I85PREP
⌘ K
Azure IoT Developer (AZ-220) study materials
Azure IoT Developer (AZ-220) study resources

Azure IoT Developer (AZ-220) practice questions

One question at a time. Build your Azure IoT Developer (AZ-220) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Set up the Azure IoT Hub solution infrastructure

You need to create an IoT hub that supports device-to-cloud telemetry from up to 1,000,000 simultaneously connected devices with minimal cost per device. Which tier should you choose?

  1. The Basic tier at S3 scale Correct answer.
  2. The Standard tier at S1 scale
  3. The Standard tier at S3 scale
  4. The Free tier

Explanation

The Basic tier provides device-to-cloud telemetry and per-device identity but omits cloud-to-device messaging, device twins, and methods, making it the cheapest option for pure telemetry workloads. Scale units increase message throughput and device capacity, so S3 on Basic supports very large device counts at lower cost than Standard.

Question 2Set up the Azure IoT Hub solution infrastructure

A solution must send commands from the cloud to devices and read reported properties from device twins. Which IoT Hub tier is required?

  1. Free
  2. Basic
  3. Standard Correct answer.
  4. Shared access policy tier

Explanation

Device twins, direct methods, and cloud-to-device messaging are available only in the Standard tier. The Basic tier is restricted to device-to-cloud telemetry and device identity operations.

Question 3Set up the Azure IoT Hub solution infrastructure

You are defining a shared access policy for a backend service that only needs to read device-to-cloud messages. Which permission set is the minimum required?

  1. Service connect Correct answer.
  2. Registry write only
  3. Registry read and write
  4. Device connect

Explanation

The service connect permission grants access to the service-facing endpoints, including reading and acknowledging cloud-to-device and device-to-cloud messages. Registry permissions govern identity management and device connect governs device-side connections.

Question 4Set up the Azure IoT Hub solution infrastructure

Which endpoint should a device use to send telemetry to an IoT hub?

  1. The device-to-cloud endpoint on port 5671 Correct answer.
  2. The built-in event hub-compatible endpoint
  3. The file upload notification endpoint
  4. The service-facing messages endpoint

Explanation

Devices send telemetry by connecting to the device-facing endpoint using MQTT or AMQP over port 5671, or HTTPS on port 443. The event hub-compatible endpoint is for services reading telemetry, not for devices sending it.

Question 5Set up the Azure IoT Hub solution infrastructure

You must deploy an IoT hub with a specific resource name and region by using a repeatable template. Which Azure resource type should the template declare?

  1. Microsoft.EventHub/namespaces
  2. Microsoft.IoTHub/hubs
  3. Microsoft.Devices/IotHubAccounts
  4. Microsoft.Devices/IotHubs Correct answer.

Explanation

IoT Hub resources are declared under the Microsoft.Devices resource provider with the type Microsoft.Devices/IotHubs. The other types either do not exist or belong to different services.

Question 6Set up the Azure IoT Hub solution infrastructure

A device must authenticate to IoT Hub without using a symmetric key. Which credential type should you configure for the device identity?

  1. A shared access signature embedded in the connection string
  2. An X.509 self-signed certificate thumbprint Correct answer.
  3. A service principal secret
  4. A storage account key

Explanation

IoT Hub supports X.509 certificate authentication where the device presents a certificate whose thumbprint or issuing CA is registered. Symmetric keys and SAS tokens are the alternative key-based mechanism, not certificate-based authentication.

Question 7Set up the Azure IoT Hub solution infrastructure

Which IoT Hub feature allows you to route messages to different endpoints based on message properties without writing custom code?

  1. Direct methods
  2. Message routing queries Correct answer.
  3. Device twin tags
  4. Message enrichment

Explanation

Message routing lets you define queries over message properties, twin properties, and body content to direct messages to built-in or custom endpoints. Enrichment adds properties to messages but does not select destinations.

Question 8Set up the Azure IoT Hub solution infrastructure

You need to configure the IoT hub so that telemetry is retained for later replay by a downstream service. Which built-in endpoint provides the event hub-compatible stream?

