Distributed databases and cybersecurity

Explain what a distributed database is and give two advantages compared to a centralised database (availability, scalability) and one complication it introduces (consistency between copies).

Explain what data replication is and how it differs from a backup: what problem each one solves (hot failover vs loss or corruption of data) and why a reliable service needs both.

The figure shows a service with its data replicated across three nodes; one of them has failed and is marked with a question mark. Explain what happens to the service while the node is down, what the system must do upon recovering it, and what property of distributed systems is being taken advantage of.

An online shop replicates its database across two distant data centres. Following a network outage between them, each centre continues to accept orders. Analyse the consistency issue that arises (the CAP theorem: consistency, availability, and partition tolerance), which option you would choose for product stock and which for customer reviews, justifying the difference.

A global platform combining a social network and a microtransaction gateway replicates its databases across nodes located in Europe, the Americas, and Asia. An unexpected cut in submarine communication cables temporarily isolates the European region from the rest of the continents. Apply the CAP theorem to predict the operational consequences if the system attempts to prioritize availability (AP systems) versus strict consistency (CP systems). Justify technically and economically why an eventual consistency model should be adopted for a video's view counter, whereas for users' digital wallet balances it is imperative to block unsynchronized transactions, analyzing the risk of double-spending.

Define each of these common threats in one sentence: phishing, ransomware, denial-of-service (DoS) attack, and data breach. State which one primarily targets the human factor.

You receive an email that appears to be from your bank: it urgently asks you to 'verify your account' via a link. Detail at least four red flags that would betray a phishing attempt (sender, actual link, urgency, spelling errors, attachments) and what you should do step by step.

A 'maintenance technician' calls reception saying they need the management Wi-Fi password to repair the printer. Explain what pretexting (social engineering) is, what red flags betray the call, and what verification protocol should be in place (never share credentials over the phone, verify identity through an official channel).

Explain what a password manager does and why it allows using a long, distinct password for each service. What risk does it concentrate (the master password) and how is it mitigated?

Explain the basic concept of encryption: transforming readable data into unreadable data without the key. Distinguish between encrypting stored data (at rest) and encrypting communication (in transit, as HTTPS does), and explain what each one protects.

The support department of an e-commerce company discovers on a Monday at 08:00 that, due to a security breach in its web gateway, an attacker has exfiltrated a database containing names, home addresses, national ID numbers (DNI), and credit card numbers belonging to 25.000 customers. The commercial director proposes not to disclose the leak publicly in order to prevent a reputation crisis and the financial losses resulting from customer churn, arguing that the technical flaw has already been resolved by 11:00. Assess the director's proposal from both a legal and security perspective: determine the mandatory and non-extendable deadlines established by the GDPR regarding the supervisory authority and the affected individuals, classify the risk level to the users' rights, and predict the sanctions and legal liabilities the company faces if it deliberately conceals the incident.