Exam AZ-220 topic 2 question 2 discussion

Should not hte answer be C & E. The question asks for stopping the auto enrollment for 1000 devices out of the 10,000

I think correct answers should be C and E. The statement says "MUST PREVENT CONNECTIONS AND AUTO-ENROLLMENT". By deleting the enrollment entry, we are preventing devices from auto-enrolling but not from connecting. That's why we need also to delete their identities in the Identity Registry - Blacklisting the Root certificate would impact on the 10k devices, and we only want to disallow 1k devices. Even when we can create intermmediate certificates to disallow certain path in the chain, that option is not listed, and Option B clearly mentions ROOT CERTIFICATE, so I dont agree with option B

Agree with CE

For me, B is a wrong answer. It's required do deprovision 1000 of 10000 devies. Blacklisting root certificate seems like it will disable enrollments with other intermediate/leaf certificates chained to that root cert. There is a possibility, that other devices require that root cert, so doing that may cause issues in real life scenario.

Appeared for exam on 3/24/2021 and successfully cleared it, this question was there.

To deprovision a device that has an individual enrollment: 1. Disenroll the device from your provisioning service 2. Disable or delete the device in the identity registry of the IoT hub that it was provisioned to. https://docs.microsoft.com/en-us/azure/iot-dps/how-to-unprovision-devices C & E it seems.

Agree on BC

Confusion here seems to be surrounding the term: blacklist. Given answer is correct. The documentation actually states this as being "disallowed". X.509 certificates are typically arranged in a certificate chain of trust. If a certificate at any stage in a chain becomes compromised, trust is broken. "The certificate must be disallowed to prevent Device Provisioning Service from provisioning devices downstream in any chain that contains that certificate. To learn more about X.509 certificates and how they are used with the provisioning service, see X.509 certificates." https://docs.microsoft.com/en-us/azure/iot-dps/how-to-revoke-device-access-portal

Correct ans are BC: Deprovisioning process: -Disenrollment (Blacklist individual devices or an enrollment group -Deregister (Delete de device enrollment entries)

Guidance for this scenario has changed. To blacklist specific devices in an Enrollment group, without blacklisting the entire enrolment group, you can add the specific devices and their certificates as individually enrolled devices, and then disable them. DPS first checks individual enrolments. If it finds a match that is disabled, it will refuse the connection, even if a non-blacklisted match exists in group enrolments: https://docs.microsoft.com/en-us/azure/iot-dps/how-to-revoke-device-access-portal#blacklist-specific-devices-in-an-enrollment-group

B & C is the correct answer - blacklist the cert or delete the enrollment group To blacklist the certificate, you can either disable or delete its enrollment group.

I think it's B & E - https://docs.microsoft.com/en-us/azure/iot-dps/how-to-unprovision-devices