1Z0-829 Practice Test 28 — 15 Questions

Question 1

A developer compiles a Java 17 application into a modular JAR with the module descriptor `module com.acme.inventory { exports com.acme.inventory.api; }`. The JAR also contains the package `com.acme.inventory.internal` with public classes. Another module `com.acme.reporting` declares `requires com.acme.inventory;` and attempts to import `com.acme.inventory.internal.StockLedger`. What is the result?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compilation fails because `com.acme.inventory.internal` is not exported by `com.acme.inventory`.. A named module grants access to its public types only from packages it explicitly exports. Here `com.acme.inventory` exports just the `api` package, so another module cannot compile against types in `internal`. The `requires` directive establishes readability but does not bypass the export gate. The compiler therefore rejects the import, and no runtime behavior is reached.

Answer

Compilation succeeds, but at runtime an `IllegalAccessError` is thrown when `StockLedger` is first used.

Answer

Compilation succeeds because public classes in non-exported packages are still accessible to modules that `requires` the providing module.

Answer

Compilation succeeds only if `com.acme.reporting` adds `requires transitive com.acme.inventory` instead of `requires com.acme.inventory`.

Question 2

A developer writes the following code in a Java 17 application: List list = new ArrayList<>(List.of("a", "b")); List copy = List.copyOf(list); list.add("c"); System.out.println(copy.size()); What is printed?

Accepted Answer

2. List.copyOf produces an unmodifiable copy of the source collection's current elements. Mutating the original ArrayList afterward does not alter the copy, so the copy retains the two strings it was given. The call to add on the original list succeeds because the original remains mutable, and the size printed for the copy stays at two.

Answer

An UnsupportedOperationException is thrown at runtime.

Answer

3

Answer

A NullPointerException is thrown at runtime.

Question 3

A developer writes a method that declares `throws SQLException` and contains a try-with-resources block. Inside the try, a `Connection` is opened and a query is executed. The method must guarantee that the `Connection` is closed even if the query throws an exception. Which statement best describes the behavior of the following code?

```java
public void query() throws SQLException {
    try (Connection conn = DriverManager.getConnection(url)) {
        executeQuery(conn);
    }
}
```

Accepted Answer

The connection is closed automatically when the try block exits, whether normally or due to an exception, and any exception from `close()` is suppressed if the try block throws.. Try-with-resources ensures deterministic cleanup by invoking `close()` on any resource declared in the resource specification, regardless of whether the try block completes normally or throws. If the try block throws and `close()` also throws, the close exception is suppressed and attached to the primary exception, which can be retrieved via `getSuppressed()`. This makes resource management robust and concise.

Answer

The connection is not closed because `Connection` does not implement `AutoCloseable`; the developer must manually close it in a finally block.

Answer

The connection is closed only if `executeQuery` throws an exception; if it completes normally, the connection stays open until garbage collection.

Answer

The connection is closed only if `executeQuery` completes normally; if it throws, the connection remains open.

Question 4

A developer is packaging a Java 17 application as a modular JAR and wants to allow reflective access to specific packages only for a particular module at runtime, while keeping other packages encapsulated. Which two approaches achieve this? (Choose two.)

Accepted Answer

At launch, use `--add-opens com.example.app/com.example.internal=com.example.framework`.. Reflective access to a package for a specific module can be granted either by the `opens ... to ...` directive in the module descriptor or by the `--add-opens` launcher option. Both restrict openness to the named module. Qualified exports and `--add-exports` provide access to public types but not deep reflection, while unqualified `opens` opens the package to all modules, which is broader than desired.

Answer

Use `opens com.example.internal;` in the module descriptor.

Answer

Use `exports com.example.internal to com.example.framework;` in the module descriptor.

Answer

At launch, use `--add-exports com.example.app/com.example.internal=com.example.framework`.

Question 5

A developer defines a record `Point(int x, int y)` and then writes a second record `ColoredPoint(int x, int y, String color)` that should reuse the `Point` components. The team wants to avoid manually redeclaring the x and y fields. Which approach is valid in Java 17?

Accepted Answer

Declare `record ColoredPoint(Point p, String color)` and access coordinates via p.x() and p.y().. Records are implicitly final and cannot extend other classes or records, so inheritance is not available for reusing components. The supported approach is composition: embed a Point instance inside ColoredPoint and delegate access through its accessor methods. This preserves the compact constructor and equals/hashCode behavior of Point while avoiding duplicated state, and it compiles and behaves correctly in Java 17.

