Is this exercise free to use?

Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.

How many questions are in this exercise?

This set contains 22 multiple-choice questions, each with a detailed explanation shown after you answer.

Do I need to create an account to track my progress?

No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.

Who is this Software Licensing exercise for?

This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss software licensing topics confidently at work.

What happens if I answer a question incorrectly?

You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.

Can I retry this exercise?

Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.

How long does this exercise take to complete?

Most learners finish all 22 questions in under 10 minutes, since each question is answered by clicking a single option.

Where can I find more Software Licensing exercises?

See the full Software Licensing exercises hub for more vocabulary drills on this topic.

Is this exercise mobile-friendly?

Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.

SPDX Identifiers | Coders Lingo

1 / 22

What is an SPDX identifier and where would you use it?

2 / 22

A source file contains the header: SPDX-License-Identifier: Apache-2.0. What does this mean?

3 / 22

Which SPDX expression correctly represents code that can be used under either the MIT License or the Apache-2.0 License (user's choice)?

4 / 22

What is the purpose of the REUSE specification in relation to SPDX identifiers?

5 / 22

A package.json contains "license": "GPL-3.0-only". How does this differ from "GPL-3.0-or-later"?

6 / 22

Liam from the security team just commented on your pull request: 'I'm seeing a lot of SPDX-License-Identifier: MIT tags. While MIT is fine, are you sure we're consistently applying it across all our dependencies? We need to ensure proper attribution.' What should you do?

7 / 22

You are working on a new microservice and need to document its dependencies. You've analyzed them using an automated tool that generates a JSON response. The response includes the following snippet: ```json { "dependencies": [ {"name": "lodash", "version": "4.17.21", "license": "MIT", "spdx_identifier": "License-Distinction: MIT"} ] } ``` What does the `spdx_identifier` field in this response indicate?

8 / 22

During a standup meeting, Sarah asks: 'How are we handling SPDX identifiers in the new API contract?'. Which of the following is the MOST appropriate response?

9 / 22

You're working on a project that uses several open-source libraries. You've identified the SPDX expressions for each dependency and are preparing a report. What is the primary benefit of using REUSE specifications alongside SPDX identifiers?

10 / 22

Reviewer Comment: 'I noticed a few projects using SPDX-License-Identifier: BSD-3-Clause. While BSD is permissive, are we documenting the specific variations and ensuring consistency across the codebase? It's crucial for legal compliance and transparency.' Which of the following best explains the reviewer's concern?

11 / 22

Slack Message from Alex: 'Hey team, just ran some automated checks on our dependencies. I'm seeing a lot of projects using SPDX-License-Identifier: MIT. Is this the standard we should be aiming for? Should we be documenting *why* we chose MIT licenses in our dependency declarations?' What is Alex's primary question?

12 / 22

Reviewer Comment: 'I'm seeing a mixed bag of SPDX identifiers here – some are `MIT`, others are `Apache-2.0`. While both are permissive, it's important to maintain consistency for our legal team. Can you clarify which identifier you intended to use in this particular file and ensure future files follow the same standard?'

Which of the following actions should you take FIRST?

13 / 22

Slack Message from David: 'Hey team, I've been looking at the SPDX identifiers used in our dependencies and noticed a lot of `LGPL-2.0` licenses. Are we aware of the implications of using LGPL? It's a copyleft license with more restrictions than MIT or Apache.'

Which of the following best describes David's concern?

14 / 22

Reviewer Comment: 'I'm seeing a lot of SPDX-License-Identifier: MIT tags across our projects. While MIT is generally considered permissive, it's important to understand that different variations exist within the MIT license. Could you provide details on which specific MIT variant we are using and ensure consistent application throughout our codebase for improved traceability?', What does this comment primarily highlight?

15 / 22

PR Description: 'Updating this component's dependencies. We've updated the package.json and added SPDX identifiers for all new and existing dependencies. Specifically, we've standardized on `Apache-2.0` across the board to simplify licensing management. Please review and approve.' Considering the provided information, what is a key reason for standardizing on `Apache-2.0`?

16 / 22

Standup Update from Emily: 'I've been working on mapping out our dependencies and their associated SPDX identifiers. I'm using a tool to automatically generate this information, which is great for consistency. However, the output includes some ambiguous expressions – like `BSD-Clause` – and I need guidance on how to handle these.' What does Emily primarily require assistance with?

17 / 22

API Response Snippet: { "dependency": "lodash", "license": "MIT", "spdx_identifier": "BSD-3-Clause" } What information does this API response primarily convey?

18 / 22

During a code review, Mark highlights the following comment on your PR: 'I noticed several dependencies using `SPDX-License-Identifier: MIT`. While MIT is common, are you documenting *why* you chose this identifier for each dependency – particularly considering some have more restrictive licenses? This helps ensure clarity and avoids potential legal issues later.', Which of the following best addresses Mark's concern?

A. Simply change all `MIT` identifiers to `Apache-2.0` for consistency. B. Confirm that each dependency's license actually *is* MIT, as indicated in its documentation. C. Document the rationale behind choosing `MIT` for each dependency, acknowledging the permissive nature of the license and any potential conflicts with other licenses. D. Ignore the comment; Mark is overthinking the SPDX identifiers.

19 / 22

Sarah in the legal team sends you a Slack message: 'I'm seeing a lot of inconsistent use of SPDX identifiers across our projects. Specifically, some are using `SPDX-License-Identifier: BSD-3-Clause`, while others are using `BSD-2-Clause`. Can you explain the subtle differences between these and ensure we're using them consistently to minimize ambiguity?' What is Sarah primarily asking for?

A. A complete audit of all our projects' dependencies. b. Confirmation that all dependencies use only permissive licenses. C. An explanation of the nuances in the BSD license family and guidance on selecting the appropriate identifier based on the specific license terms. D. A standardized set of SPDX identifiers to be used across all projects, regardless of license details.

20 / 22

You're reviewing a PR that includes the following snippet: ```json { "dependency": "lodash", "license": "MIT", "spdx_identifier": "BSD-3-Clause" } ``` Which of the following statements BEST describes what this JSON response is intended to convey?

A. The dependency's license is exclusively MIT, despite the `BSD-3-Clause` identifier. B. The dependency's license is a combination of both MIT and BSD-3-Clause licenses. C. The tool has incorrectly identified the license; `lodash` actually uses the MIT license. D. The response provides a single, authoritative SPDX identifier for the dependency, regardless of the actual license details.

21 / 22

During a standup meeting, David asks: 'We're adding SPDX identifiers to our new microservice. What's the best way to ensure we don't accidentally misrepresent the licenses of our dependencies?' Which of the following is the MOST crucial step?

A. Simply assigning the most common SPDX identifier (e.g., `MIT`) to each dependency. B. Manually reviewing the license documentation for *every* dependency before assigning an identifier. C. Using a consistent naming convention for all identifiers, regardless of the actual license terms. D. Relying solely on automated tools to generate SPDX identifiers automatically.

22 / 22

You're preparing a report on your project's open-source dependencies and are considering using REUSE specifications. What is the primary advantage of incorporating REUSE specifications into your SPDX reporting?

A. REUSE specifications automatically generate accurate license compliance reports. B. REUSE specifications provide a standardized way to represent multiple licenses that apply to a single dependency, simplifying tracking and analysis. C. REUSE specifications are solely for legal teams to ensure complete license coverage. D. REUSE specifications replace the need to manually identify and document all dependencies.

Frequently Asked Questions