Neco 2017 Data Processing Question 46

Company XYZ has identified three security threats to its data system:\n\n- Threat A: probability 0.02 per year, impact \(\text{\u20A6}500,000\).\n- Threat B: probability 0.05 per year, impact \(\text{\u20A6}200,000\).\n- Threat C: probability 0.01 per year, impact \(\text{\u20A6}1,000,000\).\n\nIt can implement one of two security controls:\n\nControl X reduces the probability of Threats A and B by \(60\%\) each and costs \(\text{\u20A6}150,000\).\nControl Y reduces the impact of Threat C by \(40\%\) and its probability by \(30\%\); it costs \(\text{\u20A6}120,000\).\n\nOnly one control can be adopted. Considering both the expected annual loss after implementation and the one‑time implementation cost, which control should the company choose to minimise the total monetary outlay?