The LinkedIn Skill Assessments feature allows you to demonstrate your knowledge of the skills you’ve added on your profile. Job posters on LinkedIn can also add Skill Assessments as part of the job application process. This allows job posters to more efficiently and accurately verify the crucial skills a candidate should have for a role.
The topics in the REST API assessment include:
- API Security
- Consuming APIs
- Designing APIs
- Documenting APIs
- Implementing APIs
- Measuring APIs
Question Format
Multiple Choice
Language
English
Table of Contents
- 1 LinkedIn REST APIs Skill Assessment Answers
- 1.1 What type of relationship is defined as one resource existing only if another parent resource exist-for example, pages in a book?
- 1.2 Which URL pattern is recommended when working with one resource and a collection of resources?
- 1.3 When dealing with JSON web Tokens (JWTs), what is a claim?
- 1.4 Which REST contraint specifies that knowledge and understanding obtained from one component of the API should be generally applicable elsewhere in the API?
- 1.5 What would you enable to allow a browser on another site to make an AJAX request to your API?
- 1.6 APIs commonly use webhooks to _.
- 1.7 What is the underlying goal of all APIs?
- 1.8 Which is a common command-line tool for using or exploring an API?
- 1.9 What is the modern specification for describing an API?
- 1.10 Which HTTP verb is normally used to update or create a resource in an API?
- 1.11 What is one benefit of server-side caching in APIs?
- 1.12 Your API resource does no allow deletion, and a client application attempted to delete the resource. What HTTP respose code should you return?
- 1.13 What is OpenID Connect?
- 1.14 What is one benefit of GraphQl over REST approaches?
- 1.15 Which REST constraint specifies that there should be no shared context?
- 1.16 What purpose does a User-Agent serve?
- 1.17 If you were to add versioning by using the Accept and Content-Type header, what would be the correct format of the header value?
- 1.18 What is one benefit that OAuth provides over an API key approach?
- 1.19 The ability to execute the same API request over and over again without changing the resource’s state is an example of _.
- 1.20 What component can you use to wrap legacy architectures or protocols into a REST interface for easier consumption and integration?
- 1.21 What protection does a JSON Web Token (JWT) offer to mitigate tampering with its contents?
- 1.22 What OAuth term is used to represent permissions?
- 1.23 What additional type of token would you see when using OpenID Connect?
- 1.24 What should you add to a Cache-Control response header to specify that a response should not be stored in an intermediary cache?
- 1.25 Which OAuth grant type can support a refresh token?
- 1.26 Using OAuth, what scope would you request for write access to the API?
- 1.27 Which property would you use to include subresources directly into a JSON document?
- 1.28 What is the best way to track SDK and version usage?
- 1.29 Which REST constraint allows for the presence of caching, routing, and other systems between the client and server?
- 1.30 Which content is best to include in your documentation?
- 1.31 What metric tracks overall availability for your API?
- 1.32 What is the recommended method and URL pattern for retrieving a specific user?
- 1.33 What is the purpose of a link relation?
- 1.34 When building SDKs, which languages should you support?
- 1.35 Which property would you use to include references to other resources in a JSON document?
- 1.36 What is OAuth?
- 1.37 What should your API documentation describe?
- 1.38 What is the purpose of an OAuth refresh token?
- 1.39 What is Time to First Hello World?
- 1.40 Which response header tells the client and intermediaries that the response is not to be cached anywhere?
- 1.41 What component hides the distinctions or boundaries between various microservices from end-client applications?
- 1.42 The textbook approach to api versioning is to use _.
- 1.43 Which is the most secure method to transmit an API key?
- 1.44 Within Oauth, what component validates the user’s identity?
- 1.45 API traffic that is entirely internal to your organization is normally called _?
- 1.46 What is the best approach for requesting JSON instead of XML from an API?
- 1.47 When a user attempts to access a record that is not their own, which HTTP response code is the most appropriate?
- 1.48 Which is a benefit of using an API gateway?
- 1.49 API testing must be treated as _?
- 1.50 Which HTTP verb is used in a CORS preflight request?
- 1.51 Which response header will tell the client that the response is cached for 1 minute ?
- 1.52 What is the concept that allows an API client to explore an API via links embedded in payloads?
- 1.53 Which HTTP response code describes a new resource as created successfully?
- 1.54 Which is an example of Code on Demand?
- 1.55 Which URL pattern should you follow for accessing a subresource attached to a specific resource?
- 1.56 Which REST constraint essentially prohibits the use of cookies?
- 1.57 Which HTTP verb is used to delete a resource?
- 1.58 Which verb is not considered idempotent?
- 1.59 Which REST constraint specifies that each request should stand on its own and not have a specific required order?
- 1.60 When you get a 429 response code, what should you do next?
- 1.61 When exploring record sets, what is the best approach for pagination?
- 1.62 What is not a method for API authentication or authorization?
- 1.63 Which HTTP response code usually means the requested work is still processing and may or may not result in an error later?
