1Z0-829 Practice Test 11 — 15 Questions

Question 1

A Java application uses a custom resource class implementing AutoCloseable. The close() method throws a checked exception. In a try-with-resources block, if both the try block and the close() method throw exceptions, which exception is propagated to the caller? Assume the resource is declared in try-with-resources.

Accepted Answer

The exception from the try block is the primary exception, and the close() exception is added as a suppressed exception.. In a try-with-resources block, when both the try block and the close() method throw exceptions, the exception from the try block is the primary exception propagated to the caller. The exception thrown by close() is added to the primary exception's suppressed exception list, as defined by the Java Language Specification (JLS §14.20.3.2). This ensures that the most relevant exception (the one from the application logic) is not masked by a resource-closing failure.

Answer

The exception from close() is always the primary exception.

Answer

Both exceptions are thrown simultaneously as a multi-catch exception.

Answer

The exception from the try block is always suppressed.

Question 2

Which TWO are valid multi-catch statements in Java 17? (Choose two.)

Accepted Answer

catch (SQLException | IOException e). Option A is correct because Java 17 allows a multi-catch clause to handle multiple exception types in a single catch block, provided the exception types are unrelated in the class hierarchy. SQLException and IOException are both checked exceptions that do not inherit from each other, so they can be caught together in a multi-catch statement.

Answer

catch (Exception | RuntimeException e)

Answer

catch (SQLException | Exception e)

Answer

catch (IOException | FileNotFoundException e)

Question 3

A developer needs to read all lines from a text file named "data.txt" that uses UTF-8 encoding. Which code correctly reads the file using the NIO.2 API?

Accepted Answer

Files.readAllLines(Path.of("data.txt"), StandardCharsets.UTF_8). Option D is correct because `Files.readAllLines()` reads all lines from a file into a `List<String>`, and it accepts a `Path` and a `Charset` (here `StandardCharsets.UTF_8`) to handle encoding. This method is part of the NIO.2 API and directly fulfills the requirement to read all lines from a UTF-8 encoded file.

Answer

Files.lines(Path.of("data.txt"), StandardCharsets.UTF_8).collect(Collectors.toList())

Answer

Files.readString(Path.of("data.txt"), StandardCharsets.UTF_8)

Answer

Files.readAllBytes(Path.of("data.txt")).toString()

Question 4

Which three actions help secure a Java application that uses serialization? (Select three.)

Accepted Answer

Overriding resolveClass() in ObjectInputStream to validate class names.. Option A is correct because overriding `resolveClass()` in `ObjectInputStream` allows you to validate the class name before it is deserialized. This prevents deserialization attacks where an attacker sends a malicious class that could execute arbitrary code. By checking the class name against a whitelist, you can block untrusted classes from being loaded.

Answer

Using SecureRandom to generate serialVersionUID.

Answer

Declaring serialVersionUID explicitly as a long constant.

Question 5

Which resource declaration order in try-with-resources is valid when both a FileInputStream and a BufferedInputStream wrapping it need to be closed automatically?

Accepted Answer

try (FileInputStream fis = new FileInputStream("a"); BufferedInputStream bis = new BufferedInputStream(fis)) { ... }. Option A is correct: Both resources are declared in the try header, with fis declared before bis. Option B has a forward reference error. Option C does not include bis in the try header, so it won't be automatically closed. Option D only declares one resource, not both.

Answer

try (FileInputStream fis = new FileInputStream("a")) { BufferedInputStream bis = new BufferedInputStream(fis); ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(fis); FileInputStream fis = new FileInputStream("a")) { ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(new FileInputStream("a"))) { ... }

Question 6

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The class definition has changed and the serialVersionUID is not explicitly defined.. Option D is correct because when a class definition changes (e.g., adding/removing fields) and the class does not explicitly declare a `serialVersionUID`, the JVM computes one automatically based on the class structure. After deserialization, if the computed UID differs from the UID stored in the serialized stream, an `InvalidClassException` is thrown. This is the most common cause of deserialization failures in practice.

Answer

The serialized object is corrupted.

Answer

The JVM versions are incompatible.

Answer

The file contains data that is not a serialized object.

Question 7

Which TWO statements are true regarding reading files with the NIO.2 API?

Accepted Answer

Files.newBufferedReader() provides buffered character input.. Option B is correct because `Files.newBufferedReader()` returns a `BufferedReader` that wraps a `FileReader` (or underlying `FileChannel`), providing efficient buffered character input. This method is designed for reading text files line-by-line with reduced I/O operations, making it suitable for large or stream-oriented text processing.

Answer

Files.readAllLines() is memory efficient for large files.

Answer

Files.newInputStream() wraps a FileChannel for high performance.

Answer

Files.readAllBytes() is the best choice for large binary files.

