1Z0-829 Java I/O API and Securing Applications Practice Test 2 — 15 Questions

Question 1

Which TWO statements about Java serialization are true?

Accepted Answer

During deserialization, the constructor of the serialized class is not invoked.. During deserialization, Java does not invoke the constructor of the class being deserialized. Instead, the object is reconstructed from the serialized stream data using the no-arg constructor of the first non-serializable superclass (if any), and the serialized class's fields are populated via reflection or readObject() methods. This avoids re-executing initialization logic that may have side effects or depend on runtime state.

Answer

The serialVersionUID must be explicitly declared in every serializable class.

Answer

A class that implements Externalizable does not need to implement Serializable.

Answer

Fields marked as transient are serialized by default.

Question 2

You are developing a Java application that processes sensitive user data. The application runs on a server with strict security policies. You need to read configuration properties from a file located at /etc/app/config.properties. The application uses a SecurityManager. During testing, you get a security exception: java.security.AccessControlException: access denied (java.io.FilePermission /etc/app/config.properties read). You have already added a file permission grant in the policy file for the application codebase. However, the exception persists. What is the most likely cause?

Accepted Answer

A library or caller on the execution stack does not have the required FilePermission.. Even if the application's own codebase has the required FilePermission, any library or caller on the execution stack that does not have the permission will cause an AccessControlException. The SecurityManager performs stack inspection: every class on the call stack must have the required permission. If a library or framework method invoked by your code lacks the grant, the check fails.

Answer

The application codebase URL in the policy file is incorrect.

Answer

The file path is relative and needs to be resolved against user.dir.

Answer

The policy file is not being loaded because the JVM was not started with -Djava.security.policy.

Question 3

Which TWO statements about java.io and java.nio.file packages are true?

Accepted Answer

java.nio.file.Files class provides methods for operating on symbolic links.. The `java.nio.file.Files` class provides methods such as `createSymbolicLink()`, `readSymbolicLink()`, and `isSymbolicLink()` that directly operate on symbolic links in the file system. This is a key feature of the NIO.2 API, which offers comprehensive support for file system metadata and link management, unlike the older `java.io` package.

Answer

java.io.Console can be used to read from and write to the standard streams of the JVM.

Answer

java.io.FileInputStream supports the mark and reset methods.

Answer

java.nio.file.Path is a class that represents a file path.

Question 4

A Java application running on a server reads configuration from a file 'config.properties' located in the same directory as the JAR. The application uses java.util.Properties.load(InputStream) to read the file. Recently, the file was modified by an unauthorized user, and the application started throwing runtime exceptions due to corrupted property values. The security team requires that the file be protected from unauthorized modifications while still being readable by the application. Which action should be taken to ensure the integrity of the configuration file?

Accepted Answer

Digitally sign the file and verify the signature before loading properties.. Digital signing provides both integrity and authenticity. By signing the file with a private key and verifying the signature with a public key before calling Properties.load(InputStream), the application can detect any unauthorized modification. This directly addresses the security requirement without relying on encryption (which protects confidentiality, not integrity) or file permissions (which can be bypassed by a privileged attacker).

Answer

Encrypt the file using AES and decrypt it in the application.

Answer

Set the file permissions to read-only for the application user.

Answer

Store the file in a ZIP archive with a checksum.

Question 5

Order the steps to create an immutable class in Java.

Accepted Answer

Step 1: Declare the class as final. Step 2: Declare all fields as private and final. Step 3: Provide a constructor that initializes all fields (with defensive copying for mutable fields). Step 4: Do not define any setter methods.. Immutability requires no way to change object state after construction. Defensive copying prevents internal state from being altered.

Answer

Step 1: Declare all fields as private and final. Step 2: Provide a constructor that initializes all fields. Step 3: Declare the class as final. Step 4: Do not define any setter methods.

Answer

Step 1: Provide a constructor that initializes all fields. Step 2: Declare all fields as private and final. Step 3: Declare the class as final. Step 4: Do not define any setter methods.

Answer

Step 1: Do not define any setter methods. Step 2: Declare the class as final. Step 3: Declare all fields as private and final. Step 4: Provide a constructor that initializes all fields.

Question 6

Match each concurrency utility to its purpose.

Accepted Answer

CountDownLatch: A synchronization aid that allows one or more threads to wait until a set of operations being performed in other threads completes.. This question tests understanding of common concurrency utilities in java.util.concurrent such as CountDownLatch, CyclicBarrier, Semaphore, and Exchanger. A common mistake is confusing CountDownLatch (one-time use) with CyclicBarrier (reusable) and mixing up Semaphore's permit-based control with barrier synchronization.

Answer

CyclicBarrier: A synchronization aid that allows one or more threads to wait until a set of operations completes.

Answer

Semaphore: A synchronization aid that allows a set of threads to all wait for each other to reach a common barrier point.

Question 7

A developer needs to read all lines from a text file named "data.txt" that uses UTF-8 encoding. Which code correctly reads the file using the NIO.2 API?

Accepted Answer

Files.readAllLines(Path.of("data.txt"), StandardCharsets.UTF_8). `Files.readAllLines()` reads all lines from a file into a `List<String>`, and it accepts a `Path` and a `Charset` (here `StandardCharsets.UTF_8`) to handle encoding. This method is part of the NIO.2 API and directly fulfills the requirement to read all lines from a UTF-8 encoded file.

