Neco 2020 Data Processing Question 47

A company employs 200 staff members. Each staff member uses either a strong password (probability \(0.6\)) or a weak password (probability \(0.4\)). An attacker's brute‑force attempt succeeds with probability \(0.02\) on a weak password and \(0.001\) on a strong password. The company introduces two‑factor authentication (2FA) for \(30\%\) of the employees, which reduces any successful breach probability by a factor of \(0.1\) for those protected users. Assuming the proportion of weak passwords among the 2FA group is the same as the overall original proportion, what is the maximum allowable proportion of weak passwords among the remaining \(70\%\) of employees (those without 2FA) so that the expected number of compromised accounts is less than 1? Express your answer as a percentage (to the nearest whole number).