1Z0-829 Java I/O API and Securing Applications — 50 Questions

Question 1

A Java application writes sensitive user data to a file. To ensure that data is not left in the file system after the application crashes, which practice should be followed?

Accepted Answer

Write to a temporary file, then use Files.move() with ATOMIC_MOVE to replace the target file. Writing to a temporary file and then atomically moving it with `Files.move()` using the `ATOMIC_MOVE` option ensures that the target file is replaced only after the write succeeds. If the application crashes during the write, only the temporary file is corrupted, and the original target file remains intact. This prevents sensitive data from being left in an incomplete or partially written state in the file system.

Answer

Call flush() after every write operation

Answer

Delete the file manually in a finally block

Answer

Use a FileLock to prevent concurrent access

Question 2

A Java application running in a secure environment needs to read a file located outside the application's directory. Which approach correctly handles security?

Accepted Answer

Grant java.io.FilePermission in the security policy file for the specific file path. In a secure Java environment, the SecurityManager enforces access controls based on the security policy file. To read a file outside the application's directory, you must explicitly grant `java.io.FilePermission` with the specific file path and the `read` action in the policy file. Without this permission, any attempt to read the file will throw a `java.security.AccessControlException`.

Answer

Use FileInputStream without any additional configuration

Answer

Use java.net.URL to access the file via file:// protocol

Answer

Set the file readable flag using File.setReadable(true)

Question 3

Which TWO statements are true about securing a Java application?

Accepted Answer

A security policy file can grant specific permissions to code from a particular codebase.. A Java security policy file can use a codebase URL (e.g., `codeBase "file:/path/to/jar"`) to grant specific permissions, such as `java.io.FilePermission`, to code loaded from that location. This is a core feature of the Java security model, allowing fine-grained access control based on where the code originates.

Answer

Enabling the security manager is required for all Java applications.

Answer

The Java Cryptography Extension (JCE) is deprecated and should not be used.

Answer

Using code signing guarantees that the application is secure.

Question 4

Which TWO are true about the try-with-resources statement?

Accepted Answer

Resources declared outside the try block can be used if they are effectively final.. The try-with-resources statement allows resources declared outside the try block to be used, provided they are effectively final (i.e., their reference does not change after initialization). This was introduced in Java 9, which enhanced try-with-resources to support effectively final variables in addition to those declared directly within the try parentheses.

Answer

All resources must be of the same type.

Answer

Multiple resources must be separated by commas.

Answer

The resource must implement the Closeable interface.

Question 5

A Java application reads configuration from a file using FileInputStream. The application must handle the case where the configuration file is missing by logging a warning and using default values. Which design approach best meets this requirement?

Accepted Answer

Use Files.exists() to check file existence before opening the stream, and if absent, log a warning and use defaults.. It explicitly checks for file existence using `Files.exists()` before attempting to open the stream, allowing the application to log a warning and fall back to default values without throwing an exception. This approach aligns with the requirement to handle a missing configuration file gracefully, avoiding unnecessary exception handling overhead. The `Files.exists()` method is part of the modern `java.nio.file` API, which is preferred over the legacy `File.exists()` for its better integration with symbolic links and file system operations.

Answer

Wrap the FileInputStream in a try-with-resources and catch Exception to handle missing file.

Answer

Catch FileNotFoundException inside the try block and set default values.

Answer

Use File.exists() to check file existence before opening the stream, and if absent, log a warning and use defaults.

Question 6

Which TWO statements about java.io and java.nio.file packages are true?

Accepted Answer

java.nio.file.Files class provides methods for operating on symbolic links.. Option B is correct because java.nio.file.Files provides static methods that specifically handle symbolic links, such as createSymbolicLink, readSymbolicLink, isSymbolicLink, and delete, which follow or do not follow links as needed. Option C is correct because java.io.RandomAccessFile implements both DataInput and DataOutput and exposes read()/write() methods along with a file pointer (seek, getFilePointer), so it supports both reading from and writing to the same file. Option A is not correct as stated because java.io.Console is obtained via System.console() and reads/writes through its own reader()/writer() tied to the console, not by directly operating on the standard streams System.in/System.out/System.err. Option D is not correct because java.io.FileInputStream does not support mark/reset; markSupported() returns false, unlike BufferedInputStream. Option E is not correct because java.nio.file.Path is an interface, not a class, implemented by platform-specific classes such as sun.nio.fs.UnixPath.

Answer

java.io.Console can be used to read from and write to the standard streams of the JVM.

Answer

java.io.FileInputStream supports the mark and reset methods.

Answer

java.nio.file.Path is a class that represents a file path.

Question 7

Order the steps to create an immutable class in Java.

Accepted Answer

Step 1: Declare the class as final. Step 2: Declare all fields as private and final. Step 3: Provide a constructor that initializes all fields (with defensive copying for mutable fields). Step 4: Do not define any setter methods.. Immutability requires no way to change object state after construction. Defensive copying prevents internal state from being altered.

