Neco 2024 Data Processing Question 15

A company has identified three independent security threats with the following inherent risk scores (on a scale from 0 to 1):\n\n- Threat A: 0.8\n- Threat B: 0.6\n- Threat C: 0.4\n\nThree security controls are available:\n\n- Control X reduces Threat A by 45 % (effectiveness = 0.45).\n- Control Y reduces Threat B by 55 % (effectiveness = 0.55).\n- Control Z reduces Threat C by 80 % (effectiveness = 0.80).\n\nOnly two controls can be implemented because of budget limits. The residual risk for a threat after a control is applied is calculated as\n\[\n\text{Residual Risk}= \text{Inherent Risk}\times (1-\text{Effectiveness}).\n\]\nDetermine which pair of controls should be implemented to achieve the lowest total residual risk (sum of residual risks for all three threats). State the chosen controls and the resulting total residual risk (rounded to three decimal places).