Answer

Declare `record ColoredPoint(int x, int y, String color)` and rely on the compiler to share the x and y fields with Point.

Answer

Declare `record ColoredPoint(int x, int y, String color)` and annotate it with @Inherited to pull in Point's components.

Answer

Declare `record ColoredPoint(int x, int y, String color) extends Point`.

Question 6

A developer is implementing a class `Temperature` that wraps a `double` value. The class must be immutable. The developer writes the following code: `public final class Temperature { private final double value; public Temperature(double value) { this.value = value; } public double getValue() { return value; } }`. Which statement about this implementation is correct?

Accepted Answer

The class is immutable because all fields are final and the class is final.. The class is immutable because it is final, its field is private and final, and it provides no mutator methods. The primitive field cannot be modified after construction. Defensive copying is not needed for primitives, and the final keyword on methods is redundant due to the final class. Thus, the implementation correctly achieves immutability.

Answer

The class is not immutable because the `value` field is not private.

Answer

The class is not immutable because the constructor does not perform a defensive copy of the `value` parameter.

Answer

The class is immutable, but only if the `getValue()` method is also declared `final`.

Question 7

A developer uses a TreeMap<String, Integer> to store configuration settings. The map is created with a custom Comparator that sorts keys by length, then alphabetically. What is the behavior when two keys have the same length but different characters?

Accepted Answer

The map treats them as distinct keys and stores both entries.. TreeMap uses the supplied Comparator to determine key ordering and equality. If the Comparator returns a non-zero value, the keys are considered distinct regardless of equals. Since the custom Comparator sorts by length then alphabetically, keys of equal length but different characters are distinct, so both entries are stored. This is the correct behavior.

Answer

The map throws a ClassCastException when the second key is inserted.

Answer

The map replaces the first entry because the keys are considered equal by the Comparator.

Answer

The map throws an IllegalArgumentException because the Comparator is inconsistent with equals.

Question 8

A developer needs to count how many elements in a Stream<Integer> named nums are greater than 10 and also compute the sum of those same elements. The developer writes:

long count = nums.filter(n -> n > 10).count();
int sum = nums.filter(n -> n > 10).mapToInt(Integer::intValue).sum();

What happens when this code runs?

Accepted Answer

It throws IllegalStateException when the second pipeline attempts to consume the already-consumed stream.. The count call consumes the stream referenced by nums, so the subsequent pipeline that calls sum on the same reference throws IllegalStateException. To compute both values, the developer should obtain a fresh stream for each terminal operation, for example by calling the source collection's stream method twice or by using a Supplier>.

Answer

It runs successfully and prints the correct count and sum because each pipeline creates its own independent traversal.

Answer

It fails to compile because count returns long while sum returns int and the two cannot appear in the same method.

Answer

It compiles but the second pipeline always returns zero because the stream is exhausted.

Question 9

A developer is using a Deque to implement a stack. The developer writes the following code: Deque stack = new ArrayDeque<>(); stack.push("A"); stack.push("B"); stack.push("C"); System.out.println(stack.pop()); System.out.println(stack.peek()); What is printed?

Accepted Answer

C then B. Deque.push inserts at the head, and Deque.pop removes from the head, so the last element pushed ("C") is the first popped. After popping "C", the head becomes "B", which peek returns without removal. Therefore, the output is "C" followed by "B". This is standard stack LIFO behavior using a Deque.

Answer

C then A

Answer

B then C

Answer

A then B

Question 10

A Java SE 17 application uses a custom ObjectInputStream subclass to filter deserialized classes. The developer overrides resolveClass to allow only classes that implement a marker interface SafeSerializable. During testing, a serialized object of class SafeClass (which implements SafeSerializable) is deserialized successfully. However, an attacker sends a serialized object of class EvilClass that also implements SafeSerializable but has a readObject method that executes malicious code. The developer wants to prevent deserialization of EvilClass without blocking all SafeSerializable classes. Which approach is most effective?

Accepted Answer

Add a check in resolveClass to compare the class name against a whitelist of allowed class names.. The most effective approach is to use a whitelist of allowed class names in resolveClass. This ensures that only explicitly trusted classes are deserialized, regardless of the interfaces they implement. Interface-based filtering is insufficient because an attacker can implement the marker interface in a malicious class. Blacklisting is also weak because it can be bypassed by renaming or using different classes. Validating after deserialization is too late because malicious code may already execute.

Answer

Set the system property jdk.serialFilter to '!com.example.EvilClass' to blacklist the malicious class.

Answer

Use a serial filter that rejects any class that does not implement SafeSerializable.

