CyberCertPrepOT Security FundamentalsOT Fundamentals: Network Architecture & ProtocolsEASYFree question
A technician sniffing a plant network sees TCP traffic to a PLC on port 502 carrying register reads. Which protocol is this?
- A.DNP3 over TCP with its link layer framing
- B.Modbus TCP with its MBAP header framing
- C.EtherNet/IP explicit messaging over CIP sessions
- D.OPC UA binary over a secure channel
Why B is correct
Port 502 is the registered Modbus TCP port, and each frame starts with the MBAP header (transaction ID, protocol ID, length, unit ID). DNP3 normally uses port 20000, EtherNet/IP uses 44818 and 2222, and OPC UA uses 4840 by default.
Know someone studying for OT Security Fundamentals? Send them this one.