  1. The file upload endpoint
  2. The built-in events endpoint Correct answer.
  3. The twin change events endpoint
  4. The device connection state endpoint

Explanation

The built-in events endpoint exposes an Event Hubs-compatible interface that services can consume with consumer groups and retention settings. The other endpoints serve different purposes such as upload notifications or twin change feeds.

Question 9Set up the Azure IoT Hub solution infrastructure

A company needs to provision 50,000 devices with unique identities and enroll them automatically at first boot. Which service should be used with IoT Hub?

  1. Azure Device Provisioning Service Correct answer.
  2. Azure IoT Edge
  3. Azure Stream Analytics
  4. Azure IoT Central

Explanation

Device Provisioning Service performs zero-touch, at-scale provisioning and assigns devices to the correct hub based on enrollment configuration. It supports individual and group enrollments using symmetric keys, TPM, or X.509 certificates.

Question 10Set up the Azure IoT Hub solution infrastructure

You must ensure that a device can connect to IoT Hub over port 443 when outbound MQTT traffic is blocked. Which protocol should the device use?

  1. AMQP over web sockets
  2. HTTPS Correct answer.
  3. AMQP over TCP
  4. MQTT over web sockets

Explanation

IoT Hub supports HTTPS on port 443 for device-to-cloud messaging, which works when other ports are blocked. HTTPS does not support cloud-to-device messaging, twins, or methods, so it is limited to telemetry and twin reads and writes.

Question 11Set up the Azure IoT Hub solution infrastructure

You need to grant a backend application permission to invoke direct methods on devices but not to modify device identities. Which shared access policy should you assign?

  1. Registry write
  2. Device connect
  3. Service connect Correct answer.
  4. Registry read

Explanation

Service connect permits invoking direct methods and accessing service endpoints without granting registry permissions. Registry permissions control device identity management and are unnecessary for method invocation.

Question 12Set up the Azure IoT Hub solution infrastructure

You are creating an IoT hub and want to limit the number of concurrent device connections to control cost. Which setting should you adjust?

  1. The daily message quota per unit
  2. The message retention period
  3. The number of scale units in the tier Correct answer.
  4. The partition count of the event hub-compatible endpoint

Explanation

Scale units determine the hub's throughput and device capacity, including the maximum number of connected devices. Partition count and retention affect the event stream, and the daily quota limits messages rather than connections.

Question 13Set up the Azure IoT Hub solution infrastructure

You want to deploy an IoT hub and a storage account together in a single ARM template. Which element of the template defines the order in which the resources are created?

  1. The outputs section
  2. The parameters section
  3. The apiVersion property
  4. The dependsOn property Correct answer.

Explanation

The dependsOn property establishes dependencies so Azure Resource Manager creates resources in the correct order. Parameters and outputs supply values, and apiVersion selects the schema version of the resource provider.

Question 14Set up the Azure IoT Hub solution infrastructure

A device uses a group enrollment in Device Provisioning Service with X.509 certificate attestation. Which configuration is required to validate the device certificate chain?

  1. Enable message enrichment on the hub
  2. Register the device's leaf certificate thumbprint in IoT Hub
  3. Create a shared access policy with registry write
  4. Register the root or intermediate CA certificate in the DPS certificate store Correct answer.

Explanation

Group enrollments use X.509 attestation where the signing root or intermediate CA certificate must be uploaded and verified in DPS. Devices then present leaf certificates that chain to that trusted CA.

Question 15Set up the Azure IoT Hub solution infrastructure

You need to route messages to a blob storage container when the temperature property exceeds 30, and to the built-in endpoint otherwise. Which configuration achieves this?

  1. Create a device twin tag and a direct method
  2. Enable message enrichment and disable the built-in endpoint
  3. Create two consumer groups on the built-in endpoint
  4. Create a custom endpoint and a route with a query on the temperature property, then enable the fallback route Correct answer.

Explanation

A route with a query such as temperature > 30 sends matching messages to the custom blob endpoint, and the fallback route captures messages that match no route. This combination provides conditional routing without custom code.

