1Z0-829 Java I/O API and Securing Applications Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The class definition has changed and the serialVersionUID is not explicitly defined.. When a class definition changes (e.g., adding/removing fields) and the class does not explicitly declare a `serialVersionUID`, the JVM computes one automatically based on the class structure. After deserialization, if the computed UID differs from the UID stored in the serialized stream, an `InvalidClassException` is thrown. This is the most common cause of deserialization failures in practice.

Answer

The serialized object is corrupted.

Answer

The JVM versions are incompatible.

Answer

The file contains data that is not a serialized object.

Question 2

A developer needs to read a very large text file (over 1 GB) efficiently with minimal memory overhead. Which approach is most suitable?

Accepted Answer

Use FileChannel with a ByteBuffer to read in chunks.. FileChannel with a ByteBuffer allows reading a large file in configurable chunks, leveraging the operating system's native I/O for high throughput and minimal memory overhead. This approach avoids loading the entire file into memory and reduces context switching compared to stream-based readers.

Answer

Use Scanner to read tokens.

Answer

Use BufferedReader to read lines.

Answer

Use FileInputStream and read byte by byte.

Question 3

A class implements Serializable but the developer wants to completely prevent deserialization of its instances. Which approach accomplishes this?

Accepted Answer

Override readObject() to throw an InvalidClassException.. Overriding readObject() to throw an InvalidClassException (or any exception) prevents the deserialization mechanism from completing. When an ObjectInputStream calls readObject() on a class that defines its own readObject() method, that custom method is invoked instead of the default deserialization. Throwing an exception inside readObject() aborts the deserialization process, effectively blocking the reconstruction of the instance.

Answer

Override readResolve() to return a null.

Answer

Override writeObject() to encrypt the object.

Answer

Override writeReplace() to throw an exception.

Question 4

A web server application writes access logs to a file. To ensure that log entries are written to disk immediately even if the JVM crashes, which approach is most appropriate?

Accepted Answer

Use FileOutputStream and call flush() after each write.. FileOutputStream provides direct, unbuffered writes to the underlying file descriptor. While calling flush() does not force an immediate disk write (that requires sync() or FileChannel.force()), the unbuffered nature means data is passed to the operating system without intermediate caching in the JVM. Among the given options, this minimizes data loss risk because there is no JVM-level buffer that could hold unwritten data. Options B and C use buffering, which can delay writes, and D also uses an internal buffer. Note: For true guaranteed synchronous disk writes, additional system calls like FileDescriptor.sync() or FileChannel.force() are required.

Answer

Use BufferedWriter and call write() then flush() periodically.

Answer

Use PrintWriter with autoFlush enabled.

Answer

Use FileWriter without any buffering.

Question 5

A Java application needs to refer to a file using the path "data/input.txt". To ensure platform independence (correct file separator), which approach is recommended?

Accepted Answer

Paths.get("data", "input.txt"). `Paths.get("data", "input.txt")` uses the default file system's path separator, ensuring platform independence. This method internally calls `FileSystems.getDefault().getPath()` to construct the path with the correct separator for the operating system (e.g., '/' on Linux/macOS, '\' on Windows).

Answer

FileSystems.getDefault().getPath("data", "input.txt")

Answer

new File("data/input.txt").toPath().normalize()

Answer

new File("data/input.txt").toPath()

Question 6

Which THREE are recommended practices to prevent privilege escalation when using doPrivileged in a security-sensitive Java application?

Accepted Answer

Restrict the codebase URLs in policy files to only trusted code locations.. Option A is correct because restricting codebase URLs in the policy files ensures that doPrivileged blocks only grant elevated permissions to code loaded from trusted locations, preventing untrusted or remotely loaded code from inheriting privileged rights. Option D is correct because signing JARs and verifying signatures guarantees code integrity and authenticity, so an attacker cannot tamper with or substitute privileged classes to escalate privileges. Option E is correct because calling AccessController.checkPermission before entering a doPrivileged block explicitly verifies that the caller already holds the required permission, preventing the privileged block from being used to bypass normal access checks. Option B is not recommended here because SubjectDomainCombiner is used for combining protection domains in Subject.doAs scenarios, not for preventing privilege escalation with doPrivileged. Option C is not a recommended practice in this context because a SecurityManager is not always required and, while it enforces policy, it does not by itself prevent privilege escalation when doPrivileged is misused.

