I don't know either, but thought about it a lot at one point.

First, you only respond to correctly encrypted/signed requests. Everything else you ignore.

So, second, once you have your valid request, you respond to it, also in an encrypted fashion. IIRC F-35 can use their radars, with their bean-forming abilities, for stealthy comms, sending a very narrow beam of radio signals to the recipient.

And if this is fantasy, I suppose by the time you receive an IFF query, you know you're about to be shot at. So you might as well respond, sacrificing stealth. Hence why you want to really be sure you're really asked by your side, rather than receiving a spoof request.

Airlines just broadcast a ton of public information about themselves, so they don't really need an IFF system. They put their hands up and say "don't shoot, I'm a civilian!".