Gce Model Questions Vol1 2024 Computer Studies Question 34

A company evaluates three assets: A1 valued at \(\text{₦}50{,}000\), A2 at \(\text{₦}30{,}000\) and A3 at \(\text{₦}20{,}000\). Two threats are identified: T1 with probability 0.02 and T2 with probability 0.05. Vulnerability V1 (impact factor 1.5) affects A1 and A2 and is exploitable by T1; vulnerability V2 (impact factor 2.0) affects A3 and is exploitable by T2. Risk for an asset is calculated as \(\text{Value} \times \text{Probability} \times \text{Impact factor}\). (a) Compute the total risk for the company. (b) A security control costing \(\text{₦}5{,}000\) reduces the probability of T2 by half. After implementing the control, does the total risk fall below a threshold of \(\text{₦}5{,}000\)? State the new total risk.