Protocols

A control engineer is selecting a fieldbus for a new process line and wants a protocol that carries both cyclic process data and acyclic parameter data over a single twisted-pair cable, using a master/slave polling model on RS-485. Which protocol matches this description?

  1. Modbus TCP
  2. HART
  3. EtherNet/IP
  4. PROFIBUS DP Correct answer.

Explanation

PROFIBUS DP is an RS-485 based fieldbus that uses a master/slave token-passing model and supports both cyclic I/O exchange and acyclic diagnostic or parameter services. EtherNet/IP and Modbus TCP are Ethernet-based, while HART rides on a 4-20 mA analog loop.

Question 34Industrial Networking and Protocols

A PCN candidate is reviewing the OSI model as it applies to industrial networks. At which layer does an industrial managed switch primarily make forwarding decisions based on MAC addresses?

  1. Layer 3
  2. Layer 7
  3. Layer 2 Correct answer.
  4. Layer 4

Explanation

A Layer 2 switch builds a MAC address table and forwards frames based on destination MAC addresses within a broadcast domain. Layer 3 devices route on IP addresses, Layer 4 uses ports, and Layer 7 covers application protocols.

Question 35Industrial Networking and Protocols

Which address range is reserved for link-local IPv4 autoconfiguration (APIPA), commonly seen when an industrial device cannot reach a DHCP server?

  1. 10.0.0.0/8
  2. 169.254.0.0/16 Correct answer.
  3. 192.168.0.0/16
  4. 172.16.0.0/12

Explanation

169.254.0.0/16 is the IPv4 link-local block used for automatic private IP addressing when DHCP is unavailable. The other ranges are RFC 1918 private address spaces assigned administratively.

Question 36Industrial Networking and Protocols

A plant uses Modbus TCP between an HMI and a PLC. Which transport port does Modbus TCP use by default?

  1. 20000
  2. 102
  3. 44818
  4. 502 Correct answer.

Explanation

Modbus TCP uses TCP port 502 as its registered default port for client/server messaging. The other ports are associated with S7 communications, EtherNet/IP encapsulation, and DNP3 respectively.

Question 37Industrial Networking and Protocols

An engineer must assign a deterministic, cyclic PROFINET I/O exchange between a controller and a remote IO device. Which communication relationship does this describe?

  1. A HART burst mode session
  2. A Modbus function code exchange
  3. A CIP connection between two scanners
  4. An AR between the PROFINET IO controller and the IO device Correct answer.

Explanation

PROFINET IO uses an Application Relation (AR) between an IO controller and an IO device to establish cyclic data exchange along with acyclic record data channels. CIP connections belong to EtherNet/IP, Modbus uses function codes over TCP/serial, and HART burst mode is an analog-loop digital feature.

Question 38Industrial Networking and Protocols

A technician is troubleshooting a star-topology industrial Ethernet segment and wants to verify which switch port a device's MAC address is learned on. Which command output on a managed switch provides this mapping?

  1. The spanning-tree topology change log
  2. The routing table
  3. The ARP cache
  4. The MAC address table Correct answer.

Explanation

The MAC address table (also called the forwarding or CAM table) maps learned MAC addresses to specific switch ports and VLANs. The routing table holds IP routes, the ARP cache maps IP to MAC at Layer 3 hosts, and STP logs track topology changes.

Question 39Industrial Networking and Protocols

A control network uses EtherNet/IP. Which two mechanisms does CIP define for messaging between devices?

  1. Modbus function codes over TCP and serial RTU
  2. FTP for configuration and SMTP for alarms
  3. HTTP requests and SOAP responses
  4. Explicit messaging over TCP/UDP and implicit (I/O) messaging over UDP Correct answer.

Explanation

CIP distinguishes explicit messaging, used for configuration and non-time-critical requests over TCP or UDP, from implicit I/O messaging, which uses UDP for cyclic, time-critical data. The other option pairs are unrelated protocols or belong to different stacks.

Question 40Industrial Networking and Protocols

An engineer wants to isolate PROFINET IO traffic and engineering traffic on the same physical switch. Which IEEE 802.1Q feature should be configured to keep these broadcast domains separate?

  1. VLANs with 802.1Q trunking Correct answer.
  2. Port mirroring
  3. Link aggregation with LACP
  4. Rapid Spanning Tree

Explanation

IEEE 802.1Q VLAN tagging creates separate logical broadcast domains on shared switch infrastructure, and trunk links carry multiple tagged VLANs between switches. LACP aggregates bandwidth, RSTP prevents loops, and port mirroring copies traffic for analysis.

Question 41Industrial Networking and Protocols

During commissioning, a Modbus RTU master polls a slave but receives no response. Which configuration item is the most likely cause when the physical wiring is verified good?

  1. Mismatched serial parameters such as baud rate, parity, or slave address Correct answer.
  2. Wrong DNS server configured on the master
  3. Mismatched TCP port number
  4. Incorrect default gateway on the slave

Explanation

Modbus RTU requires the master and slave to agree on baud rate, data bits, parity, stop bits, and slave address; any mismatch prevents the slave from recognizing or replying to the request. Gateways, DNS, and TCP ports are irrelevant to a serial RTU link.

Question 42Industrial Networking and Protocols

A network designer is planning PROFINET IRT for a motion control application. Which requirement is essential to achieve the deterministic cycle times associated with IRT?

