Neco 2022 Data Processing Question 11

The company has identified three threats to its information assets:\n\n- Threat A: probability \(0.02\), potential loss \u20A6 500,000.\n- Threat B: probability \(0.05\), potential loss \u20A6 300,000.\n- Threat C: probability \(0.01\), potential loss \u20A6 800,000.\n\nThree possible security controls are available, but only one can be implemented:\n\n* Control X reduces the probability of Threat A by \(40\%\) and Threat B by \(20\%\).\n* Control Y reduces the probability of Threat C by \(50\%\) and Threat B by \(30\%\).\n* Control Z reduces the probability of Threat A by \(25\%\) and Threat C by \(25\%\).\n\nAssuming the reductions are applied to the original probabilities, which control results in the lowest expected annual loss? State your answer as "Control X", "Control Y" or "Control Z".