hard Modbus exam questions

Hard level questions

1. Q01

   To carry a 32-bit IEEE 754 floating-point value over Modbus (whose registers are 16 bits), two consecutive registers are typically used, with the byte order documented by the slave manufacturer.

   TrueFalse

   5. Data encoding· 32-Bit-Float· Hard

   ▸

   Correct answer

   True

   Learning tip

   Modbus is natively 16-bit, so any 32-bit IEEE 754 float or long integer must span two consecutive registers. For example, an energy meter reading of 12345.67 kWh encodes in IEEE 754 as 0x4640E5C2 (four bytes), which maps in Big Endian to Register N = 0x4640 and Register N+1 = 0xE5C2. The client issues a 0x03 request with count = 2 and reassembles the value. Modern libraries (pymodbus, libmodbus) handle the conversion automatically, provided the byte order is specified correctly.

   View the full question page →
2. Q02

   Modbus (RTU and TCP) has no native security: no authentication, no encryption, no signatures. The accepted good practice is strict OT VLAN isolation, an industrial firewall and no direct internet exposure.

   TrueFalse

   6. Practical· Cybersecurity· Hard

   ▸

   Correct answer

   True

   Learning tip

   Modbus was designed in 1979 with no security in mind, so any direct internet exposure brings: spoofing (anyone on the network can issue a Write Register), sniffing (all frames are in clear text) and denial of service (flooding requests saturates the slaves). The hard truth is that a Modbus Secure variant (TCP over TLS, adopted in 2018) does exist but its deployment is extremely limited because field devices do not support it. The industry standard remains network-level isolation through industrial firewalls (Hirschmann, Phoenix mGuard, Siemens SCALANCE), no internet exposure, and dedicated OT monitoring (Claroty, Nozomi).

   View the full question page →
3. Q03

   When decoding a 32-bit IEEE 754 float carried over 2 consecutive Modbus registers, how many different byte-order combinations does a developer typically encounter in practice depending on the slave?

   • A.1 (standard Big endian)
   • B.2 (Big endian, Little endian)
   • C.4 (ABCD, DCBA, BADC, CDAB)
   • D.8 (all possible permutations)

   6. Endianness· Word Swap und Byte Swap· Hard

   ▸

   Correct answer

   C — 4 (ABCD, DCBA, BADC, CDAB)

   Learning tip

   Four combinations are commonly seen: ABCD (standard Big Endian, the official Modbus order), DCBA (reversed Little Endian), BADC (Big Endian Byte Swap -- registers in the right order but inner bytes swapped) and CDAB (Little Endian Byte Swap -- registers swapped but inner bytes in normal order). A is wrong because, in practice, far more than one order is encountered. B is wrong because there are not just two orders; both byte-swap variants must be supported as well. D is wrong because, although eight permutations of four bytes exist mathematically, only those four are actually used by vendors. The root cause is that the original Modbus standard only specified byte order within a 16-bit register, not how to combine two registers for a 32-bit value, so each vendor made its own choice.

   View the full question page →