1Z0-829 Practice Test 36 — 15 Questions

Question 1

A web application allows users to upload profile pictures. The application saves the files to a directory using the original filename provided by the user. After a security review, the team discovered a critical path traversal vulnerability. Which remediation is most effective in preventing exploitation while maintaining usability?

Accepted Answer

Generate a random UUID as the filename and store the original filename in a database.. Option D is correct because generating a random UUID as the filename eliminates the user's control over the file path, making path traversal attacks impossible. The original filename can be stored in a database for display purposes, preserving usability while ensuring the file is saved with a safe, unpredictable name.

Answer

Store the files in a database BLOB instead of the filesystem.

Answer

Sanitize the filename by removing all occurrences of "../" and "/".

Answer

Check that the file extension is allowed (e.g., .jpg, .png) and no special characters.

Question 2

A logging framework in Java has been writing logs to a file using a FileWriter with default buffer size. The logs are frequently lost when the application crashes because the buffer is not flushed. Which change ensures that log messages are written immediately without significantly impacting performance?

Accepted Answer

Use a PrintWriter wrapping a FileWriter and set autoFlush=true.. Option C is correct because a PrintWriter wrapping a FileWriter with autoFlush=true ensures that every println, printf, or format call triggers an automatic flush of the underlying stream. This guarantees log messages are written to disk immediately upon each write, preventing data loss during a crash, while still allowing the FileWriter's internal buffer to aggregate small writes for performance. The autoFlush mechanism in PrintWriter is specifically designed for this use case in Java I/O.

Answer

Use a FileWriter with autoFlush=true.

Answer

Set the buffer size to 0 to disable buffering.

Answer

Call flush() after every log message.

Question 3

You are a Java developer at a logistics company. Your team is maintaining a legacy Java 8 application that uses dozens of jars on the classpath. The company has decided to migrate to Java 17 and adopt the module system. As a first step, you are analyzing the application's dependencies using jdeps. You run 'jdeps -s -dotoutput /tmp/deps' on all jars. The output shows many dependencies labeled 'not found' for internal packages that belong to other jars in the application. The packages are correctly exported by the respective jars (which are on the classpath). You suspect that because the jars are on the classpath, jdeps cannot resolve inter-jar dependencies as modules. To get accurate dependency information, what should you do?

Accepted Answer

Place all the jars on the module path and remove them from the classpath when running jdeps.. When jars are on the classpath, jdeps treats them as unnamed modules and cannot resolve inter-jar dependencies as module-level relationships, leading to 'not found' labels. Placing all jars on the module path (Option B) forces jdeps to treat each jar as a module (if it has a module-info.class) or as an automatic module (if it does not), enabling accurate dependency resolution. This is the correct approach because the module path is designed for module-aware analysis, while the classpath is a legacy flat namespace.

Answer

Use jlink to create a custom runtime image that includes all the jars.

Answer

Run jdeps with the --module-path option pointing to the directory containing all jars, and keep the jars on the classpath.

Answer

Convert each jar into a named module by adding module-info.java to each jar and recompiling.

Question 4

A Java developer is building a modular application that uses only the `java.base` and `java.sql` modules. The application runs correctly with a full JDK 17 installation. The developer wants to distribute a minimal runtime image to reduce download size for end users. They have the application module JAR file and all dependencies are modular. The developer runs the command `jlink --module-path $JAVA_HOME/jmods:app --add-modules app --output myimage` but receives an error: "Error: java.sql module not found". What is the most likely cause of this error?

Accepted Answer

The `--add-modules` option was not specified for `java.sql`, so it is not included in the runtime image.. Option D is correct because `jlink` only includes modules explicitly specified with `--add-modules` (plus their transitive dependencies) in the runtime image. The command only specifies `--add-modules app`, so `java.sql` is not included unless `app` requires it. Since the error says 'java.sql module not found', the most likely cause is that `java.sql` was not listed in `--add-modules` and is not a transitive dependency of `app`.

Answer

The `--add-modules` option can only be used with root modules, but `java.sql` is not a root module.

Answer

The `java.sql` module is not a standard JDK module and must be compiled separately.

Answer

The module path is missing the application's output directory.