Question 8

Which THREE are recommended practices to prevent privilege escalation when using doPrivileged in a security-sensitive Java application?

Accepted Answer

Restrict the codebase URLs in policy files to only trusted code locations.. Option A is correct because restricting codebase URLs in policy files to only trusted code locations limits the sources from which privileged code can be loaded. This prevents an attacker from injecting malicious code from an untrusted URL that could otherwise be granted elevated permissions via doPrivileged. By narrowing the codebase, you reduce the attack surface for privilege escalation attacks.

Answer

Use SubjectDomainCombiner to merge multiple protection domains.

Answer

Always use a SecurityManager to enforce the policy.

Question 9

A financial application deserializes objects received over the network using ObjectInputStream. To prevent deserialization attacks, which secure coding practice should be implemented?

Accepted Answer

Use an ObjectInputFilter to whitelist allowed classes.. Option A is correct because ObjectInputFilter (introduced in Java 9) allows you to define a filter that whitelists only trusted classes during deserialization. By rejecting untrusted classes before they are deserialized, you prevent deserialization attacks such as remote code execution via gadget chains. This is the recommended secure coding practice per Oracle's secure coding guidelines for the Java I/O API.

Answer

Override readObject() in each serializable class to validate data.

Answer

Declare all fields as transient to prevent unwanted data exposure.

Answer

Encrypt the serialized data with AES before transmission.

Question 10

Refer to the exhibit. Which of the following best describes the effective permissions granted to the application?

Accepted Answer

The application can read and write files under /data/ and connect to any socket.. The exhibit shows a Java security policy granting the application `java.net.SocketPermission` with `connect,resolve` actions and `java.io.FilePermission` with `read,write` actions on `/data/-`. This means the application can connect to any socket (since the target name is `*`) and read/write any file under `/data/`. Option B correctly captures both permissions.

Answer

The application can connect to any network socket.

Answer

The application can only read files under /data/ and connect to sockets.

Answer

The application can read and write any file under /data/.

Question 11

Which TWO approaches are recommended to secure Java I/O operations? (Choose two.)

Accepted Answer

Use try-with-resources to ensure proper resource closure.. Option A is correct because try-with-resources automatically closes each resource declared in its header when the block exits, whether normally or via exception. This eliminates the risk of resource leaks from forgotten or improperly handled close() calls, which is a fundamental security and reliability requirement for I/O operations.

Answer

Use BufferedInputStream to wrap FileInputStream for better performance.

Answer

Use Serializable interface for all data objects.

Answer

Use FileLock to prevent concurrent write access.

Question 12

A Java application needs to refer to a file using the path "data/input.txt". To ensure platform independence (correct file separator), which approach is recommended?

Accepted Answer

Paths.get("data", "input.txt"). Option B (Paths.get) accepts a varargs of strings and joins them using the platform file separator. Option A uses File's path which uses the default separator but File is older API. Option C is equivalent but more verbose. Option D is unnecessary. Paths.get is the most idiomatic modern NIO.2 approach.

Answer

FileSystems.getDefault().getPath("data", "input.txt")

Answer

new File("data/input.txt").toPath().normalize()

Answer

new File("data/input.txt").toPath()

Question 13

A company needs to read a large text file (over 2 GB) line by line in a Java application while minimizing memory footprint. Which approach is most efficient?

Accepted Answer

Use Files.lines(path) with try-with-resources. Option D is correct because `Files.lines(path)` returns a `Stream<String>` that lazily reads lines from the file, processing them one at a time without loading the entire file into memory. Combined with try-with-resources, the underlying `BufferedReader` is automatically closed, ensuring efficient resource management even for files over 2 GB.

Answer

Use Files.readAllLines(path)

Answer

Use FileOutputStream with read() loop

Answer

Use Scanner with File and loop hasNextLine()

Question 14

A class implements Serializable. Which modification ensures that a specific field (password) is not included in the serialized stream?

Accepted Answer

Declare the field as transient. Option C is correct because the transient keyword prevents serialization of that field. Option A is wrong because final does not affect serialization. Option B is wrong because static fields are not serialized anyway, but that changes the field's nature. Option D is wrong because volatile affects concurrency, not serialization.

Answer

Declare the field as volatile

Answer

Declare the field as static

Answer

Declare the field as final

Question 15

Which TWO secure coding practices should be followed when developing a Java application that handles user input? (Choose two.)

Accepted Answer

Use PreparedStatement for database queries with user input.. Option A is correct because using PreparedStatement with parameterized queries prevents SQL injection by separating SQL logic from user input. The database driver automatically escapes special characters in the input, ensuring that user-supplied data is treated as literal values, not executable SQL code.

Answer

Serialize sensitive data without encryption for performance.

Answer

Grant java.security.AllPermission to the application's codebase.

Answer

Use java.util.Random for generating session tokens.