- 1.64 When validating a JWT, what are some of the claims that you must confirm? (Select all that apply.)
- 1.65 API traffic that enters and leaves your organization is normally called _?
- 1.66 Which OAuth grant type is appropriate for mobile apps?
- 1.67 Which datetime format is the easiest or most predictable to parse and process?
- 1.68 Which header is not used in cache management?
LinkedIn REST APIs Skill Assessment Answers
What type of relationship is defined as one resource existing only if another parent resource exist-for example, pages in a book?
- Partial
- dependent
- associative
- linked
Which URL pattern is recommended when working with one resource and a collection of resources?
- /companies/{id} and/company
- /company/{id} and/companies
- /companies/{id} and/companies
- /company/{id} and/company
When dealing with JSON web Tokens (JWTs), what is a claim?
- data in the token
- Ownership
- a permission
- and integer
Which REST contraint specifies that knowledge and understanding obtained from one component of the API should be generally applicable elsewhere in the API?
- Uniform Interface
- Client-Server
- Stateless
- Chacheable
What would you enable to allow a browser on another site to make an AJAX request to your API?
- HTTP
- REST
- OPTIONS
- CORS
APIs commonly use webhooks to _.
- notify other systems of an event
- catch error faster
- improve error logging
- log additional data
What is the underlying goal of all APIs?
- to add new technologies to an organization’s infrastructure.
- to share features and functionality with other system.
- to move infrastructure to the cloud.
- to appease the latest digital transformation effort.
Which is a common command-line tool for using or exploring an API?
- bash
- curl
- ssh
- powerShell
What is the modern specification for describing an API?
- OpenAPI (Swagger)
- WADL
- WSDL
- OAuth
Which HTTP verb is normally used to update or create a resource in an API?
- SUBMIT
- WRITE
- POST
- CREATE
What is one benefit of server-side caching in APIs?
- Mobile app work better.
- It improves uptime.
- It offers better security.
- It reduce load on servers.
Your API resource does no allow deletion, and a client application attempted to delete the resource. What HTTP respose code should you return?
- 409 Conflict
- 400 Bad Request
- 406 Not Acceptable
- 405 Method Not Allowed
What is OpenID Connect?
- an identify layer on top of OAuth 2.0
- the new name for SAML 3.0
- a modern replacement for API keys
- an SSO competitor for OAuth 2.0
What is one benefit of GraphQl over REST approaches?
- flexible querying/responses
- more stable APIs
- compatible with more gateways
- more secure by default
- Stateless
- Client-Server
- Uniform Interface
- Cacheable
What purpose does a User-Agent serve?
- It identifies the user ID.
- It identifies the client application or SDK.
- It identifies if the API should expect a user authentication.
- It identifies if the API should accept microservice traffic.
If you were to add versioning by using the Accept and Content-Type header, what would be the correct format of the header value?
- application/json
- application/json_version2
- text/html
- application/vnd.myapp.v2+json
What is one benefit that OAuth provides over an API key approach?
- A token is encrypted.
- A token is encoded.
- A token is scoped to the use case.
- A token can be shared between systems.
The ability to execute the same API request over and over again without changing the resource’s state is an example of _.
- stateless architecture
- idempotency
- a uniform interface
- cacheability
What component can you use to wrap legacy architectures or protocols into a REST interface for easier consumption and integration?
- API proxy
- API gateway
- OpenAPI
- OAuth authorization server
What protection does a JSON Web Token (JWT) offer to mitigate tampering with its contents?
- transport over SSL
- encrypted payload
- a signature
- encoded payload
What OAuth term is used to represent permissions?
- token
- scope
- claim
- back channel
What additional type of token would you see when using OpenID Connect?
- ID token
- refresh token
- access token
- auth code token
What should you add to a Cache-Control response header to specify that a response should not be stored in an intermediary cache?
- no-proxy
- client-only
- restricted
- private
Which OAuth grant type can support a refresh token?
- Authorization Code Grant
- Client Credentials Grant
- Implicit Grant
- Authentication Grant
Using OAuth, what scope would you request for write access to the API?
- It varies from API to API.
- admin
- write
- read-write
Which property would you use to include subresources directly into a JSON document?
- _embedded
- resources
- subresources
- _links
What is the best way to track SDK and version usage?
- tracking downloads
- Accept headers
- user agents
- polling users
Which REST constraint allows for the presence of caching, routing, and other systems between the client and server?
- Layered System
- Stateless
- Client-Server
- Cacheable
Which content is best to include in your documentation?
- your tech stack
- reasoning for your naming schema
- your mission statement
- sample code
What metric tracks overall availability for your API?
- Response Time
- Time to First Hello World
- TTL
- Uptime
What is the recommended method and URL pattern for retrieving a specific user?
- GET /user/{id}
- GET /users/{id}
- GET /user?id={id}
- GET /users?id={id}
What is the purpose of a link relation?
- to describe relationships between resources or actions
- to describe subresources related to the current one
- to link two resources together
- to describe a resource and its purpose
When building SDKs, which languages should you support?
