Exam AZ-220 topic 2 question 17 discussion

DRAG DROP -
You have an Azure IoT solution that includes an Azure IoT hub, a Device Provisioning Service instance, and 1,000 connected IoT devices. The IoT devices are allocated to four enrollment groups. Each enrollment group is configured to use certificate attestation.
You need to decommission all the devices in a single enrollment group and the enrollment group itself.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Suggested Answer:
To deprovision all of the devices that have been provisioned through an enrollment group:
1. Disable the enrollment group to disallow its signing certificate.
2. Use the list of provisioned devices for that enrollment group to disable or delete each device from the identity registry of its respective IoT hub.
3. After disabling or deleting all devices from their respective IoT hubs, you can optionally delete the enrollment group. Be aware, though, that, if you delete the enrollment group and there is an enabled enrollment group for a signing certificate higher up in the certificate chain of one or more of the devices, those devices can re-enroll.
Reference:
https://docs.microsoft.com/en-us/azure/iot-dps/how-to-unprovision-devices