Correct Answer: Derive a unique device symmetric key using HMAC-SHA256 from the DPS group enrollment primary key, and flash only the unique key to the device
Group enrollments in DPS using symmetric keys should never have their master enrollment key distributed to devices. Instead, you derive a unique SAS key for each device ID using HM...
Correct Answer
Derive a unique device symmetric key using HMAC-SHA256 from the DPS group enrollment primary key, and flash only the unique key to the device
Why This Answer Is Correct
Group enrollments in DPS using symmetric keys should never have their master enrollment key distributed to devices. Instead, you derive a unique SAS key for each device ID using HMAC-SHA256 and store only the unique derived key on the device.
This question evaluates your knowledge of IoT Security — a core concept tested in Microsoft Certified: Azure IoT Developer Specialty (AZ-220). Understanding IoT Security is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You need to authenticate IoT devices to IoT Hub in a way that each device has a unique cryptographic credential and a compromised device credential can be revoked without affecting other devices. Which authentication method should you use?
Microsoft Defender for IoT has flagged anomalous communication patterns from one of your IoT Hub-connected devices. You need to investigate the device without disrupting the rest of your fleet. What is the fastest action to isolate the device?
You are deploying security agents on Linux IoT devices to monitor process creations, active network connections, and login attempts for security auditing. Which Microsoft Defender for IoT component should you install?
You are designing a high-security IoT device and must ensure its private keys are never exposed in system memory or storage. Which hardware component should you integrate, and how does the Azure IoT SDK support it?