SY0-701 Question 186
Single answerReal-time operating system (RTOS)A manufacturer deploys internet-connected infusion pumps in a hospital. The pumps run a real-time operating system (RTOS) because they must respond to sensor input and dosage timing within strict deadlines. During a security review, the team finds that the devices are difficult to patch quickly and have limited memory and storage. Which security approach is MOST appropriate to reduce risk without disrupting the pumps' real-time operation?
- A
Place the infusion pumps on a dedicated segmented network with tightly restricted communications to only required management and monitoring systems
- B
Install a full-featured endpoint detection and response (EDR) agent directly on each pump to provide continuous behavioral monitoring
- C
Enable frequent on-device antivirus signature updates and scheduled full-disk scans during normal operation
- D
Join the pumps to the hospital's general user workstation VLAN so they can receive standard security controls and patch workflows more easily
Show answer and explanation
Correct answer: A
Explanation
RTOS devices are designed for deterministic, time-sensitive operations, so security controls must account for performance and availability requirements. In environments such as healthcare, industrial systems, and embedded IoT, best practice is often to use compensating controls such as network segmentation, ACLs, firewall rules, deny-by-default communications, and tightly controlled management access when host-based security tooling is limited. This is consistent with guidance from NIST on IoT device cybersecurity and network segmentation practices, including NISTIR 8259 for IoT cybersecurity capabilities and NIST SP 800-82 for operational technology environments. For Security+, candidates should recognize that RTOS and embedded systems often cannot support the same agents and patch cadence as general-purpose operating systems, so isolation and restricted communications are often the most appropriate risk-reduction measures.
- A. Correct.
Correct. RTOS-based embedded and medical devices often have limited CPU, memory, and storage, and they may be sensitive to latency or resource contention. Network segmentation and strict allowlisting of communications are practical compensating controls that reduce exposure without adding significant load to the device. This aligns with common guidance for IoT/OT and medical environments where direct hardening options are limited.
- B. Incorrect.
Incorrect. A full EDR agent is often unsuitable for RTOS-based embedded devices because it can consume resources, introduce timing jitter, and may not even be supported by the device vendor or platform. Someone might choose this because EDR is a strong control on traditional endpoints, but RTOS devices usually require lighter compensating controls rather than enterprise workstation tooling.
- C. Incorrect.
Incorrect. Frequent antivirus updates and scheduled full-disk scans are typical for desktops and servers, but they are generally impractical for RTOS devices. Such scans can interfere with deterministic performance, and many RTOS platforms do not support conventional antivirus products. This option reflects the misconception that all endpoints can use standard IT security agents.
- D. Incorrect.
Incorrect. Putting the pumps on a general workstation VLAN increases exposure to lateral movement, broadcast traffic, and unnecessary services. Although it might simplify centralized management, it weakens security and can create reliability issues for safety-critical RTOS devices. The safer approach is isolation with only essential communication paths permitted.