Question 16Set up the Azure IoT Hub solution infrastructure

You are configuring an IoT hub to support file uploads from devices. Which two resources must be associated with the hub? Choose the configuration that best satisfies the requirement.

  1. A Service Bus queue and a shared access policy
  2. A storage account container and a notification mechanism for upload completions Correct answer.
  3. A Log Analytics workspace and a diagnostic setting
  4. An Event Hubs namespace and a consumer group

Explanation

File upload requires an Azure storage account container to receive blobs and a way for devices to receive upload completion notifications, typically through a service endpoint or twin notification. IoT Hub generates a SAS URI for the device to upload directly to storage.

Question 17Set up the Azure IoT Hub solution infrastructure

A solution architect wants to minimize latency between devices and the hub for devices located in Western Europe. Which action should be taken?

  1. Enable message enrichment on the hub
  2. Use the Basic tier instead of Standard
  3. Increase the number of partitions
  4. Create the IoT hub in the West Europe region Correct answer.

Explanation

Deploying the IoT hub in the same region as the devices reduces network latency because traffic terminates at the nearest Azure datacenter. Enrichment, partitions, and tier selection affect functionality and throughput, not geographic latency.

Question 18Set up the Azure IoT Hub solution infrastructure

You need to configure diagnostics so that IoT Hub connection and routing logs are sent to a Log Analytics workspace. Which configuration should you create?

  1. A diagnostic setting on the IoT hub with the desired log categories Correct answer.
  2. A shared access policy with service connect
  3. A route with a query on the message body
  4. A device twin desired property

Explanation

Diagnostic settings on the IoT hub route platform logs and metrics to destinations such as Log Analytics, storage, or Event Hubs. Log categories must be selected to capture connection and routing events.

Question 19Set up the Azure IoT Hub solution infrastructure

You must ensure that a device can receive cloud-to-device messages and use direct methods, and the device connects over MQTT. Which statement describes the correct configuration?

  1. Use the Basic tier and connect with HTTPS on port 443
  2. Use the Free tier and connect with AMQP over port 443
  3. Use the Standard tier and connect with MQTT on port 8883 or 5671 Correct answer.
  4. Use the Basic tier and connect with MQTT over HTTPS

Explanation

Cloud-to-device messages and direct methods require the Standard tier, and MQTT connections use port 8883 or 5671. The Basic tier and HTTPS-only connections do not support these features.

Question 20Set up the Azure IoT Hub solution infrastructure

A company requires that device identities be managed by a separate team with read-only access, while the operations team can send messages to devices. Which combination of shared access policies satisfies this requirement?

  1. Registry read for the identity team and service connect for the operations team Correct answer.
  2. Registry write for the identity team and device connect for the operations team
  3. Service connect for both teams
  4. Registry read for both teams

Explanation

Registry read allows the identity team to view device identities without modification, and service connect allows the operations team to send cloud-to-device messages. Assigning each team the least privilege needed enforces separation of duties.

Question 21Set up the Azure IoT Hub solution infrastructure

You are deploying an IoT hub with an ARM template and need to reference the hub's hostname in a downstream resource. Which template construct should you use?

  1. A dependsOn entry on the downstream resource
  2. A variable containing a literal string
  3. An output that references the hub resource's properties Correct answer.
  4. A parameter with a default value

Explanation

Outputs expose values computed during deployment, such as the hub hostname, so other deployments or scripts can consume them. Parameters and variables supply inputs and constants but do not read resource properties.

Question 22Set up the Azure IoT Hub solution infrastructure

A device is enrolled through an individual enrollment in Device Provisioning Service and must be reprovisioned to a different hub after a factory reset. Which action should you take?

  1. Create a new group enrollment with the same registration ID
  2. Disable the device's shared access signature
  3. Delete the device identity from the original hub only
  4. Update the individual enrollment to target the new hub and allow reprovisioning Correct answer.

Explanation

Individual enrollments specify the target hub and a reprovisioning policy such as re-provisioning after initial assignment. Updating the enrollment changes where the device is assigned on its next registration.

