After the acquisition of an environment monitoring infrastructure from a local operator, your company needs to integrate hundreds of their field devices into your company’s IoT infrastructure. Most of the devices use X.509 authentication but there are some device types that are secured with TPM modules. 
For each device, the enrollment list must contain the <............1............> of the device because this is the key that the Device Provisioning Service checks on the first connection attempt of the device. 
Which of the following objects completes the above statement <..1..>?

Answer options:

A.public part of the endorsement key
B.public part of the storage root key
C.private part of the SRK
D.private part of the endorsement key

Correct Answer: A
Option A is CORRECT because the Device Provisioning Service uses the public part of the endorsement key (EK_pub) to identify and enroll the device. This key has to be provided in the enrollment of the device.
Option B is incorrect because the Device Provisioning Service never checks the SRK or owner of the device.
Option C is incorrect because the private part of any of the device keys is hidden and retained in the TPM; it is never revealed to outside services.
Option D is incorrect because private parts of any of the device keys are hidden and retained in the TPM; they are never revealed to outside services.
Diagram: 

References: 

https://docs.microsoft.com/en-us/azure/iot-dps/concepts-tpm-attestation
https://docs.microsoft.com/en-us/azure/iot-dps/about-iot-dps#provisioning-process
https://docs.microsoft.com/en-us/azure/iot-dps/concepts-tpm-attestation#detailed-attestation-process