Answer

Step 1: Declare all fields as private and final. Step 2: Provide a constructor that initializes all fields. Step 3: Declare the class as final. Step 4: Do not define any setter methods.

Answer

Step 1: Provide a constructor that initializes all fields. Step 2: Declare all fields as private and final. Step 3: Declare the class as final. Step 4: Do not define any setter methods.

Answer

Step 1: Do not define any setter methods. Step 2: Declare the class as final. Step 3: Declare all fields as private and final. Step 4: Provide a constructor that initializes all fields.

Question 8

Match each concurrency utility to its purpose.

Accepted Answer

CountDownLatch: A synchronization aid that allows one or more threads to wait until a set of operations being performed in other threads completes.. This question tests understanding of common concurrency utilities in java.util.concurrent such as CountDownLatch, CyclicBarrier, Semaphore, and Exchanger. A common mistake is confusing CountDownLatch (one-time use) with CyclicBarrier (reusable) and mixing up Semaphore's permit-based control with barrier synchronization.

Answer

CyclicBarrier: A synchronization aid that allows one or more threads to wait until a set of operations completes.

Answer

Semaphore: A synchronization aid that allows a set of threads to all wait for each other to reach a common barrier point.

Question 9

A developer needs to read all lines from a text file named "data.txt" that uses UTF-8 encoding. Which code correctly reads the file using the NIO.2 API?

Accepted Answer

Files.readAllLines(Path.of("data.txt"), StandardCharsets.UTF_8). `Files.readAllLines()` reads all lines from a file into a `List<String>`, and it accepts a `Path` and a `Charset` (here `StandardCharsets.UTF_8`) to handle encoding. This method is part of the NIO.2 API and directly fulfills the requirement to read all lines from a UTF-8 encoded file.

Answer

Files.lines(Path.of("data.txt"), StandardCharsets.UTF_8).collect(Collectors.toList())

Answer

Files.readString(Path.of("data.txt"), StandardCharsets.UTF_8)

Answer

Files.readAllBytes(Path.of("data.txt")).toString()

Question 10

Given a requirement to efficiently copy a large file (over 2 GB) from one path to another, which approach is most appropriate for Java NIO.2?

Accepted Answer

Using FileChannel.transferTo() with position and count. `FileChannel.transferTo()` leverages zero-copy I/O, which allows data to be transferred directly between file system caches without unnecessary copying through user-space buffers. This is particularly efficient for large files (over 2 GB) as it minimizes context switches and memory overhead, and the method supports a `position` and `count` parameter to handle large file offsets correctly.

Answer

Files.copy(source, target, StandardCopyOption.REPLACE_EXISTING)

Answer

Using Files.readAllBytes() then Files.write()

Answer

Using FileInputStream and FileOutputStream with a buffer of 8192 bytes

Question 11

Which resource declaration order in try-with-resources is valid when both a FileInputStream and a BufferedInputStream wrapping it need to be closed automatically?

Accepted Answer

try (FileInputStream fis = new FileInputStream("a"); BufferedInputStream bis = new BufferedInputStream(fis)) { ... }. In a try-with-resources statement, resources are declared in order and closed in reverse order. By declaring FileInputStream first and then BufferedInputStream wrapping it, both resources are properly closed automatically, with the BufferedInputStream closed first (ensuring its buffer is flushed) and then the FileInputStream.

Answer

try (FileInputStream fis = new FileInputStream("a")) { BufferedInputStream bis = new BufferedInputStream(fis); ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(fis); FileInputStream fis = new FileInputStream("a")) { ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(new FileInputStream("a"))) { ... }

Question 12

A developer wants to traverse a directory tree to find all files that are symbolic links. Which NIO.2 method should be used to follow symbolic links during traversal?

Accepted Answer

Files.walk(Path, FileVisitOption.FOLLOW_LINKS). `Files.walk(Path, FileVisitOption.FOLLOW_LINKS)` is the only method among the options that both traverses a directory tree recursively and explicitly follows symbolic links. The `FileVisitOption.FOLLOW_LINKS` enum constant instructs the walk to follow symbolic links, allowing the traversal to detect files that are themselves symbolic links. Without this option, `Files.walk` treats symbolic links as regular files and does not follow them, which would miss the target of the link.

Answer

Files.newDirectoryStream(Path)

Answer

Files.list(Path)

Answer

Files.walk(Path) without options

Question 13

A Java application uses SecurityManager with a policy file. Which permission is required to allow the application to read all files in the /var/log directory, including subdirectories?

Accepted Answer

permission java.io.FilePermission "/var/log/-", "read";. The trailing '-' in the path pattern '/var/log/-' is a recursive wildcard that matches all files and subdirectories under /var/log, which is required to read all files in that directory tree. The permission grants 'read' access, which is the only action needed for reading files.

Answer

permission java.io.FilePermission "/var/log", "read";

Answer

permission java.io.FilePermission "/var/log/*", "read,write";

Answer

permission java.io.FilePermission "/var/log/*", "read";

Question 14

Refer to the exhibit. Assuming the application is running from /home/application/lib/myapp.jar, which of the following actions is allowed by the policy?