Question 23Set up the Azure IoT Hub solution infrastructure

You need to route telemetry to a Service Bus queue only when the message body contains a specific device type and the message is not a duplicate. Which routing configuration is most appropriate?

  1. A route with a query on the body and the message property, plus duplicate detection on the endpoint Correct answer.
  2. A device twin desired property with a tag filter
  3. A fallback route with no query and enrichment enabled
  4. Two consumer groups on the built-in endpoint

Explanation

Routes can query message body and application properties to select a subset of messages, and the destination Service Bus queue can apply duplicate detection. Combining both satisfies the content filter and the deduplication requirement.

Question 24Set up the Azure IoT Hub solution infrastructure

A solution must support 6,000 device-to-cloud messages per second sustained, and the hub must also support twins and methods. How should you size the hub?

  1. Use the Free tier with multiple hubs
  2. Use the Basic tier with the maximum number of scale units
  3. Use the Standard tier with a single scale unit
  4. Use the Standard tier with enough scale units to meet the throughput requirement Correct answer.

Explanation

Throughput scales with the number of scale units, and each unit provides a defined message rate, so the required rate determines the unit count. The Standard tier is necessary because twins and methods are not available in Basic.

Question 25Set up the Azure IoT Hub solution infrastructure

You must prevent devices from connecting to an IoT hub except through a gateway that enforces certificate validation. Which hub configuration supports this requirement?

  1. Assign the registry read policy to devices
  2. Enable message enrichment on all routes
  3. Increase the partition count of the built-in endpoint
  4. Disable the public network access and route traffic through the gateway Correct answer.

Explanation

Restricting public network access forces device traffic through a controlled path such as a gateway or private endpoint. This lets the gateway enforce certificate validation before traffic reaches the hub.

Question 26Set up the Azure IoT Hub solution infrastructure

You are creating a new IoT hub by using the Azure CLI and need to select a pricing tier that supports cloud-to-device messages, device twins, and direct methods for a production workload. Which tier should you choose?

  1. Standard Correct answer.
  2. Free
  3. Basic
  4. Premium

Explanation

Cloud-to-device messaging, device twins, and direct methods are available only in the Standard and Premium tiers; the Free tier is intended for evaluation and has limited message quota, while Basic excludes these features. Standard is the usual production choice when advanced device features are required without the higher cost of Premium.

Question 27Set up the Azure IoT Hub solution infrastructure

You are deploying an IoT hub with an Azure Resource Manager template and want the hub to expose the built-in Event Hub-compatible endpoint so a downstream consumer can read telemetry. Which resource provider and resource type should the template declare?

  1. Microsoft.Devices/provisioningServices with the iotHubs property configured
  2. Microsoft.Devices/IotHubs with the messagingEndpoints property configured
  3. Microsoft.Devices/IotHubs with the eventHubEndpoints property configured Correct answer.
  4. Microsoft.EventHub/namespaces with an event hub that references the IoT hub

Explanation

The built-in Event Hub-compatible endpoint is a property of the IoT hub itself, so the template declares a Microsoft.Devices/IotHubs resource and configures eventHubEndpoints to set the partition count and retention time. No separate Event Hub namespace resource is needed for the built-in endpoint.

Question 28Set up the Azure IoT Hub solution infrastructure

You need to give a device application a connection string that allows it to send telemetry and receive cloud-to-device messages but does not allow it to create or delete device identities. Which type of credential should you use?

  1. A shared access policy on the IoT hub with the iothubowner permission
  2. A shared access signature for the built-in service endpoint with the service connect permission
  3. A device-specific symmetric key or X.509 certificate configured for that device identity Correct answer.
  4. A shared access policy on the IoT hub with the registry read and write permissions

Explanation

Device identities authenticate with their own symmetric key or X.509 certificate, and the permissions are scoped to that single device, so the device can send and receive messages but cannot manage the identity registry. Hub-level shared access policies are intended for backend services and grant broader permissions.

Question 29Set up the Azure IoT Hub solution infrastructure

You are configuring an IoT hub to send resource logs to Azure Monitor. Which destination should you choose to query connection and routing events with Kusto queries?

