A risk is real when there is a presence of threat (such as a willing and capable attacker), a vulnerability that the attacker can exploit, and a high likelihood that the attacker will carry out the threat. (a) Describe the TWO (2) types of losses when the vulnerability is exploited by hostile user. Using suitable example, calculate the annual loss expectancy (ALE) for the two losses. (b) (c) [10 marks] Briefly explain the FIVE (5) types of control can be implemented as the countermeasures for vulnerability. [5 marks] Suggest suitable countermeasure for one of the losses in Q1(a) and justify your answer accordingly. [5 marks] (d) Under what situation the management would have to give up implementing the countermeasure and accept the risk? Describe the risk acceptance process. [5 marks]