- Java, Javascript, and .NET
- and you can support
- PHP, Python, and Go
- the languages that your target users use
Which property would you use to include references to other resources in a JSON document?
- resources
- _embedded
- subresources
- _links
What is OAuth?
- an authorization framework for granted delegated access
- an approach to single sign-on for APIs
- a method for API authentication
- HTTP Basic Authentication 2.0
What should your API documentation describe?
- JSON
- HTTP
- common use cases
- your tech stack
What is the purpose of an OAuth refresh token?
- to share user profile information
- to update an API configuration
- to keep a web session active
- to retrieve an access token
What is Time to First Hello World?
- how long it takes for a developer to do something with your API
- how long it takes to start a new programming language
- how long it takes to install your SDK
- how long it takes to read your documentation
Which response header tells the client and intermediaries that the response is not to be cached anywhere?
- Cache-State: none
- Expires:-1
- Cache-Control: no-cache
- Cache-Control: no-store
What component hides the distinctions or boundaries between various microservices from end-client applications?
- API gateway
- API logging
- a layered system
- API proxy
The textbook approach to api versioning is to use _.
- common knowledge
- URLs
- no versioning
- the Accept header
Which is the most secure method to transmit an API key?
- URL parameter
- Authorization header
- Base64 encoding
- Basic Auth
Within Oauth, what component validates the user’s identity?
- client
- not specified
- authorization server
- resource server
API traffic that is entirely internal to your organization is normally called _?
- inbound traffic
- north-south traffic
- internal traffic
- east-west traffic
What is the best approach for requesting JSON instead of XML from an API?
- Add .json to the URL.
- APIs do not use XML.
- Use the Content-Type header.
- Use the Accept header.
When a user attempts to access a record that is not their own, which HTTP response code is the most appropriate?
- 403
- 404
- 401
- 405
Which is a benefit of using an API gateway?
- HTTP verbs
- JSON payloads
- HTTP response codes
- rate limiting/throttling
API testing must be treated as _?
- red team testing
- white box testing
- blue box testing
- black box testing
Which HTTP verb is used in a CORS preflight request?
- PUT
- POST
- GET
- OPTIONS
Which response header will tell the client that the response is cached for 1 minute ?
- Expires: 1 minute
- Cache-Control: max-age=60
- Expires: 1 January 2020
- Cache-Expires: max-age=60
What is the concept that allows an API client to explore an API via links embedded in payloads?
- hypermedia
- link relations
- parsing
- browsing
Which HTTP response code describes a new resource as created successfully?
- 200
- 201
- 204
- 202
Which is an example of Code on Demand?
- AWS Lambda
- downloading open-source software
- Serverless
- JavaScript on a webpage
Which URL pattern should you follow for accessing a subresource attached to a specific resource?
- /companies/employees/{companyId}/{employeeId}
- /company/{companyId}/employees/{employeeId}
- /companies/{companyId}/employees/{employeeId}
- /companies/{companyId}/employee/{employeeId}
- Stateless
- Cacheable
- Layered System
- Uniform Interface
Which HTTP verb is used to delete a resource?
- FLUSH
- DELETE
- CLEAR
- DESTROY
Which verb is not considered idempotent?
- DELETE
- GET
- PUT
- POST
Which REST constraint specifies that each request should stand on its own and not have a specific required order?
- Uniform Interface
- Cacheable
- Stateless
- Client-Server
When you get a 429 response code, what should you do next?
- Check you JSON structure.
- Slow down your requests.
- Check the API uptime status.
- Check you API key.
When exploring record sets, what is the best approach for pagination?
- date-based filtering
- next/previous cursors
- page size and filters
- database IDs
- OAuth
- biometrics
- API Keys
- username and password
Which HTTP response code usually means the requested work is still processing and may or may not result in an error later?
- 200 OK
- 204 No Content
- 201 Created
- 202 Accepted
When validating a JWT, what are some of the claims that you must confirm? (Select all that apply.)
A. The exp (expiration) has not passed.
B. The algorithm is sufficient.
C. The signature matches the payload.
D. The token was Base64 encoded.
E. The iss (issuer) is the auth server you expect.
F. There is a refresh token.
G. The cid (client ID) is the client you expect.
H. The token was encrypted.
- A,B,E,H
- B,C,F,G
- A,D,G,H
- A,C,E,G
API traffic that enters and leaves your organization is normally called _?
- east-west traffic
- inbound traffic
- north-south traffic
- external traffic
Which OAuth grant type is appropriate for mobile apps?
- Authorization Code with PKCE
- Client Credentials
- Device
- Resource Owner Password
Which datetime format is the easiest or most predictable to parse and process?
- YY-M-D hh:mm:ss+TZ
- YY-M-D h:mm:ss
- YYYY-MM-DDThh:mm:ssZ
- YYYY-M-D hh:mm:ss
Which header is not used in cache management?
- Rate-Limit
- Expires
- Etag
- Cache-Control