Answer

Override readObject in the custom ObjectInputStream to validate the object after deserialization.

Question 11

A developer creates a custom runtime image with `jlink` for a Java 17 application. The application uses the `java.sql` module, which is not part of the `java.base` module. The command used is `jlink --module-path $JAVA_HOME/jmods --add-modules com.example.app --output myimage`. The application fails at runtime with `NoClassDefFoundError: java/sql/DriverManager`. What is the most likely cause?

Accepted Answer

The application module does not declare `requires java.sql`, so the module was not resolved and thus not linked into the image.. `jlink` builds a runtime image from the transitive closure of the specified root modules. If the application module uses `java.sql` but does not declare `requires java.sql`, the module is not part of the resolved graph, so it is excluded from the image. At runtime, loading `DriverManager` fails. Adding the `requires` directive or explicitly adding `java.sql` with `--add-modules` resolves the issue.

Answer

The `jlink` command must include `--bind-services` to include `java.sql` because it provides a service provider.

Answer

The `java.sql` module is not available in the `jmods` directory of a JDK 17 installation and must be added from a separate download.

Answer

The `java.sql` module was not included because `jlink` does not automatically resolve transitive dependencies of the application module.

Question 12

A developer has a Stream<String> of city names and writes the following pipeline:

long count = cities.filter(c -> c.length() > 5).count();

Which statement best describes the nature of the count() operation in this pipeline?

Accepted Answer

count() is a terminal operation that triggers processing of the stream.. count() is a terminal operation that returns the number of elements in the stream as a long. It forces evaluation of the lazy filter intermediate operation and consumes the stream. Because the stream is consumed, it cannot be reused; a new stream must be created from the source to perform additional processing.

Answer

count() can be called multiple times on the same stream without error.

Answer

count() is a lazy operation that does not process elements until another operation follows.

Answer

count() is an intermediate operation that returns a new Stream.

Question 13

A developer is writing a method that must return a List containing only the elements of an input List that start with the letter "A", without modifying the original list. The developer writes: List result = input.stream() .filter(s -> s.startsWith("A")) .collect(Collectors.toList()); input.clear(); return result; What is the result of calling this method?

Accepted Answer

The method returns a new list containing the filtered elements, and the original list is emptied.. The stream pipeline filters the input and collects matching elements into a new list before the original list is cleared. Because the collected list is independent, clearing the source does not empty the result. The method returns the filtered list, and the original list is emptied. No exception occurs because Collectors.toList() yields a mutable list and the source supports clear().

Answer

The method returns a list that is backed by the original list and becomes empty after clear() is called.

Answer

The method throws UnsupportedOperationException because Collectors.toList() returns an unmodifiable list.

Answer

The method returns an empty list because the stream is lazy and clear() is called before terminal operation.

Question 14

A telemetry service receives sensor readings and must stop consuming as soon as a reading exceeds a threshold, while also skipping readings flagged as invalid. The developer writes:

```java
int[] readings = {5, 30, 12, -1, 60, 8};
int total = 0; int processed = 0;
for (int r : readings) {
    if (r < 0) continue;
    if (r > 50) break;
    total += r;
    processed++;
}
System.out.println(total + ":" + processed);
```
What is printed?

Accepted Answer

47:3. In an enhanced for loop, continue abandons the current element and moves to the next, while break exits the entire loop. The negative reading is discarded, the values 5, 30, and 12 accumulate to 47 and increment the counter three times, and the reading of 60 halts iteration before it can be added or counted.

Answer

107:4

Answer

42:3

Answer

47:4

Question 15

A security review of a Java SE 17 application that uses Java serialization identifies risks. The team must implement measures that directly mitigate deserialization vulnerabilities. Which two actions are appropriate? (Choose two.)

Accepted Answer

Set a serialization filter using ObjectInputFilter.Config.setSerializationFilter with a whitelist of allowed classes.. The two effective mitigations are setting a global serialization filter with an allowlist and overriding resolveClass in a custom ObjectInputStream to reject disallowed classes. Both prevent untrusted classes from being instantiated during deserialization. Encryption does not stop gadget chains, manual readObject validation is unreliable, and serialVersionUID has no security role. Together, filters and resolveClass checks form a strong defense-in-depth against deserialization attacks.

Answer

Encrypt the serialized bytes with AES/GCM before writing to the stream.

Answer

Mark all classes as Serializable and rely on serialVersionUID checks.

Answer

Override readObject to call ObjectInputFilter.Config.getSerializationFilter and validate the class before reading fields.