1Z0-829 Java I/O API and Securing Applications Practice Test 2 — 15 Questions

Question 1

You are developing a Java application that processes sensitive user data. The application runs on a server with strict security policies. You need to read configuration properties from a file located at /etc/app/config.properties. The application uses a SecurityManager. During testing, you get a security exception: java.security.AccessControlException: access denied (java.io.FilePermission /etc/app/config.properties read). You have already added a file permission grant in the policy file for the application codebase. However, the exception persists. What is the most likely cause?

Accepted Answer

A library or caller on the execution stack does not have the required FilePermission.. Option B is correct because even if the application's own codebase has the required FilePermission, any library or caller on the execution stack that does not have the permission will cause an AccessControlException. The SecurityManager performs stack inspection: every class on the call stack must have the required permission. If a library or framework method invoked by your code lacks the grant, the check fails.

Answer

The application codebase URL in the policy file is incorrect.

Answer

The file path is relative and needs to be resolved against user.dir.

Answer

The policy file is not being loaded because the JVM was not started with -Djava.security.policy.

Question 2

Which TWO statements about java.io and java.nio.file packages are true?

Accepted Answer

java.nio.file.Files class provides methods for operating on symbolic links.. Option B is correct because the `java.nio.file.Files` class provides methods such as `createSymbolicLink()`, `readSymbolicLink()`, and `isSymbolicLink()` that directly operate on symbolic links in the file system. This is a key feature of the NIO.2 API, which offers comprehensive support for file system metadata and link management, unlike the older `java.io` package.

Answer

java.io.Console can be used to read from and write to the standard streams of the JVM.

Answer

java.io.FileInputStream supports the mark and reset methods.

Answer

java.nio.file.Path is a class that represents a file path.

Question 3

A Java application running on a server reads configuration from a file 'config.properties' located in the same directory as the JAR. The application uses java.util.Properties.load(InputStream) to read the file. Recently, the file was modified by an unauthorized user, and the application started throwing runtime exceptions due to corrupted property values. The security team requires that the file be protected from unauthorized modifications while still being readable by the application. Which action should be taken to ensure the integrity of the configuration file?

Accepted Answer

Digitally sign the file and verify the signature before loading properties.. Option D is correct because digital signing provides both integrity and authenticity. By signing the file with a private key and verifying the signature with a public key before calling Properties.load(InputStream), the application can detect any unauthorized modification. This directly addresses the security requirement without relying on encryption (which protects confidentiality, not integrity) or file permissions (which can be bypassed by a privileged attacker).

Answer

Encrypt the file using AES and decrypt it in the application.

Answer

Set the file permissions to read-only for the application user.

Answer

Store the file in a ZIP archive with a checksum.

Question 4

Order the steps to create an immutable class in Java.

Question 5

Match each concurrency utility to its purpose.

Question 6

A developer needs to read all lines from a text file named "data.txt" that uses UTF-8 encoding. Which code correctly reads the file using the NIO.2 API?

Accepted Answer

Files.readAllLines(Path.of("data.txt"), StandardCharsets.UTF_8). Option D is correct because `Files.readAllLines()` reads all lines from a file into a `List<String>`, and it accepts a `Path` and a `Charset` (here `StandardCharsets.UTF_8`) to handle encoding. This method is part of the NIO.2 API and directly fulfills the requirement to read all lines from a UTF-8 encoded file.

Answer

Files.lines(Path.of("data.txt"), StandardCharsets.UTF_8).collect(Collectors.toList())

Answer

Files.readString(Path.of("data.txt"), StandardCharsets.UTF_8)

Answer

Files.readAllBytes(Path.of("data.txt")).toString()

Question 7

A company uses serialization to transfer objects between microservices. To prevent deserialization attacks, they want to restrict which classes can be deserialized. Which approach should be used in Java 17?

Accepted Answer

Use ObjectInputFilter with a custom filter. Option C is correct because Java 17 provides the `ObjectInputFilter` API (introduced in Java 9) as the standard mechanism to restrict which classes can be deserialized. By setting a custom filter via `ObjectInputStream.setObjectInputFilter()` or a system-wide `jdk.serialFilter` property, you can whitelist or blacklist classes based on patterns, effectively preventing deserialization attacks without modifying the serialization stream itself.

Answer

Override resolveClass in ObjectInputStream

Answer

Use SecurityManager with a policy file

Answer

Implement Externalizable and control fields

Question 8

Given a requirement to efficiently copy a large file (over 2 GB) from one path to another, which approach is most appropriate for Java NIO.2?

Accepted Answer

Using FileChannel.transferTo() with position and count. Option D is correct because `FileChannel.transferTo()` leverages zero-copy I/O, which allows data to be transferred directly between file system caches without unnecessary copying through user-space buffers. This is particularly efficient for large files (over 2 GB) as it minimizes context switches and memory overhead, and the method supports a `position` and `count` parameter to handle large file offsets correctly.