  1. An Event Hubs namespace
  2. A Log Analytics workspace Correct answer.
  3. An Azure Storage account
  4. An Azure Monitor metric alert

Explanation

Diagnostic settings can send IoT Hub resource logs to a Log Analytics workspace, where they are stored in tables that support Kusto queries. Storage accounts archive logs, and Event Hubs forward them to external consumers, but neither provides the built-in query experience.

Question 30Set up the Azure IoT Hub solution infrastructure

You are creating an IoT hub and need to ensure that devices in a restricted network can reach the hub without exposing it to the public internet. Which IoT Hub capability should you enable?

  1. Shared access policies
  2. Private endpoint connections Correct answer.
  3. Message routing
  4. Device-to-cloud partitions

Explanation

A private endpoint connection creates a private IP address for the IoT hub inside a virtual network, allowing devices and services to connect without traversing the public internet. Shared access policies, routing, and partition settings affect authorization and messaging behavior, not network isolation.

Question 31Set up the Azure IoT Hub solution infrastructure

You need to configure an IoT hub so that device-to-cloud messages are automatically enriched with the device's location before they are routed to a storage container. Which IoT Hub feature should you use?

  1. The file upload notification endpoint
  2. Message enrichment Correct answer.
  3. Message routing queries
  4. The device twin desired properties

Explanation

Message enrichment adds static or device-twin-derived values, such as location, as application properties to messages before routing, so downstream endpoints receive the extra metadata. Routing queries only filter messages, and twin desired properties are configuration data, not message metadata.

Question 32Set up the Azure IoT Hub solution infrastructure

A solution must support 6,000 device-to-cloud messages per second sustained, and the hub must also support twins and methods. Which IoT Hub tier and scale should you choose?

  1. Free tier with one unit
  2. Basic tier with ten units
  3. Standard tier with three units Correct answer.
  4. Standard tier with one unit

Explanation

The Standard tier is required for twins and methods, and each Standard unit provides a documented throughput allowance; three units are needed to sustain 6,000 messages per second while leaving capacity for other operations. The Basic tier lacks twins and methods, and the Free tier is not intended for production throughput.

Question 33Set up the Azure IoT Hub solution infrastructure

You are using an ARM template to deploy an IoT hub and want to reference the hub's hostname in a downstream resource. Which template expression should you use?

  1. reference(resourceId('Microsoft.Devices/IotHubs', variables('hubName'))).properties.state
  2. reference(resourceId('Microsoft.Devices/IotHubs', variables('hubName'))).hostName Correct answer.
  3. reference(resourceId('Microsoft.Devices/IotHubs', variables('hubName'))).properties.eventHubEndpoints
  4. reference(resourceId('Microsoft.Devices/IotHubs', variables('hubName'))).sku.name

Explanation

The reference function returns the runtime properties of a deployed resource, and hostName is the property that contains the fully qualified hub hostname. Other properties such as eventHubEndpoints, sku, and state do not contain the hostname.

Question 34Set up the Azure IoT Hub solution infrastructure

You need to prevent devices from connecting to an IoT hub except through a gateway that enforces certificate validation. Which IoT Hub setting should you configure?

  1. Disable public network access and allow only the gateway's private endpoint Correct answer.
  2. Set the hub's minimum TLS version to 1.2
  3. Disable the built-in Event Hub-compatible endpoint
  4. Rotate the hub's shared access policies daily

Explanation

Disabling public network access and permitting only a private endpoint used by the gateway ensures that devices cannot reach the hub directly over the internet. TLS version and shared access policy rotation affect security posture but do not restrict which network path clients use.

Question 35Set up the Azure IoT Hub solution infrastructure

You are creating an IoT hub and want to limit the number of concurrent device connections to control cost. Which setting should you configure?

  1. The message retention time
  2. The number of IoT Hub units Correct answer.
  3. The file upload storage container
  4. The device-to-cloud partition count

Explanation

The number of units determines the hub's throughput and connection capacity, so reducing units limits concurrent device connections and lowers cost. Partition count, retention time, and storage container settings affect messaging behavior, not connection capacity.

