Neco 2022 Computer Studies Question 20

An organization assesses three threat categories with the following annual occurrence probabilities and potential monetary impacts: Malware (probability \(0.20\), impact \(\text{₦}2{,}000{,}000\)), Insider abuse (probability \(0.05\), impact \(\text{₦}5{,}000{,}000\)), and DDoS attack (probability \(0.10\), impact \(\text{₦}3{,}000{,}000\)). The organization can invest in security controls that reduce the probability of each threat by \(30\%\) per \(\text{₦}500{,}000\) spent, up to a maximum reduction of \(60\%\) per threat. With a total budget of \(\text{₦}1{,}500{,}000\), how should the funds be allocated among the three threat controls to minimise the expected annual loss? State the allocation (in \(\text{₦}\)) for each threat and the resulting minimized expected loss (in \(\text{₦}\)).