You are designing the IoT solution of an office building where you would need 1000 devices registered in your IoT Hub. Each device has its device twin, the content of which can be manipulated either from the back-end or from the device app itself. However, the back-end and the device app have different rights when accessing different parts of the device twin. 
Regarding the access to different parts of the device twin, which of the following statements are true?

Answer options:

A.Device app can retrieve the device twin id, tags and properties; device gets notified of the changes in the desired properties
B.Device app can update the reported properties; Back-end can partially update reported properties
C.Back-end can update device twin tags; Device app can partially update device twin tags
D.Back-end can set desired properties; Device app can partially update reported properties

Correct Answer: D
Option A is incorrect because device apps don’t have access (not even visibility) to the “tags” session in the device twin.
Option B is incorrect because “reported” properties are values to be updated by the device app. Back-end has only read access to them.
Option C is incorrect because device twin tags can only be accessed (read and write) by the back-end application. Device app has no visibility over tags.
Option D is CORRECT because desired properties are kind of instructions sent from the back-end to the device, while reported properties are values sent by the devices to the opposite direction.
Diagram: 

References: 

https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-device-twins
https://docs.microsoft.com/en-us/azure/iot-hub/tutorial-device-twins