Question 5

You are a software architect at a financial firm. Your team is developing a modular Java 17 application that comprises several modules: 'com.bank.core' (provides core banking services), 'com.bank.web' (REST API), and 'com.bank.persistence' (database access). The application uses the 'java.sql' module for JDBC and 'java.logging' for logging. The team uses Maven for dependency management. The application has an external dependency on the 'com.fasterxml.jackson.databind' library (Jackson) for JSON processing, which is provided as a non-modular jar. The Jackson jar is placed on the module path. The application modules are all named modules with module-info files. At runtime, the 'com.bank.web' module requires 'com.bank.core' and 'com.fasterxml.jackson.databind' (the automatic module). The 'com.bank.core' module requires 'java.sql' and 'java.logging'. When the application runs, it throws an 'IllegalAccessError' indicating that the module 'com.bank.core' tries to access a class from 'com.fasterxml.jackson.databind' but the module does not read it. Yet, 'com.bank.web' is the only module that explicitly requires Jackson. What is the most likely cause and the correct resolution?

Accepted Answer

Add 'requires com.fasterxml.jackson.databind' to the module-info.java of 'com.bank.core' because it uses Jackson classes directly.. Option B is correct because the error indicates that 'com.bank.core' directly uses classes from 'com.fasterxml.jackson.databind', but its module-info.java does not include a 'requires com.fasterxml.jackson.databind' directive. In the Java module system, a module can only access types from another module if it explicitly reads that module. Since 'com.bank.core' needs Jackson classes at runtime, it must declare the dependency itself, even if another module ('com.bank.web') also requires it.

Answer

Convert all application modules to unnamed modules by removing module-info files.

Answer

Place the Jackson jar on the classpath instead of the module path.

Answer

Use jlink to create a custom runtime image including all modules and the Jackson jar.

Question 6

In a large enterprise application, a concurrent caching system is implemented using a ConcurrentHashMap that is accessed by multiple threads concurrently. The cache performs atomic operations on individual keys, but some operations require updates on multiple keys. To ensure consistency, the code acquires intrinsic locks on the keys using synchronized blocks. Over time, the system has been experiencing intermittent deadlocks. During post-mortem analysis, it was found that thread A holds a lock on key X and is waiting for key Y, while thread B holds a lock on key Y and is waiting for key X. The development team needs to redesign the locking strategy to eliminate these deadlocks while maintaining high throughput and minimizing code changes. They consider the following proposals: replacing ConcurrentHashMap with Collections.synchronizedMap, using a single ReentrantLock for all cache operations, always acquiring locks on keys in a consistent global order, or using a Lock with tryLock and a timeout and releasing all locks if timeout expires. Based on best practices in concurrent programming and considering the requirements to avoid deadlocks and maintain performance, which approach should they choose?

Accepted Answer

Use a Lock with tryLock and a timeout, and release all locks if timeout expires.. Option C is correct because using tryLock with a timeout allows threads to back off and release all acquired locks if they cannot obtain all required locks within a specified time, which breaks the circular wait condition that causes deadlocks. This approach maintains high throughput by avoiding coarse-grained locking and minimizes code changes by only modifying the lock acquisition logic, not the underlying ConcurrentHashMap structure.

Answer

Use a single ReentrantLock for all cache operations.

Answer

Replace ConcurrentHashMap with Collections.synchronizedMap.

Answer

Always acquire locks on keys in a consistent global order.

Question 7

A junior developer writes a method that uses a switch statement to handle different types of user input. The input is an integer representing an operation code. The developer uses a traditional switch statement with break statements. However, when operation code 2 is entered, the program also executes the code for operation 3. What is the most likely cause?

Accepted Answer

The break statement is missing after the operation 2 case.. In a traditional Java switch statement, execution continues into the next case block unless a break statement is encountered. If operation code 2 executes the code for operation 3, it indicates that the break statement is missing after the case for operation 2, causing fall-through to the next case.

Answer

The operation codes are not mutually exclusive.

Answer

The variable is being modified inside the switch.

Answer

The switch statement uses fall-through by design.

Question 8

A Java application processes a list of orders. Each order has a status: NEW, PROCESSING, SHIPPED, or DELIVERED. The code must print a message based on the status:
- If NEW: "Order received"
- If PROCESSING: "Order in progress"
- If SHIPPED: "Order shipped"
- If DELIVERED: "Order delivered"
- For any other status: "Unknown status"

The developer writes the following code using a switch expression:

String message = switch (status) {
    case NEW -> "Order received";
    case PROCESSING -> "Order in progress";
    case SHIPPED -> "Order shipped";
    case DELIVERED -> "Order delivered";
    default -> "Unknown status";
};
System.out.println(message);

What is the correct course of action to ensure the code compiles and runs correctly?

Accepted Answer

No change needed; the code compiles and runs as expected.. Option C is correct because the switch expression shown is syntactically valid and complete. It uses the arrow syntax with all enum constants covered and includes a default branch to handle any other status, so it compiles and runs as expected. Switch expressions can yield values and work with enum types, making the code correct as written.