Answer

Use SubjectDomainCombiner to merge multiple protection domains.

Answer

Always use a SecurityManager to enforce the policy.

Question 7

Refer to the exhibit. Which algorithm was used to generate the certificate fingerprint shown?

Accepted Answer

MD5. The certificate fingerprint shown is a 32-character hexadecimal string, which corresponds to a 128-bit hash. MD5 produces a 128-bit (16-byte) hash, displayed as 32 hex digits. This matches the fingerprint format exactly, confirming that MD5 was used.

Answer

SHA-1

Answer

SHA-384

Answer

SHA-256

Question 8

Refer to the exhibit. Which of the following best describes the effective permissions granted to the application?

Accepted Answer

The application can read and write files under /data/ and connect to any socket.. The exhibit shows a Java security policy granting the application `java.net.SocketPermission` with `connect,resolve` actions and `java.io.FilePermission` with `read,write` actions on `/data/-`. This means the application can connect to any socket (since the target name is `*`) and read/write any file under `/data/`. Option B correctly captures both permissions.

Answer

The application can connect to any network socket.

Answer

The application can only read files under /data/ and connect to sockets.

Answer

The application can read and write any file under /data/.

Question 9

Which TWO approaches are valid for writing text data to a file in Java? (Choose two.)

Accepted Answer

new FileWriter("out.txt", true).write(text). Option C is correct because FileWriter is a character-stream class designed for writing text; constructing it with the boolean true opens the file in append mode, and write(text) writes the String's characters directly. Option D is correct because PrintWriter is a text-oriented writer whose print(text) method writes the String, and the constructor PrintWriter(String fileName) conveniently creates/truncates the file and uses the default charset. Option A is not a text-writing approach per se: FileOutputStream is a byte stream, and text.getBytes() manually converts to bytes, so it writes raw bytes rather than text characters. Option B is invalid for text because RandomAccessFile.writeUTF writes a modified UTF-8 length-prefixed encoding, not plain text, and is intended for binary data. Option E is not among the marked answers; moreover, Files.write with a collection of lines requires a Charset or Iterable<CharSequence> overload and StandardOpenOption.CREATE alone does not specify text semantics, making it less directly a plain text-writing approach than C or D.

Answer

new FileOutputStream("out.txt").write(text.getBytes())

Answer

new RandomAccessFile("out.txt", "rw").writeUTF(text)

Answer

Files.write(Paths.get("out.txt"), lines, StandardOpenOption.CREATE)

Question 10

Which THREE statements about the SecurityManager and security policies in Java 17 are true? (Choose three.)

Accepted Answer

The SecurityManager class is deprecated in Java 17.. Option B is correct because JEP 411, delivered in Java 17, deprecated the SecurityManager class (along with related APIs such as AccessController) for removal, marking the beginning of the phase-out of the security manager model. Option D is correct because a policy file is composed of grant entries that associate permissions with code sources, using syntax like grant codeBase "..." { permission ...; }, which is the core mechanism for expressing policy. Option E is correct because AccessController.doPrivileged() executes a code block with the privileges of its own protection domain, temporarily suspending the stack-based permission check of callers so the code can perform actions it is itself permitted to do. Option A is not correct because System.setProperty("java.security.policy", ...) only sets a system property value and does not load or refresh a policy; policy loading is done via Policy.getPolicy()/Policy.setPolicy() or the -Djava.security.policy command-line option at startup. Option C is not correct because, since Java 1.2, applications run without a SecurityManager installed by default; one must be installed explicitly via -Djava.security.manager or System.setSecurityManager().

