Gce Model Questions Vol1 2023 Computer Studies Question 38

A risk analyst evaluates three threats to a system. Their likelihood (L) and impact (I) are scored on a 1-5 scale as follows: Threat 1: L=4, I=5; Threat 2: L=3, I=4; Threat 3: L=2, I=3. The analyst can implement one of three controls: - Control C1 reduces the likelihood of Threat 1 by 50 % and costs $2000. - Control C2 reduces the impact of Threat 2 by 2 points (minimum impact is 1) and costs $1500. - Control C3 reduces the likelihood of Threat 3 by 25 % and the impact of Threat 3 by 1 point, costing $2500. Risk for a threat is calculated as (R = L \times I). (a) Compute the initial risk scores for each threat and the total risk. (b) Compute the new total risk after each individual control is applied (assume only that control is used). (c) Which control gives the greatest reduction in total risk per dollar spent? State the control identifier.