1Z0-829 Java I/O API and Securing Applications Practice Test 3 — 15 Questions

Question 1

Which THREE statements are true about Java NIO.2 and its interaction with blocking I/O? (Choose three.)

Accepted Answer

A Selector can be used to manage multiple non-blocking channels.. Option A is correct because a java.nio.channels.Selector is the multiplexing mechanism designed to register multiple SelectableChannel instances (such as SocketChannel, ServerSocketChannel, and DatagramChannel) in non-blocking mode, allowing one thread to monitor readiness events like OP_READ, OP_WRITE, OP_CONNECT, and OP_ACCEPT. Option B is correct because Files.walk(Path, FileVisitOption...) returns a Stream<Path> that is lazily evaluated, traversing the file tree depth-first on demand as the stream is consumed, and it must be closed (try-with-resources) to release the underlying directory stream. Option E is correct because Paths.get(String first, String... more) is the static factory method that converts a path string or URI components into a Path object, delegating to the default FileSystem's getPath method. Option C is wrong because FileChannel supports both blocking and non-blocking modes depending on how it is obtained and configured; channels from FileChannel.open are blocking, and file channels cannot be registered with a Selector. Option D is wrong in this context because although BufferedInputStream does extend FilterInputStream, that statement concerns classic java.io blocking streams and is unrelated to Java NIO.2, so it is not one of the three true statements about NIO.2 and blocking I/O.

Answer

FileChannel operations are always non-blocking.

Answer

BufferedInputStream extends FilterInputStream.

Question 2

A developer is building a file synchronization tool that runs on multiple threads. Multiple threads may read and write to the same file concurrently. The developer wants to ensure that a thread does not read a file while another thread is writing to it, and that concurrent reads are allowed. Which locking mechanism should be used?

Accepted Answer

Use java.nio.channels.FileLock with shared lock for reading and exclusive lock for writing.. Java.nio.channels.FileLock provides a platform-independent mechanism for locking files, supporting shared locks for concurrent reads and exclusive locks for writes. This ensures that a thread cannot read a file while another thread is writing to it, while allowing multiple threads to read simultaneously, which matches the requirement exactly.

Answer

Use a ReentrantReadWriteLock in Java with the file as a resource.

Answer

Use synchronized blocks on the File object.

Answer

Use a Semaphore with permits equal to the number of threads.

Question 3

A web application allows users to upload profile pictures. The application saves the files to a directory using the original filename provided by the user. After a security review, the team discovered a critical path traversal vulnerability. Which remediation is most effective in preventing exploitation while maintaining usability?

Accepted Answer

Generate a random UUID as the filename and store the original filename in a database.. Generating a random UUID as the filename eliminates the user's control over the file path, making path traversal attacks impossible. The original filename can be stored in a database for display purposes, preserving usability while ensuring the file is saved with a safe, unpredictable name.

Answer

Store the files in a database BLOB instead of the filesystem.

Answer

Sanitize the filename by removing all occurrences of "../" and "/".

Answer

Check that the file extension is allowed (e.g., .jpg, .png) and no special characters.

Question 4

A logging framework in Java has been writing logs to a file using a FileWriter with default buffer size. The logs are frequently lost when the application crashes because the buffer is not flushed. Which change ensures that log messages are written immediately without significantly impacting performance?

Accepted Answer

Use a PrintWriter wrapping a FileWriter and set autoFlush=true.. A PrintWriter wrapping a FileWriter with autoFlush=true ensures that every println, printf, or format call triggers an automatic flush of the underlying stream. This guarantees log messages are written to disk immediately upon each write, preventing data loss during a crash, while still allowing the FileWriter's internal buffer to aggregate small writes for performance. The autoFlush mechanism in PrintWriter is specifically designed for this use case in Java I/O.

Answer

Use a FileWriter with autoFlush=true.

Answer

Set the buffer size to 0 to disable buffering.

Answer

Call flush() after every log message.

Question 5

A developer needs to read a large text file (several gigabytes) line by line as efficiently as possible, processing each line without loading the entire file into memory. Which approach should the developer use?

Accepted Answer

Use Files.lines with a try-with-resources block, and process each line using the stream.. `Files.lines` returns a `Stream<String>` that lazily reads lines from the file, processing them one at a time without loading the entire file into memory. The try-with-resources block ensures the underlying file handle is closed automatically, preventing resource leaks. This approach is specifically designed for efficient, memory-safe line-by-line processing of large files.

Answer

Use a FileReader wrapped in a BufferedReader, and process each line in a loop.