Question 36Set up the Azure IoT Hub solution infrastructure

You are configuring an IoT hub to route telemetry to a Service Bus queue only when the message body contains a specific device type and the message property priority equals high. Which routing query syntax should you use?

  1. deviceType = 'sensor' AND priority = 'high'
  2. $body.deviceType = 'sensor' OR priority = 'high'
  3. $body.deviceType = 'sensor' AND priority = 'high' Correct answer.
  4. $body.deviceType = 'sensor' AND $body.priority = 'high'

Explanation

In IoT Hub routing queries, message body fields are referenced with the $body prefix, while application and system properties are referenced by name, so the correct form combines $body.deviceType with priority. Using OR would match messages that satisfy only one condition, and prefixing priority with $body would look for it in the body.

Question 37Provision and manage devices

You need device-to-cloud telemetry from many devices, and each device must be able to authenticate with its own unique credential rather than sharing one key. Which Azure IoT Hub feature should you use?

  1. The built-in Event Hubs-compatible endpoint
  2. A shared IoT Hub connection string embedded in firmware
  3. Per-device symmetric keys in the device identity registry Correct answer.
  4. A single shared access policy scoped to registry read

Explanation

Each device identity in the IoT Hub registry carries its own symmetric keys, so credentials can be revoked or rotated individually without affecting other devices. Shared keys or shared connection strings cannot be revoked per device and dramatically widen the blast radius of a leak.

Question 38Provision and manage devices

Which attestation mechanism does the Device Provisioning Service accept for an individual enrollment using a TPM?

  1. A symmetric key stored in the device's firmware
  2. A signed X.509 root certificate chain
  3. An endorsement key stored in plaintext in the enrollment record
  4. The TPM endorsement key plus the public part of the storage root key Correct answer.

Explanation

TPM attestation in DPS relies on the endorsement key and the storage root key public area, which the device presents as its unique hardware identity. The service validates that the presented values match the individual enrollment before assigning the device to an IoT hub.

Question 39Provision and manage devices

You are registering a group of devices in DPS that will each present a certificate signed by your company's intermediate CA. Which enrollment type fits this requirement?

  1. Enrollment group with X.509 intermediate or root certificate attestation Correct answer.
  2. Enrollment group with symmetric key attestation
  3. Individual enrollment with TPM attestation
  4. Individual enrollment with symmetric key attestation

Explanation

An enrollment group with X.509 attestation lets you register many devices whose certificates chain to a trusted root or intermediate CA, so devices are provisioned without pre-registering each one. Individual enrollments would require a separate record per device and do not scale to a CA-issued fleet.

Question 40Provision and manage devices

What is the primary purpose of an allocation policy configured on a DPS enrollment?

  1. To choose which IoT hub a newly provisioned device is assigned to Correct answer.
  2. To select the transport protocol the device will use
  3. To throttle the rate at which devices can send telemetry
  4. To rotate the device's symmetric key automatically after provisioning

Explanation

Allocation policies such as evenly distributed, lowest latency, static configuration, or custom functions determine which linked IoT hub receives a device during provisioning. They influence hub assignment only; they do not govern keys, throttling, or transport.

Question 41Provision and manage devices

A device uses DPS with symmetric key attestation and has been assigned to a hub. Which value does the device need to compute the derived device key?

  1. The IoT hub's Event Hubs-compatible endpoint
  2. The DPS global endpoint hostname
  3. The registration ID Correct answer.
  4. The device's X.509 thumbprint

Explanation

For symmetric key attestation the device derives its key by HMAC-hashing the enrollment group's primary or secondary key using the registration ID as the message. The resulting derived key is then used to authenticate to the assigned hub.

Question 42Provision and manage devices

You want to prevent a device from being provisioned to a hub until an operator has explicitly approved it. Which DPS capability should you configure?

  1. Disable the enrollment group entirely
  2. Enable custom allocation with a webhook
  3. Mark the individual enrollment as disabled until approval Correct answer.
  4. Set the enrollment's reprovisioning policy to never

Explanation

An individual enrollment can be created in a disabled state, so the device cannot be provisioned until an operator enables it. This provides an explicit approval gate before a device receives hub credentials.

