@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

<https://knobit.org/id/task/dsec-access-control/C1> a edu:Question ;
    rdfs:label "C1 (2 points)"@en ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/task/dsec-access-control/C1> ;
    schema:hasPart <https://knobit.org/id/register/data-security#SE-301>,
        <https://knobit.org/id/register/data-security#SE-302> ;
    schema:identifier "C1" ;
    schema:position 1 ;
    schema:text "The masking bypass, 1 each. (a) The data analyst role sees personal_code masked in analytics_customer_view, but also reads crm_customer, which holds personal_code in clear with the same customer_id: a join on customer_id undoes the mask. The answer finds it. (b) It closes the path: read_crm_customer removed from the analyst role (the analyst's duties do not need it), or crm_customer masked for the role, or customer_id replaced by a token in the view - not just a note."@en .

edu:Question rdfs:label "Question"@en,
        "Küsimus"@et .

<https://knobit.org/id/register/data-security#SE-301> rdfs:label "dsec-access-control C1: the analyst's masked personal code is joinable to the clear customer table"@en .

<https://knobit.org/id/register/data-security#SE-302> rdfs:label "dsec-access-control C1: the join path closed"@en .