Answer

Files.lines(Path.of("data.txt"), StandardCharsets.UTF_8).collect(Collectors.toList())

Answer

Files.readString(Path.of("data.txt"), StandardCharsets.UTF_8)

Answer

Files.readAllBytes(Path.of("data.txt")).toString()

Question 8

A company uses serialization to transfer objects between microservices. To prevent deserialization attacks, they want to restrict which classes can be deserialized. Which approach should be used in Java 17?

Accepted Answer

Use ObjectInputFilter with a custom filter. Java 17 provides the `ObjectInputFilter` API (introduced in Java 9) as the standard mechanism to restrict which classes can be deserialized. By setting a custom filter via `ObjectInputStream.setObjectInputFilter()` or a system-wide `jdk.serialFilter` property, you can whitelist or blacklist classes based on patterns, effectively preventing deserialization attacks without modifying the serialization stream itself.

Answer

Override resolveClass in ObjectInputStream

Answer

Use SecurityManager with a policy file

Answer

Implement Externalizable and control fields

Question 9

Given a requirement to efficiently copy a large file (over 2 GB) from one path to another, which approach is most appropriate for Java NIO.2?

Accepted Answer

Using FileChannel.transferTo() with position and count. `FileChannel.transferTo()` leverages zero-copy I/O, which allows data to be transferred directly between file system caches without unnecessary copying through user-space buffers. This is particularly efficient for large files (over 2 GB) as it minimizes context switches and memory overhead, and the method supports a `position` and `count` parameter to handle large file offsets correctly.

Answer

Files.copy(source, target, StandardCopyOption.REPLACE_EXISTING)

Answer

Using Files.readAllBytes() then Files.write()

Answer

Using FileInputStream and FileOutputStream with a buffer of 8192 bytes

Question 10

Which resource declaration order in try-with-resources is valid when both a FileInputStream and a BufferedInputStream wrapping it need to be closed automatically?

Accepted Answer

try (FileInputStream fis = new FileInputStream("a"); BufferedInputStream bis = new BufferedInputStream(fis)) { ... }. In a try-with-resources statement, resources are declared in order and closed in reverse order. By declaring FileInputStream first and then BufferedInputStream wrapping it, both resources are properly closed automatically, with the BufferedInputStream closed first (ensuring its buffer is flushed) and then the FileInputStream.

Answer

try (FileInputStream fis = new FileInputStream("a")) { BufferedInputStream bis = new BufferedInputStream(fis); ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(fis); FileInputStream fis = new FileInputStream("a")) { ... }

Answer

try (BufferedInputStream bis = new BufferedInputStream(new FileInputStream("a"))) { ... }

Question 11

A developer wants to traverse a directory tree to find all files that are symbolic links. Which NIO.2 method should be used to follow symbolic links during traversal?

Accepted Answer

Files.walk(Path, FileVisitOption.FOLLOW_LINKS). `Files.walk(Path, FileVisitOption.FOLLOW_LINKS)` is the only method among the options that both traverses a directory tree recursively and explicitly follows symbolic links. The `FileVisitOption.FOLLOW_LINKS` enum constant instructs the walk to follow symbolic links, allowing the traversal to detect files that are themselves symbolic links. Without this option, `Files.walk` treats symbolic links as regular files and does not follow them, which would miss the target of the link.

Answer

Files.newDirectoryStream(Path)

Answer

Files.list(Path)

Answer

Files.walk(Path) without options

Question 12

A developer needs to create a temporary file that will be automatically deleted when the JVM terminates. Which approach correctly achieves this?

Accepted Answer

File.createTempFile("pre", ".txt").deleteOnExit(). `File.createTempFile("pre", ".txt")` creates a temporary file in the default temporary-file directory, and chaining `.deleteOnExit()` registers that file for deletion when the JVM terminates. This combination ensures both the creation of a temporary file and its automatic cleanup upon JVM shutdown, fulfilling the requirement precisely.

Answer

new File("tmp.txt").deleteOnExit()

Answer

Files.createTempDirectory("tmp").toFile().deleteOnExit()

Answer

Files.createTempFile("pre", ".txt")

Question 13

A method receives an InputStream and needs to compute its MD5 hash while reading the data. Which approach is most efficient?

Accepted Answer

Use DigestInputStream wrapping the original stream, then read the stream. `DigestInputStream` is a built-in Java class that computes a message digest (e.g., MD5) on the fly as data is read from the underlying stream. This avoids buffering the entire stream into memory, making it both memory-efficient and CPU-efficient for large or streaming data sources.

Answer

Read all bytes into a byte array, then compute hash using MessageDigest

Answer

Use a custom filter that hashes bytes during read

Answer

Use Scanner to read tokens and update hash

Question 14

A Java application uses SecurityManager with a policy file. Which permission is required to allow the application to read all files in the /var/log directory, including subdirectories?

Accepted Answer

permission java.io.FilePermission "/var/log/-", "read";. The trailing '-' in the path pattern '/var/log/-' is a recursive wildcard that matches all files and subdirectories under /var/log, which is required to read all files in that directory tree. The permission grants 'read' access, which is the only action needed for reading files.

Answer

permission java.io.FilePermission "/var/log", "read";

Answer

permission java.io.FilePermission "/var/log/*", "read,write";

Answer

permission java.io.FilePermission "/var/log/*", "read";