Question 43Provision and manage devices

Which statement about device twins in IoT Hub is accurate?

  1. Device twins are stored only in the device's local memory
  2. A device twin can store only reported properties
  3. A device twin is deleted automatically when the device disconnects
  4. Each device identity has exactly one device twin Correct answer.

Explanation

IoT Hub maintains exactly one device twin per device identity, containing tags, desired properties, and reported properties. The twin persists in the hub regardless of connection state until the identity is deleted.

Question 44Provision and manage devices

A backend service updates a desired property in a device twin while the device is offline. What happens when the device reconnects?

  1. The update is discarded because the device was offline
  2. The device receives the desired property on its next twin synchronization Correct answer.
  3. The update is converted into a cloud-to-device message automatically
  4. The device twin is recreated from the last reported state

Explanation

Desired properties are persisted in the twin, so an offline device receives the current desired state when it next connects and retrieves or subscribes to twin updates. No message conversion or state reset occurs.

Question 45Provision and manage devices

Which IoT Hub operation should a device use to report its current firmware version so a backend can query it?

  1. Modify a tag on the device twin
  2. Create a new device identity
  3. Update a reported property in its device twin Correct answer.
  4. Send a cloud-to-device message

Explanation

Devices report their own state by updating reported properties in the device twin, which backends can then read or query. Tags are set by the solution backend, and identities are managed by services, not by the device.

Question 46Provision and manage devices

You need to find all devices whose twin tag reports a building of 'BuildingA' and a floor greater than 3. Which approach is appropriate?

  1. List all devices and filter client-side in the portal
  2. Use a direct method call broadcast to every device
  3. Subscribe to the telemetry endpoint and parse messages
  4. Use a twin query with a WHERE clause on tag properties Correct answer.

Explanation

IoT Hub twin queries support filtering on tags, desired properties, and reported properties using a SQL-like syntax, so the filter should be expressed in the query. Client-side filtering or telemetry parsing does not scale and is not the intended mechanism.

Question 47Provision and manage devices

Which statement describes a direct method compared with a cloud-to-device message?

  1. A direct method is fire-and-forget with no response
  2. A cloud-to-device message requires the device to be online to be delivered
  3. A direct method requires the device to be connected and returns a result Correct answer.
  4. A cloud-to-device message always returns a synchronous status code

Explanation

Direct methods are synchronous request-response invocations that require the device to be connected and return a status code and payload. Cloud-to-device messages are asynchronous and can be queued for offline devices.

Question 48Provision and manage devices

What is the purpose of a module identity in IoT Hub?

  1. To give a device a second connection string for telemetry only
  2. To replace the device twin with a module twin entirely
  3. To provide a shared access policy for backend services
  4. To represent a component of a device with its own twin and credentials Correct answer.

Explanation

A module identity lets a single device host multiple components, each with its own connection string, module twin, and direct method surface. The device twin still exists alongside module twins.

Question 49Provision and manage devices

Which credential type allows a device to authenticate to IoT Hub without storing a symmetric key on the device?

  1. A SAS token generated from a shared access policy
  2. A connection string containing the device key
  3. An X.509 client certificate with its private key Correct answer.
  4. An enrollment group symmetric key

Explanation

X.509 client certificate authentication uses the device's certificate and private key, so no symmetric key needs to be stored. SAS tokens and connection strings are derived from symmetric keys, and enrollment group keys are symmetric secrets.

Question 50Provision and manage devices

You need to bulk-register 5,000 existing devices from a CSV file into IoT Hub. Which approach is most appropriate?

  1. Use the IoT Hub bulk import/export job with a blob container Correct answer.
  2. Call the create-identity API once per device in a loop without batching
  3. Send a direct method to each device to self-register
  4. Create a single device identity and share its connection string

Explanation

The bulk import/export job reads or writes device identities in bulk through an Azure Storage blob, making it suited to large CSV-driven registrations. Sequential single calls are slow and subject to throttling, and self-registration is not supported.