The most cost-effective and secure solution is to configure VPN concentrators inside the OT networks at both sites (Option D). This setup allows encrypted communications between Site A and Site B, enabling controllers at either site to serve as secondary or failover devices for the other. By leveraging VPN tunnels, the organization avoids the expensive and time-consuming process of laying new fiber infrastructure, while still ensuring secure, authenticated, and encrypted connections across sites.
Option A, direct fiber connectivity, provides high performance but is extremely costly and less flexible than VPN solutions. Option B, deploying redundant SCADA controllers at each site, increases hardware, licensing, and management costs while still requiring interconnectivity. Option C, air-gapping the OT network, may improve isolation but would prevent remote failover capabilities, contradicting the requirement for cross-site control.
By implementing VPN concentrators, the organization achieves secure cross-site redundancy, supports operational continuity in case of controller outages, and does so in a cost-effective manner aligned with common OT security practices.

Qualitative risk assessment is used when quantitative data (monetary loss, exact downtime cost, RTO) is unavailable or unreliable. The SecurityX CAS-005 GRC objectives note that qualitative methods rely on expert judgment, likelihood scales, and impact ratings rather than financial calculations. In this case, insufficient metrics rule out quantitative analysis.
* Option A (work experience) is irrelevant to the choice of assessment type.
* Option C (risk register) supports tracking, not selecting the assessment method.
* Option D describes a quantitative goal, which is not possible with the given lack of metrics.

SecurityX CAS-005 secure DevOps guidance recommends integrating security controls into the CI/CD pipeline. By validating container security baselines at security gates before deployment, noncompliant builds are stopped early, ensuring consistency across environments.
* Option B is useful but does not ensure compliance if changes are made after image creation.
* Option A detects drift but only after deployment.
* Option D is reactive and does not prevent insecure deployments.

Tokenizationreplaces sensitive data (e.g., PII) with non-sensitive placeholders while maintaining format consistency, ensuring compliancewithout disrupting testing. This method is commonly used forPCI-DSS and GDPR compliancewhile preserving data structure for functional tests.
* Encryption (A)secures data but does not remove sensitivity or solve testing concerns.
* Truncation (B)removes portions of data but may impact testing if format requirements are strict.
* Synthetic data (C)can be useful but may not always match real-world scenarios perfectly for testing purposes.
Reference:CompTIA SecurityX (CAS-005) Exam Objectives- Domain 1.0 (Governance, Risk, and Compliance), Section onPrivacy Risk Considerations & Data Protection