Gce Model Questions Vol1 2022 Computer Studies Question 28

An organisation faces a single type of security threat that, on average, occurs with probability \(p_0 = 0.12\) per year. If the threat materialises, the expected financial loss is ₦5,000,000. Three security controls are available: - Control A reduces the threat probability by 30 % (the new probability is multiplied by 0.70) and costs ₦150,000 per year. - Control B reduces the threat probability by 45 % (multiplied by 0.55) and costs ₦200,000 per year. - Control C reduces the threat probability by 20 % (multiplied by 0.80) and costs ₦120,000 per year. The effects of the controls are independent and combine multiplicatively. Management wants to choose the combination of controls that minimises the total expected annual cost, defined as the sum of the yearly control costs and the expected loss after the controls are applied. Which combination of controls should be implemented and what is the resulting minimum total expected annual cost (in ₦)?