Your company is extending its operation and it has just built a new plant which is going to manufacture batteries for electric vehicles. The plant is equipped with thousands of sensors whose data are to be transmitted to an Azure IoT Hub and then to other cloud services for further analysis. Your task is to design the group provisioning of devices using X.509 certificates. Enrollment for the new plant must be separated from other plants. 
How would you organize the use of certificates?

Answer options:

A.Assign device certificates to the DPS enrollment entry
B.Assign intermediate certificate to the DPS enrollment entry
C.Use the CA certificate for the enrollment entry
D.Either B or C

Correct Answer: B
Option A is incorrect because device (or leaf) certificates should be used on end-devices, exclusively. The leaf certificate is the end of the chain of trust and is not used to sign further certificates.
Option B is CORRECT because it is the intermediate certificate which can be used to group devices by product lines, locations, or plants, for the given scenario. The Intermediate certificate for the new plant will be used to sign the certificates belonging to the plant only, thus ensuring the separation from other plants.
Option C is incorrect because the CA certificate is the top-level certificate of the company. It is used to sign the intermediate certificates and should not be used in the enrollment entries.
Option D is incorrect because only use of intermediate certificates (B) is recommended. CA certificate © should not be used at enrollment group level.
Diagram: 

References: 

https://docs.microsoft.com/en-us/azure/iot-dps/tutorial-custom-hsm-enrollment-group-x509
https://docs.microsoft.com/en-us/azure/iot-dps/concepts-x509-attestation#why-are-intermediate-certs-useful