Answer

System.setProperty("java.security.policy", "policy.url") loads a new policy.

Answer

By default, Java 17 applications run with a SecurityManager installed.

Question 11

Refer to the exhibit. A developer runs a keytool command and sees the output above. Which command produced this output?

Accepted Answer

keytool -list -v -alias mykey -keystore keystore.jks. The `keytool -list -v -alias mykey -keystore keystore.jks` command displays detailed certificate information (including owner, issuer, serial number, validity, and fingerprint) for the specified alias in the JKS keystore. The `-v` flag produces verbose output, which matches the exhibit's detailed certificate listing.

Answer

keytool -exportcert -alias mykey -keystore keystore.jks -file cert.cer

Answer

keytool -importcert -alias mykey -keystore keystore.jks -file cert.cer

Answer

keytool -printcert -file cert.cer

Question 12

Refer to the exhibit. A security policy file is configured as shown. The application in app.jar tries to read a file named "${user.home}/data/db.properties". What is the result?

Accepted Answer

Access is allowed because app.jar has AllPermission.. The security policy grants AllPermission to app.jar, which supersedes any specific file permissions. AllPermission implies every possible permission, including read access to any file, regardless of path restrictions. Therefore, the application can read '${user.home}/data/db.properties' without denial.

Answer

Access is denied because the FilePermission for data files is missing.

Answer

Access is denied because app.jar's AllPermission is not sufficient.

Answer

Access is allowed because the first grant includes read permission for logs/-, which covers data.

Question 13

Which class from the java.nio.file package is most appropriate for efficiently transferring data between two channels on the same machine?

Accepted Answer

FileChannel.transferTo(long, long, WritableByteChannel). `FileChannel.transferTo()` (and its counterpart `transferFrom()`) uses the operating system's zero-copy mechanism (e.g., `sendfile()` on Linux or `TransmitFile()` on Windows) to move data directly between file system caches and the target channel without intermediate buffers or user-space copies. This makes it the most efficient approach for transferring data between two channels on the same machine, as it minimizes CPU overhead and memory bandwidth usage.

Answer

Files.copy(Path, Path)

Answer

RandomAccessFile.getChannel().write(ByteBuffer)

Answer

InputStream.transferTo(OutputStream)

Question 14

A Java application uses FileChannel to copy a file to a remote network drive. The developer wants to ensure atomic file replacement on the destination. Which approach is correct?

Accepted Answer

Use Files.move() with StandardCopyOption.ATOMIC_MOVE.. `Files.move()` with `StandardCopyOption.ATOMIC_MOVE` guarantees that the file replacement on the destination file system is atomic — either the entire move succeeds or the original state remains intact. This is essential for remote network drives where partial writes or concurrent access could leave the destination in an inconsistent state. The `ATOMIC_MOVE` option leverages file system–level atomic rename operations (e.g., NFS or SMB support) to ensure no intermediate state is visible.

Answer

Delete the destination file, then rename the temporary file.

Answer

Use FileChannel.transferTo() to write directly.

Answer

Use Files.copy() with REPLACE_EXISTING option.

Question 15

A developer is writing a utility to copy a large binary file (e.g., 500 MB) from one location to another while minimizing memory overhead and ensuring data integrity. Which approach is most appropriate?

Accepted Answer

Use a custom loop reading into a byte array of 8KB and writing to the output stream.. Reading and writing in fixed-size chunks (e.g., 8KB) minimizes memory overhead by avoiding loading the entire 500 MB file into memory, while still providing efficient I/O through buffered operations. This approach ensures data integrity by processing the file sequentially without relying on character-based streams, which are unsuitable for binary data.

Answer

Use BufferedReader and BufferedWriter for binary data.

Answer

Use Files.copy() with StandardCopyOption.REPLACE_EXISTING.

Answer

Use FileInputStream.readAllBytes() and FileOutputStream.write().