You are operating an industrial IoT infrastructure with a number of devices using X.509 attestation. The devices monitor safety conditions of chemical reactors. All the devices have been provisioned through the device provisioning service using individual enrollment. Now two of the reactors are going to be dismounted, and the related devices must be deprovisioned and sold. Your task is to ensure that the devices will not be able to re-enroll in the future. You have disabled the devices’ enrollment entry in the DPS, and deleted the identity registries from the IoT Hub. 
Can you be sure that the devices will not be able to re-enroll?

Answer options:

A.Yes
B.No

Correct Answer: A
Option A is CORRECT because in case an enabled enrollment group exists on the DPS, which uses a signing certificate of the devices, there is a risk that the devices can re-enroll, even if their enrollment entry has been deleted. Therefore, disabling the enrollment entry instead of deleting it is the right solution.
Option B is incorrect because if you delete an individual enrollment of devices using X.509 attestation and an enabled enrollment group exists for a signing certificate in the devices’ certificate chain, the devices still can re-enroll.
References: 

https://docs.microsoft.com/en-us/azure/iot-dps/how-to-unprovision-devices#individual-enrollments
https://docs.microsoft.com/en-us/azure/iot-dps/concepts-x509-attestation