Answer

Add a default branch to handle any other status.

Answer

Use if-else if statements because switch cannot be used with enum types.

Answer

Change the switch expression to a switch statement because switch expressions cannot yield values.

Question 9

You are developing a microservice that processes financial transactions. The service reads transaction data from a message queue, validates it, and writes results to a database. The code uses a try-with-resources statement to manage database connections. During testing, you notice that when a transaction fails validation, the service throws an IllegalStateException before closing the database connection, causing a resource leak. You need to ensure that the database connection is always closed properly, even if an exception is thrown during validation. The current code structure is:

try (Connection conn = DriverManager.getConnection(url, user, pass)) {
    // read from queue
    // validate transaction
    // if invalid, throw new IllegalStateException("Invalid transaction");
    // write to database
}

Which course of action would you recommend?

Accepted Answer

No change is needed; the try-with-resources ensures the connection is closed.. Option B is correct because try-with-resources automatically closes any resource that implements AutoCloseable (including Connection) when the try block exits, whether normally or via an exception. The IllegalStateException thrown during validation does not prevent the connection from being closed; the close() method is called as part of the implicit finally block generated by the compiler.

Answer

Move the connection creation outside the try-with-resources to manually manage it.

Answer

Replace the try-with-resources with a try-catch-finally block and close the connection in the finally block.

Answer

Add a catch block to catch the IllegalStateException and close the connection.

Question 10

A developer is working on a high-performance trading application that processes market data. The system needs to maintain a sorted list of order IDs (Long values) that are frequently inserted and removed. The current implementation uses a TreeSet<Long> to store the order IDs. The application is experiencing performance degradation under high load, and profiling shows that the TreeSet operations are the bottleneck. The developer considers replacing the TreeSet with a data structure that offers O(log n) insertion and removal but also supports O(log n) indexed access (e.g., get by index) for batch processing. Which of the following should the developer choose to improve performance while maintaining the sorted order and adding indexed access?

Accepted Answer

No standard Java Collections class fulfills all requirements; consider a custom implementation.. Option A is correct because no standard Java Collections class provides O(log n) insertion, removal, and O(log n) indexed access while maintaining sorted order. TreeSet offers O(log n) insertion/removal but lacks indexed access; ArrayList provides O(1) indexed access but requires O(n log n) sorting after each insertion; PriorityQueue offers O(log n) insertion/removal but only O(1) peek access, not indexed access. A custom data structure like an order statistic tree (e.g., a balanced binary search tree with subtree sizes) is needed to meet all requirements.

Answer

Replace with TreeMap<Long, Boolean> and use the key set for iteration and indexed access via keySet().toArray().

Answer

Replace with PriorityQueue<Long> and use poll() for removal and toArray() for indexed access.

Answer

Replace with ArrayList<Long> and use Collections.sort() after each insertion.

Question 11

A company runs a Java 17 microservice that reads stock market data from a WebSocket and processes it. The application is packaged as an executable JAR using Maven Shade Plugin. Recently, after a dependency update, the application started throwing 'javax.net.ssl.SSLHandshakeException: PKIX path building failed' when connecting to the WebSocket. The security team insists that no certificates should be imported into the default truststore. The application already includes a custom truststore file 'certs.jks' in the resources folder. The developer had been loading it programmatically but the new dependency uses a different SSL context. The application must trust the WebSocket server without modifying JVM defaults. Which action should be taken?

Accepted Answer

Set the system property 'javax.net.ssl.trustStore' to the path of 'certs.jks' and 'javax.net.ssl.trustStorePassword' to its password.. Option A is correct because setting the system properties 'javax.net.ssl.trustStore' and 'javax.net.ssl.trustStorePassword' overrides the default JVM truststore globally for all SSL contexts within the application. This allows the custom 'certs.jks' file to be used without modifying the JVM's default truststore, satisfying the security team's requirement. The new dependency causing the issue likely uses the default SSL context, which will now pick up the custom truststore via these system properties.

Answer

Add the certificate to the default truststore using keytool and restart the application.

Answer

Use the jlink tool to create a custom runtime image that includes the certificate.

Answer

Create a custom TrustManager that bypasses all certificate validation.

Question 12

A Java developer is writing a batch processing application that reads records from a database and processes them. The processing must continue even if some records cause exceptions (e.g., data conversion errors). However, the application must log each failed record and its error, then continue with the next record. The developer uses a for loop to iterate over a list of records. Inside the loop, a try-catch block wraps the processing logic. After implementing, the developer notices that when an exception occurs, the loop terminates prematurely instead of continuing. The code structure is:

List<Record> records = fetchRecords();
for (Record rec : records) {
    try {
        process(rec);
    } catch (Exception e) {
        log.error("Failed to process: " + rec.getId(), e);
    }
}

What is the most likely reason for the premature termination?

