Your company operates solar farms at several sites. The farms are equipped with hundreds of smart sensors that need to be connected to an Azure IoT infrastructure. An IoT Hub shall be used, with the sensors from different sites using X.509 authentication. You need to set up bulk enrollment of the devices in DPS and configure the use of the certificates.The root certificate is uploaded to IoT Hub and the enrollment groups have their intermediate certificates. 
What data need the devices to send to successfully authenticate in the DPS?

Answer options:

A.The root certificate of the IoT Hub; Intermediate certificate; device certificate
B.Intermediate certificate of the corresponding enrollment group; device certificate
C.Device certificate
D.The root certificate of the IoT Hub; device certificate

Correct Answer: A
Option A is CORRECT because the device should present the whole certificate chain from its unique leaf certificate up to the verified top-level (root) certificate.
Option B is incorrect because the chain of trust must contain the whole chain of certificates from the leaf up to the verified certificate, i.e. the certificate on the IoT Hub. Authentication will fail.
Option C is incorrect because the chain of trust must contain the whole chain of certificates from the leaf up to the verified certificate, i.e. the certificate on the IoT Hub. Authentication will fail.
Option D is incorrect because the device certificate is signed with the intermediate, therefore it also must be provided as part of the whole chain of trust.
Reference: 

https://docs.microsoft.com/en-us/azure/iot-dps/concepts-x509-attestation#dps-device-chain-requirements