Exam AZ-220 topic 2 question 38 discussion

Actual exam question from Microsoft's AZ-220

Question #: 38
Topic #: 2

You have an Azure IoT hub that uses a Device Provisioning Service (DPS) instance.

For 100 legacy devices, you plan to create a new device enrollment that will use symmetric key attestation. The solution must minimize administrative effort.

What should you use to derive the device key?

A. the subscription ID
B. the IoT hub name
C. the group master key
D. the primary key of the DPS shared access policy

Show Suggested Answer

Suggested Answer: D 🗳️

by trahd at April 24, 2023, 8:05 a.m.

Comments

Submit Cancel

trahd

2 years, 2 months ago

The multiple-choice options in the question are confusing. Also, the question says "what should you do to derive the device key?". Better wording would be, "what should you do to derive the device key for each device?". I will answer it in real world terms: Since we are going for symmetric key attestation and minimizing administrative effort, it's best to use a symmetric key enrollment group. In that case, for each device, "the derived device key is a hash of the device's registration ID and is computed using the symmetric key of the enrollment group." Reference: https://learn.microsoft.com/en-gb/azure/iot-dps/concepts-symmetric-key-attestation?tabs=windows#group-enrollments

upvoted 1 times

...