  1. Wireless backhaul between controller and drives
  2. Hardware-supported isochronous cycle with time-synchronized devices and IRT-capable switches Correct answer.
  3. NAT translation between controller and IO devices
  4. Standard unmanaged switches with default store-and-forward forwarding

Explanation

PROFINET IRT relies on hardware-assisted isochronous scheduling, precise time synchronization, and switches that support IRT bandwidth reservation to guarantee deterministic cycles. Unmanaged switches, wireless links, and NAT introduce nondeterminism or break the required transparent communication.

Question 43Industrial Networking and Protocols

A plant network must be monitored for device health using standard MIB objects. Which protocol and version combination provides read-only polling with community-string authentication but no encryption?

  1. SNMPv2c Correct answer.
  2. SNMPv3 with noAuthNoPriv
  3. SNMPv3 with authPriv
  4. SNMPv1 with traps disabled

Explanation

SNMPv2c uses community strings for access control and supports read/write polling without encryption, which matches the stated requirement. SNMPv3 authPriv adds authentication and encryption, while noAuthNoPriv lacks authentication entirely.

Question 44Industrial Networking and Protocols

An engineer wants to protect a PROFINET network from unauthorized configuration changes initiated from the office LAN. Which approach best limits which devices can communicate across the boundary?

  1. Use a hub instead of a switch to simplify the topology
  2. Disable all VLAN tagging on the uplink
  3. Enable STP on all switches to block unauthorized frames
  4. Deploy a stateful industrial firewall with zone and conduit rules between the plant and office networks Correct answer.

Explanation

A stateful industrial firewall enforcing zone-and-conduit rules restricts traffic to explicitly permitted flows between network segments, which is the accepted defense-in-depth practice for IT/OT boundaries. STP, hubs, and disabled tagging do not provide access control.

Question 45Industrial Networking and Protocols

A network uses DNP3 for SCADA telemetry to remote substations. Which characteristic distinguishes DNP3 from Modbus in this context?

  1. DNP3 supports time-stamped events, unsolicited reporting, and link-layer integrity checks Correct answer.
  2. DNP3 requires UDP port 502 for all communications
  3. DNP3 is limited to a 4-20 mA analog loop
  4. DNP3 uses a single function code set with no event reporting

Explanation

DNP3 is designed for telemetry and includes time-stamped event data, unsolicited responses from outstations, and CRC-based link-layer integrity, which Modbus lacks. Modbus has no standard event timestamping or unsolicited reporting model.

Question 46Industrial Networking and Protocols

An engineer observes that a PROFINET IO device loses its cyclic connection whenever the engineering laptop connects to the same VLAN and floods the network. Which network design element most directly mitigates this by controlling broadcast and multicast traffic?

  1. Disabling flow control on the laptop
  2. Enabling port mirroring on the uplink
  3. IGMP snooping with a multicast-aware network design Correct answer.
  4. Increasing the MTU on all switch ports

Explanation

PROFINET real-time traffic uses multicast; IGMP snooping limits multicast forwarding to ports that requested the group, preventing unnecessary flooding to all ports. MTU, mirroring, and flow control do not constrain multicast propagation.

Question 47Industrial Networking and Protocols

A SCADA integrator needs to map Modbus register addresses to PLC memory. Which statement correctly describes the standard Modbus data model?

  1. Coils are 16-bit words and holding registers are single bits
  2. Coils and discrete inputs are single-bit; holding and input registers are 16-bit words Correct answer.
  3. Modbus only supports string data types
  4. All Modbus data types are 32-bit floating point

Explanation

The Modbus data model defines coils and discrete inputs as single-bit values and holding/input registers as 16-bit words, with multi-register values assembled by the application. The other options invert or misstate these sizes.

Question 48Industrial Networking and Protocols

A PCN candidate must explain how HART communicates in a typical process instrument loop. Which statement is accurate?

  1. HART superimposes a frequency-shift-keyed digital signal on a 4-20 mA analog current loop Correct answer.
  2. HART replaces the analog loop with a fiber-optic bus
  3. HART requires a dedicated Ethernet connection for each instrument
  4. HART uses only a 24 V digital pulse train with no analog component

Explanation

HART uses frequency shift keying to superimpose digital data at approximately 1200 bps on the standard 4-20 mA analog signal, allowing simultaneous analog and digital communication. It does not replace the loop with fiber or Ethernet.

Question 49Industrial Networking and Protocols

An industrial network uses a redundant ring topology with RSTP. Which statement best describes the expected behavior when a link in the ring fails?

  1. The blocked alternate port transitions to forwarding, restoring connectivity after RSTP reconvergence Correct answer.
  2. Broadcast storms occur until an administrator manually clears the MAC table
  3. All switches reboot to relearn MAC addresses
  4. The ring converts to a hub-based shared segment

Explanation

RSTP maintains a loop-free topology by blocking redundant ports; when the active link fails, the alternate port moves to forwarding and the network reconverges quickly, typically in the range of seconds or less depending on topology. Switches do not reboot, and the ring does not become a shared hub segment.

Question 50Industrial Networking and Protocols

A network engineer must verify that a PROFINET controller can reach an IO device at the IP layer before commissioning. Which tool directly tests IP reachability without relying on application-layer services?

  1. arp -a
  2. nslookup
  3. traceroute
  4. ping Correct answer.

Explanation

Ping sends ICMP echo requests to test basic IP reachability between hosts. Traceroute maps the path, nslookup queries DNS, and arp -a displays the local ARP cache.