Which Security Modes does an OPC UA SecureChannel support per the standard?

The OPC UA specification defines exactly three Security Modes on a SecureChannel: None (no protection, dev/test only), Sign (authentication and integrity via HMAC, no confidentiality), and SignAndEncrypt (sign plus AES encryption). Option A is wrong because "Encrypt" without signing is not a defined mode; you cannot encrypt without also signing in OPC UA. Option B is wrong because it omits the mandatory SignAndEncrypt mode used in production. Option D is wrong because it removes the None mode, which is legally part of the standard even though it is unsuitable for production. In production you should always choose SignAndEncrypt with a strong Security Policy such as Basic256Sha256, Aes128_Sha256_RsaOaep or Aes256_Sha256_RsaPss.

Treat SecurityMode=None as a red flag in any production audit: it is acceptable only on a strictly isolated commissioning network, never on a routed plant network.