DMG p. 277 provides a table and some instructions for the computation of effective hit points based on resistances and immunities when computing the defensive Challenge Rating of a monster, or figuring out how many actual HP a monster should have based on its defensive CR for that matter. However, the example provided in the DMG does not account for a monster (like a mummy) that has both resistances and immunities (to different damage types, of course).
So: if a monster has both resistances and immunities to damage, do you use the greater multiplier or do you apply both multipliers to get your EHP value during the CR calculation?
Best Answer
If it has both Immunity and Resistance, use Immunity only
You are meant to apply the multiplier for immunity only, in the case that the monster has both immunity and resistance. I suppose it's because immunity is stronger than resistance, and that's the one that goes.
Case Study: The Ice Devil
The Ice Devil has an overall CR 14, has immunity to 3 damage types, and resistance to 3 damage types. By dismantling this monster's design, we can learn how the designers did it and how we can follow that process.
Calculating its Offensive CR
The following is the creature's ability to deal the most damage:
Wall of Ice (70 damage): 35 cold damage, hitting at least 2 creatures;
Multiattack (64 damage): One Bite (12 piercing + 10 cold), One Claw (10 slashing + 10 cold), One Tail (12 bludgeoning + 10 cold);
Multiattack (64 damage): One Bite (12 piercing + 10 cold), One Claw (10 slashing + 10 cold), One Tail (12 bludgeoning + 10 cold).
The Ice Devil's DPR is \$\frac{70+64+64}{3} = 66\$, which puts it at CR 10. At this DPR, it should have a +7 to-hit bonus, but the Ice Devil has a +10. This means its final Offensive CR is CR 11.
Calculating its Defensive CR
So we know the final CR and the Offensive CR, and so we can get the Defensive CR. This is:
\begin{align} \text{Round}(\frac{x + 11}{2}) = 14 \end{align} \begin{align} x = 16,17, \text{or } 18 \end{align}
Now let's start removing points off this CR.
Finding its Effective AC: 22
Base Defense CR: 11
Defense CR, only Resistances: CR 13
Defensive CR, both Resistance & Immunity: CR 19
Defensive CR, only Immunity: CR 16
Conclusion
Based on the Iced Devil, you only take into account the immunity multiplier, when the creature has both immunities and resistances.