City Guilds Model Questions Vol1 2021 Information Technology Question 34

During a 24‑hour monitoring period an organisation recorded 5 000 login attempts. The breakdown is: - Successful attempts: 4 800 - Failed attempts: 200 Among the failed attempts, 150 originated from IP addresses that are on a known blacklist. Among the successful attempts, 50 originated from IP addresses that were previously on the blacklist but have since been removed. For the purpose of risk analysis, a login attempt is considered **malicious** if it is either a failed attempt from a blacklisted IP or a successful attempt from a previously‑blacklisted IP. 1. What is the probability that a randomly selected login attempt is malicious? Express your answer as a decimal rounded to four places. 2. The security team will block any IP address that accounts for at least 0.5 % of the total malicious attempts. Assuming each malicious attempt comes from a distinct IP address, how many distinct IP addresses can be blocked? Provide the two answers separated by a comma.