Accepted Answer

All of the above. The policy grants all permissions (java.security.AllPermission) to the codebase file:/home/application/lib/myapp.jar, which means any action—including writing to /var/log/app.log, queuing a print job, and reading /etc/config/application.properties—is allowed. The AllPermission permission effectively disables all security checks for that code source, so all three listed actions are permitted.

Answer

Write to the file /var/log/app.log

Answer

Queue a print job using the system printer

Answer

Read the file /etc/config/application.properties

Question 15

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The class definition has changed and the serialVersionUID is not explicitly defined.. When a class definition changes (e.g., adding/removing fields) and the class does not explicitly declare a `serialVersionUID`, the JVM computes one automatically based on the class structure. After deserialization, if the computed UID differs from the UID stored in the serialized stream, an `InvalidClassException` is thrown. This is the most common cause of deserialization failures in practice.

Answer

The serialized object is corrupted.

Answer

The JVM versions are incompatible.

Answer

The file contains data that is not a serialized object.

Question 16

A developer needs to read a very large text file (over 1 GB) efficiently with minimal memory overhead. Which approach is most suitable?

Accepted Answer

Use FileChannel with a ByteBuffer to read in chunks.. FileChannel with a ByteBuffer allows reading a large file in configurable chunks, leveraging the operating system's native I/O for high throughput and minimal memory overhead. This approach avoids loading the entire file into memory and reduces context switching compared to stream-based readers.

Answer

Use Scanner to read tokens.

Answer

Use BufferedReader to read lines.

Answer

Use FileInputStream and read byte by byte.

Question 17

A class implements Serializable but the developer wants to completely prevent deserialization of its instances. Which approach accomplishes this?

Accepted Answer

Override readObject() to throw an InvalidClassException.. Overriding readObject() to throw an InvalidClassException (or any exception) prevents the deserialization mechanism from completing. When an ObjectInputStream calls readObject() on a class that defines its own readObject() method, that custom method is invoked instead of the default deserialization. Throwing an exception inside readObject() aborts the deserialization process, effectively blocking the reconstruction of the instance.

Answer

Override readResolve() to return a null.

Answer

Override writeObject() to encrypt the object.

Answer

Override writeReplace() to throw an exception.

Question 18

A web server application writes access logs to a file. To ensure that log entries are written to disk immediately even if the JVM crashes, which approach is most appropriate?

Accepted Answer

Use FileOutputStream and call flush() after each write.. FileOutputStream provides direct, unbuffered writes to the underlying file descriptor. While calling flush() does not force an immediate disk write (that requires sync() or FileChannel.force()), the unbuffered nature means data is passed to the operating system without intermediate caching in the JVM. Among the given options, this minimizes data loss risk because there is no JVM-level buffer that could hold unwritten data. Options B and C use buffering, which can delay writes, and D also uses an internal buffer. Note: For true guaranteed synchronous disk writes, additional system calls like FileDescriptor.sync() or FileChannel.force() are required.

Answer

Use BufferedWriter and call write() then flush() periodically.

Answer

Use PrintWriter with autoFlush enabled.

Answer

Use FileWriter without any buffering.

Question 19

A Java application needs to refer to a file using the path "data/input.txt". To ensure platform independence (correct file separator), which approach is recommended?

Accepted Answer

Paths.get("data", "input.txt"). `Paths.get("data", "input.txt")` uses the default file system's path separator, ensuring platform independence. This method internally calls `FileSystems.getDefault().getPath()` to construct the path with the correct separator for the operating system (e.g., '/' on Linux/macOS, '\' on Windows).

Answer

FileSystems.getDefault().getPath("data", "input.txt")

Answer

new File("data/input.txt").toPath().normalize()

Answer

new File("data/input.txt").toPath()

Question 20

Which THREE are recommended practices to prevent privilege escalation when using doPrivileged in a security-sensitive Java application?

Accepted Answer

Restrict the codebase URLs in policy files to only trusted code locations.. Option A is correct because restricting codebase URLs in the policy files ensures that doPrivileged blocks only grant elevated permissions to code loaded from trusted locations, preventing untrusted or remotely loaded code from inheriting privileged rights. Option D is correct because signing JARs and verifying signatures guarantees code integrity and authenticity, so an attacker cannot tamper with or substitute privileged classes to escalate privileges. Option E is correct because calling AccessController.checkPermission before entering a doPrivileged block explicitly verifies that the caller already holds the required permission, preventing the privileged block from being used to bypass normal access checks. Option B is not recommended here because SubjectDomainCombiner is used for combining protection domains in Subject.doAs scenarios, not for preventing privilege escalation with doPrivileged. Option C is not a recommended practice in this context because a SecurityManager is not always required and, while it enforces policy, it does not by itself prevent privilege escalation when doPrivileged is misused.

Answer

Use SubjectDomainCombiner to merge multiple protection domains.

Answer

Always use a SecurityManager to enforce the policy.