Accepted Answer

The process() method throws an Error instead of an Exception.. The code catches `Exception`, but `Error` (and its subclasses like `OutOfMemoryError`, `StackOverflowError`, or custom `Error` types) are not subclasses of `Exception`. In Java, `Throwable` has two main branches: `Exception` (including `RuntimeException`) and `Error`. Since `Error` is not caught by `catch (Exception e)`, it propagates up and terminates the loop. This is the most likely reason for premature termination because the developer assumed all failures would be `Exception` types.

Answer

The records list contains null elements, causing a NullPointerException that is not caught.

Answer

The log.error() method itself throws an unchecked exception that is not caught.

Answer

The try-catch block is incorrectly placed inside the for loop, causing the loop to break on any exception.

Question 13

A financial trading application processes real-time stock data from multiple exchanges. The application reads large binary files (each up to 500 MB) containing trade records, processes them, and writes summary reports to a shared network drive. The development team observes that the application occasionally throws a java.io.IOException: 'The process cannot access the file because it is being used by another process' when writing reports. The application is multi-threaded, and each thread writes to a separate file in the same directory. The team also notices that the application slows down significantly when the network drive is under heavy load. The application runs on Windows servers with Java 17. The code uses FileOutputStream for writing and does not explicitly close streams in some paths. Which course of action should the team take to resolve the issues and improve performance?

Accepted Answer

Switch to using try-with-resources for all FileOutputStream instances and wrap them in BufferedOutputStream with a larger buffer.. Option C is correct because the primary issue is resource leaks from not closing FileOutputStream instances, which can cause file locking conflicts on Windows when multiple threads write to separate files in the same directory. Using try-with-resources ensures streams are closed reliably, eliminating the 'file in use' IOException. Wrapping with BufferedOutputStream and a larger buffer reduces the number of write operations to the network drive, mitigating slowdowns under heavy load by batching data and minimizing latency.

Answer

Increase the thread pool size to handle more concurrent writes.

Answer

Use FileChannel with FileLock to synchronize access.

Answer

Write to local temporary files and then copy to the network drive.

Question 14

You are responsible for a Java 17 application that processes user uploads. The application uses a custom AutoCloseable resource, UploadSession, which must always be closed after use to free server resources. A junior developer wrote the following code:

```
UploadSession session = new UploadSession();
try {
    session.upload(data);
    // more processing
} catch (UploadException e) {
    log.error("Upload failed", e);
} finally {
    session.close();
}
```

During a code review, you notice that the close() method of UploadSession throws a checked CloseException. The current code does not handle this exception. Which course of action should you recommend to ensure the application is robust and follows best practices?

Accepted Answer

Rewrite the code to use try-with-resources: try (UploadSession session = new UploadSession()) { ... } catch (UploadException e) { ... }. Option D is correct because try-with-resources automatically calls the close() method on the UploadSession resource when the try block exits, whether normally or abruptly. This eliminates the need for an explicit finally block and ensures that any checked exception thrown by close() is either caught or propagated according to the developer's declared exception handling, making the code both robust and concise.

Answer

Add a try-catch block inside the finally block to handle CloseException from session.close().

Answer

Declare the method with throws CloseException, and remove the finally block.

Answer

Keep the code as-is. The CloseException is not critical; it can be ignored.

Question 15

A financial application processes transactions in batches. Each transaction is represented as a Transaction object with fields: long id, BigDecimal amount, LocalDateTime timestamp. Transactions are stored in a List<Transaction> in the order they arrive. The system needs to frequently check if a transaction with a specific id exists, and also needs to iterate through transactions in chronological order. The list currently contains millions of transactions, and the existence check is becoming a performance bottleneck because it currently uses a linear search. The system must also maintain insertion order for iteration. Which approach best improves the performance of the existence check while maintaining the required iteration order?

Accepted Answer

Replace List with LinkedHashMap mapping id to transaction. Iterate using values() which preserves insertion order.. Option B is correct because LinkedHashMap maintains insertion order for iteration via its values() view, while providing O(1) key-based lookup for the existence check. This directly addresses the performance bottleneck of linear search in a List without sacrificing the required chronological iteration order.

Answer

Keep List and add a separate HashSet of ids for fast lookup. Use the list for iteration.

Answer

Keep List<Transaction> and sort it by id. Use Collections.binarySearch() for lookup.

Answer

Replace List with TreeMap mapping id to transaction. Iterate using values() which returns in natural key order.