You are operating an industrial IoT infrastructure with a number of devices using X.509 attestation. The devices monitor safety conditions of chemical reactors. All the devices have been provisioned through the device provisioning service. Now two of the reactors are going to be dismounted, and the related devices will be deprovisioned and sold. Your task is to ensure that the devices will not be able to re-enroll in the future. You have just deleted the devices’ enrollment entry from the DPS, and deleted the identity registries from the IoT Hub. 
Can you be sure that the devices will never be able to re-enroll?

Answer options:

A.Yes
B.No

Correct Answer: B
Option A is incorrect because if you delete an individual enrollment of devices using X.509 attestation and an enabled enrollment group exists for a signing certificate in the devices’ certificate chain, there still is a chance that devices can re-enroll.
Option B is CORRECT because in case an enabled enrollment group exists on the DPS, which uses a signing certificate of the devices, there is a risk that the devices can re-enroll, even if their enrollment entry has been deleted. In this case, the enrollment entry should be disabled, rather than deleted.
References: 

https://docs.microsoft.com/en-us/azure/iot-dps/how-to-unprovision-devices
https://docs.microsoft.com/en-us/azure/iot-dps/concepts-x509-attestation