Operations, fragments, variables, persisted queries, and query depth — how clients interact with GraphQL efficiently.
Key vocabulary
Operation — a named query, mutation, or subscription in GraphQL.
Fragment — a reusable selection set that can be included in multiple operations.
Variables — dynamic values passed into an operation, separated from the query string.
Persisted queries — pre-registered queries identified by a hash, sent by ID instead of full text.
Query depth limiting — rejecting queries that nest too many levels deep.
0 / 15 completed
1 / 15
A fragment in GraphQL is used to:
Fragment = a reusable selection set. Example: fragment UserFields on User { id name email } can be included with ...UserFields. Benefits: DRY, consistent data shapes, works well with component-based UIs.
2 / 15
Variables in GraphQL operations:
Variables = parameterised queries. Instead of embedding values in the query string, declare a variable and pass it separately. Benefits: (1) prevents injection attacks, (2) enables parsing and caching to be separated from value substitution.
3 / 15
Persisted queries improve performance by:
Persisted queries: the client registers queries at build time; at runtime sends only the hash. Benefits: smaller payloads, security (only pre-approved queries execute), and automatic allow-listing in production.
4 / 15
Query complexity analysis assigns costs to fields to:
Query complexity analysis: scalars are cheap, lists are expensive, nested types add up. If the total exceeds the configured maximum, the query is rejected. Prevents malicious or naive clients from sending resource-exhausting queries.
5 / 15
Query depth limiting prevents:
Query depth limiting rejects queries exceeding a maximum nesting depth. Without a depth limit, deeply nested queries trigger exponential resolver calls — effectively a DoS attack on the GraphQL server.
6 / 15
Sarah from the backend team commented on your PR: 'This query is returning a lot of data. Consider using fragments to only fetch the fields you actually need.' What does 'fragments' refer to in this context?
Fragments in GraphQL are specifically designed to address performance concerns like network bandwidth and complexity. They allow you to define reusable parts of a response, preventing the server from returning unnecessary data. Option A is incorrect as it describes database optimization; option C refers to indexing, and option D is error handling.
7 / 15
Mark sent you this Slack message: 'I'm using a variable in my GraphQL query to dynamically filter product listings based on user preferences. It's working great, but I'm worried about potential security issues if users can inject malicious values into the variable.' What is primarily Mark concerned about?
Mark's concern centers on security – specifically, the possibility of SQL injection (or similar vulnerabilities) if user-provided values are directly incorporated into a GraphQL query without proper sanitization. While options A, C and D are valid concerns related to GraphQL development, they aren't the immediate focus of Mark's message.
8 / 15
You're reviewing an API response from a GraphQL server for a user profile. The response includes several fields like name, email, and address. The client application only needs the user's name and email address. What is the best approach to optimize this request?
Fragments allow you to define a specific subset of fields to be returned from the GraphQL server. This dramatically reduces the amount of data transferred compared to fetching all possible profile fields (as in option B), which can lead to performance issues and unnecessary network traffic. Options A and D are related to other optimization techniques, but fragments directly address the data retrieval aspect.
9 / 15
David, a senior developer, asked you to analyze query performance. He provided this GraphQL query:
query GetUserProfile {
user(id: '123') {...
address {
street
city
zipCode
}
orders {
orderId
totalAmount
}
}
}
What is the primary purpose of 'query complexity analysis' in this scenario?
Query complexity analysis is about understanding the cost associated with different parts of a query – specifically, assigning costs to each field based on its retrieval time and how it impacts overall performance. This allows you to identify which fields are contributing most significantly to latency or resource consumption.
10 / 15
You're designing a GraphQL API for an e-commerce platform. A critical requirement is preventing users from requesting data beyond their authorized scope (e.g., accessing other customers' order history). What does query depth limiting primarily achieve?
Query depth limiting focuses on controlling the *size* of data returned – preventing clients from requesting nested fields or traversing deeply into relationships that they shouldn't have access to. This is crucial for security and resource management, while caching (option D) addresses a different performance concern.
11 / 15
Sarah from the backend team commented on your PR: 'This query is returning a lot of data. Consider using fragments to only fetch the fields you actually need.' What does 'fragments' refer to in this context?
Fragments in GraphQL are specifically designed to address performance concerns like network bandwidth and complexity. They allow you to define reusable parts of a response, preventing the server from returning unnecessary data. Option A is incorrect as it describes database optimization; option C refers to indexing, and option D is error handling.
12 / 15
Mark sent you this Slack message: 'I'm using a variable in my GraphQL query to dynamically filter product listings based on user preferences. It's working great, but I'm worried about potential security issues if users can inject malicious values into the variable.' What is primarily Mark concerned about?
Mark's concern centers on security – specifically, the possibility of SQL injection (or similar vulnerabilities) if user-provided values are directly incorporated into a GraphQL query without proper sanitization. While options A, C and D are valid concerns related to GraphQL development, they aren't the immediate focus of Mark's message.
13 / 15
You're reviewing an API response from a GraphQL server for a user profile. The response includes several fields like name, email, and address. The client application only needs the user's name and email address. What is the best approach to optimize this request?
Fragments allow you to define a specific subset of fields to be returned from the GraphQL server. This dramatically reduces the amount of data transferred compared to fetching all possible profile fields (as in option B), which can lead to performance issues and unnecessary network traffic. Options A and D are related to other optimization techniques, but fragments directly address the data retrieval aspect.
14 / 15
David, a senior developer, asked you to analyze query performance. He provided this GraphQL query:
query GetUserProfile {
user(id: '123') {...
address {
street
city
zipCode
}
orders {
orderId
totalAmount
}
}
}
What is the primary purpose of 'query complexity analysis' in this scenario?
Query complexity analysis is about understanding the cost associated with different parts of a query – specifically, assigning costs to each field based on its retrieval time and how it impacts overall performance. This allows you to identify which fields are contributing most significantly to latency or resource consumption.
15 / 15
You're designing a GraphQL API for an e-commerce platform. A critical requirement is preventing users from requesting data beyond their authorized scope (e.g., accessing other customers' order history). What does query depth limiting primarily achieve?
Query depth limiting focuses on controlling the *size* of data returned – preventing clients from requesting nested fields or traversing deeply into relationships that they shouldn't have access to. This is crucial for security and resource management, while caching (option D) addresses a different performance concern.
What will I practise in "GraphQL Client Vocabulary | Coders Lingo"?
Learn the vocabulary of GraphQL clients: operations, fragments, variables, persisted queries, and query optimisation.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more GraphQL & API Gateway Language exercises?
Browse the full GraphQL & API Gateway Language hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.