SY0-701 Question 185
Single answerReal-time operating system (RTOS)A manufacturing company deploys robotic arms controlled by embedded devices running a real-time operating system (RTOS). During a security review, the administrator discovers the devices are rarely rebooted, run a stripped-down OS image, and cannot tolerate delays that would interrupt safety functions. The vendor has released a security update, but applying it requires taking each controller offline briefly. Which action is the BEST way to reduce security risk while preserving the operational requirements of these RTOS-based systems?
- A
Move the controllers to an isolated network segment with tightly restricted communications and schedule a maintenance window to apply the vendor update in a controlled manner
- B
Install a full endpoint detection and response (EDR) suite directly on each controller so threats can be quarantined without any downtime
- C
Enable automatic operating system patching during production hours so the devices stay fully updated at all times
- D
Replace the RTOS with a general-purpose desktop operating system that supports more security tools and easier patch management
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use compensating controls such as segmentation and tightly restricted communications, then apply the vendor's update during a planned maintenance window. RTOS platforms are commonly used in embedded, industrial, medical, and safety-related systems because they provide deterministic timing and predictable task scheduling. In Security+ contexts, candidates should recognize that these systems often cannot support standard security tooling or indiscriminate patching practices used on desktops and servers. Instead, risk reduction typically relies on defense in depth: isolating the device, limiting allowed network paths, following vendor-approved update procedures, and scheduling downtime carefully. This approach is consistent with common OT and embedded security guidance from sources such as NIST SP 800-82, which emphasizes segmentation, controlled maintenance, and compensating controls for industrial and embedded environments.
- A. Correct.
Correct. RTOS-based and embedded industrial systems often have strict availability and timing requirements, so immediate patching during active operations may be unsafe. Network isolation, strict allowlisting of communications, and controlled maintenance windows are common compensating controls that reduce exposure while preserving deterministic behavior. This aligns with security best practices for operational technology (OT) and embedded systems, where segmentation and scheduled vendor-approved updates are preferred over disruptive changes.
- B. Incorrect.
Incorrect. A common misconception is that traditional endpoint tools can simply be added to any system. Many RTOS devices have limited memory, CPU, storage, and vendor support, and adding heavyweight EDR software can interfere with timing-sensitive processes. In many embedded or industrial environments, unsupported security agents may also void support agreements or create operational instability.
- C. Incorrect.
Incorrect. Although patching is important, automatic patching during production hours is risky for RTOS-controlled equipment because reboots, service interruption, or timing changes could disrupt safety-critical processes. For systems with deterministic requirements, updates are typically tested and applied during planned outages rather than pushed automatically at arbitrary times.
- D. Incorrect.
Incorrect. Replacing an RTOS with a general-purpose operating system would undermine the primary reason the device uses an RTOS: deterministic, predictable response for real-time control. General-purpose operating systems are not designed for the same strict timing guarantees and could create major safety, reliability, and compatibility issues.