In order to keep the level of security as high as possible, you need to build a comprehensive monitoring and alerting solution around your devices. Az the first step, you already enabled IoT Defender for your IoT hubs. Now you want to configure an alerting system customized to the type and behavior of your devices. Most of the devices connect to the IoT hub directly but some legacy devices use edge gateways to send data to the hub. 
How do you customize the alerting system to the types of devices?

Answer options:

A.Add the {"SecurityGroup": "default"} tag to twins of the edge devices
B.Add the "SecurityGroup": "secGrp01" tag to the azureiotsecurity module twin
C.Add the "SecurityGroup": "secGrp01" tag to twins of each device
D.Add the {"SecurityGroup": "default"} tag to twins of each device

Correct Answer: C
Option A is incorrect because if you want to customize the alerts by the type of device, the “SecurityGroup” tag with the name of the corresponding security group should be added to all device twins, not only for the edges.
Option B is incorrect because while the security module twin holds all the information relevant to device security for each of your devices, to create custom alerts for device categories, the “SecurityGroup” tag should be used in the device twins.
Option C is CORRECT because the “SecurityGroup” tag is designed for defining logical groups of devices, and managing their security state in a centralized way. Its place is in the device twin. When created, each device belongs to the security group “default”.
Option D is incorrect because if you need to customize the alerts by the type of devices, you should use group names different from “default” in the device twins.
References: 

https://docs.microsoft.com/en-us/azure/defender-for-iot/quickstart-create-custom-alerts
https://docs.microsoft.com/en-us/azure/defender-for-iot/concept-customizable-security-alerts