Neco 2018 Data Processing Question 3

A company faces a potential insider data‑theft risk. Without any preventive measure, the probability of a theft occurring in a year is \(0.02\) and the estimated loss per incident is \(\$200{,}000\).\n\nTwo preventive measures are available:\n\n1. Monitoring system - reduces the theft probability to \(0.005\) but costs \(\$8{,}000\) per year.\n2. Employee‑training program - reduces the loss per incident by 30 % (to \(\$140{,}000\)) and costs \(\$3{,}000\) per year.\n\nThe measures can be implemented separately or together. Assuming the effects are independent, which combination of measures (none, monitoring only, training only, both) yields the lowest expected total annual cost (sum of implementation cost and expected loss)?