It is known that a particular type of software test is certain to identify virus X if it has been inserted into a computer system. However, there is also a 5% probability of a false alarm (i. e., there is a 5% the probability that the test will be positive when virus X has not been inserted). You run the test and the outcome is positive. 1. What can you conclude about whether or not the system really is infected with the virus X?
2. How would your answer to (1) change if additionally, it was known that virus X had been inserted into approximately one in every thousand computer systems?
3. Suppose the only known effective fix for virus X costs $250,000 when the full costs of system shutdown and repair are considered. From a risk assessment perspective what action would you recommend you should state any assumptions about additional information needed)?