Answer

Files.copy(source, target, StandardCopyOption.REPLACE_EXISTING)

Answer

Using Files.readAllBytes() then Files.write()

Answer

Using FileInputStream and FileOutputStream with a buffer of 8192 bytes

Question 9

Which resource declaration order in try-with-resources is valid when both a FileInputStream and a BufferedInputStream wrapping it need to be closed automatically?

Accepted Answer

try (FileInputStream fis = new FileInputStream("a"); BufferedInputStream bis = new BufferedInputStream(fis)) { ... }. Option A is correct: Both resources are declared in the try header, with fis declared before bis. Option B has a forward reference error. Option C does not include bis in the try header, so it won't be automatically closed. Option D only declares one resource, not both.

Answer

try (FileInputStream fis = new FileInputStream("a")) { BufferedInputStream bis = new BufferedInputStream(fis); ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(fis); FileInputStream fis = new FileInputStream("a")) { ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(new FileInputStream("a"))) { ... }

Question 10

A developer wants to traverse a directory tree to find all files that are symbolic links. Which NIO.2 method should be used to follow symbolic links during traversal?

Accepted Answer

Files.walk(Path, FileVisitOption.FOLLOW_LINKS). The correct answer is D because `Files.walk(Path, FileVisitOption.FOLLOW_LINKS)` is the only method among the options that both traverses a directory tree recursively and explicitly follows symbolic links. The `FileVisitOption.FOLLOW_LINKS` enum constant instructs the walk to follow symbolic links, allowing the traversal to detect files that are themselves symbolic links. Without this option, `Files.walk` treats symbolic links as regular files and does not follow them, which would miss the target of the link.

Answer

Files.newDirectoryStream(Path)

Answer

Files.list(Path)

Answer

Files.walk(Path) without options

Question 11

A developer needs to create a temporary file that will be automatically deleted when the JVM terminates. Which approach correctly achieves this?

Accepted Answer

File.createTempFile("pre", ".txt").deleteOnExit(). Option A is correct because `File.createTempFile("pre", ".txt")` creates a temporary file in the default temporary-file directory, and chaining `.deleteOnExit()` registers that file for deletion when the JVM terminates. This combination ensures both the creation of a temporary file and its automatic cleanup upon JVM shutdown, fulfilling the requirement precisely.

Answer

new File("tmp.txt").deleteOnExit()

Answer

Files.createTempDirectory("tmp").toFile().deleteOnExit()

Answer

Files.createTempFile("pre", ".txt")

Question 12

A method receives an InputStream and needs to compute its MD5 hash while reading the data. Which approach is most efficient?

Accepted Answer

Use DigestInputStream wrapping the original stream, then read the stream. Option A is correct because `DigestInputStream` is a built-in Java class that computes a message digest (e.g., MD5) on the fly as data is read from the underlying stream. This avoids buffering the entire stream into memory, making it both memory-efficient and CPU-efficient for large or streaming data sources.

Answer

Read all bytes into a byte array, then compute hash using MessageDigest

Answer

Use a custom filter that hashes bytes during read

Answer

Use Scanner to read tokens and update hash

Question 13

A Java application uses SecurityManager with a policy file. Which permission is required to allow the application to read all files in the /var/log directory, including subdirectories?

Accepted Answer

permission java.io.FilePermission "/var/log/-", "read";. Option B is correct because the trailing '-' in the path pattern '/var/log/-' is a recursive wildcard that matches all files and subdirectories under /var/log, which is required to read all files in that directory tree. The permission grants 'read' access, which is the only action needed for reading files.

Answer

permission java.io.FilePermission "/var/log", "read";

Answer

permission java.io.FilePermission "/var/log/*", "read,write";

Answer

permission java.io.FilePermission "/var/log/*", "read";

Question 14

A serialized object has an explicitly declared serialVersionUID of 123L. After a code change, a new field is added to the class but the serialVersionUID is left unchanged. What happens when deserializing an old stream?

Accepted Answer

Deserialization succeeds and the new field is set to its default value.. Option A is correct because when a serialized object has an unchanged serialVersionUID, the Java deserialization mechanism treats the class as compatible. The new field is not present in the old stream, so it is simply initialized to its default value (e.g., null for objects, 0 for primitives) without throwing an exception. This behavior is defined by the Java Object Serialization Specification, which allows forward compatibility as long as the serialVersionUID matches.

Answer

Deserialization succeeds only if the new field is marked transient.

Answer

Deserialization throws StreamCorruptedException due to missing field.

Answer

Deserialization throws InvalidClassException because the class definition has changed.