Answer

Use a FileInputStream to read bytes, then manually parse newline characters.

Answer

Use Files.readAllLines to read the entire file into a List<String> and then iterate.

Question 6

A class that stores sensitive user data implements Serializable. To minimize security exposure from deserialization attacks, which modification is the best practice?

Accepted Answer

Declare the sensitive fields as transient.. Declaring sensitive fields as transient prevents them from being serialized, so they are not written to the stream and cannot be deserialized. This directly eliminates the attack surface for deserialization exploits targeting those fields, as the default serialization mechanism skips transient fields entirely.

Answer

Override writeObject to manually exclude the sensitive fields.

Answer

Implement Externalizable and override readExternal and writeExternal.

Answer

Remove the implements Serializable clause from the class declaration.

Question 7

Which TWO are secure coding practices for Java I/O that help prevent resource leaks and unauthorized access? (Choose two.)

Accepted Answer

Mark sensitive fields in a Serializable class as transient to prevent serialization.. Option A is correct because marking sensitive fields as transient in a Serializable class excludes them from the default serialization process, preventing confidential data such as passwords or keys from being written to the byte stream and later exposed or tampered with. Option D is correct because try-with-resources (introduced in Java 7) automatically invokes close() on any AutoCloseable resource such as InputStream, OutputStream, Reader, or Writer, even when exceptions are thrown, which prevents file-descriptor and memory leaks. Option B is not a secure practice: Scanner is a convenience parser, not a security control, and BufferedReader is equally capable of reading untrusted input safely when used with proper validation and encoding. Option C is a performance recommendation, not a security or resource-leak mitigation, and BufferedReader alone does not guarantee closure. Option E describes a deployment-time sandboxing mechanism (SecurityManager/Policy FilePermission) rather than a secure coding practice in the Java I/O code itself, and it does not address resource leaks.

Answer

Use Scanner instead of BufferedReader when reading untrusted input.

Answer

Always use BufferedReader for reading text files to improve performance.

Answer

Grant FilePermission in the security policy to restrict file access for untrusted code.

Question 8

A developer is building a batch processing application that reads a large CSV file (approx. 5 GB) from a network file system, transforms each row, and writes the result to a database. The initial implementation uses Files.lines(path) to obtain a Stream<String>, processes each line with forEach, and then does not explicitly close the stream. After running for several minutes, the application slows down, and eventually throws an IOException: 'Too many open files'. The database writes are also failing intermittently. The developer needs to fix the application. The environment is Java 17 on Linux with default settings. Which course of action best resolves the issues?

Accepted Answer

Wrap the Files.lines call in a try-with-resources block to ensure the stream is closed automatically.. `Files.lines(path)` returns a lazily populated `Stream<String>` that holds a file handle open. Without an explicit close, the underlying `FileChannel` and file descriptor are not released, leading to 'Too many open files' after processing many lines. Wrapping the stream in a try-with-resources block ensures `close()` is called automatically, releasing the file descriptor and preventing resource exhaustion.

Answer

Use FileInputStream with a buffered byte array and manually scan for newline characters.

Answer

Replace Files.lines with Files.newBufferedReader, wrapping it in a try-with-resources block.

Answer

Use Files.readAllLines to load the entire file into memory and then iterate over the list.

Question 9

A developer is writing a utility that reads a configuration file from the classpath. The file is expected to be UTF-8 encoded. Which code snippet correctly reads all lines from the file into a List<String> while ensuring the file is closed automatically?

Accepted Answer

try (var reader = new BufferedReader(new InputStreamReader(getClass().getResourceAsStream("config.txt"), StandardCharsets.UTF_8))) { return reader.lines().collect(Collectors.toList()); }. Reading a classpath resource requires using getResourceAsStream or getResource, not direct file paths. The correct approach wraps the stream in a BufferedReader with UTF-8 encoding and uses try-with-resources to guarantee closure. The lines() method provides a stream of lines, which can be collected into a List. This ensures proper resource management and correct character decoding.

Answer

try (var scanner = new Scanner(new File("config.txt"), StandardCharsets.UTF_8)) { return scanner.findAll(".*").map(MatchResult::group).collect(Collectors.toList()); }

Answer

List<String> lines = Files.readAllLines(Paths.get("config.txt"), StandardCharsets.UTF_8);

Answer

List<String> lines = Files.readAllLines(Paths.get(getClass().getResource("config.txt").toURI()), StandardCharsets.UTF_8);

Question 10

A Java 17 application running on Linux must read a configuration file located at /etc/app/config.properties. The application is launched by a service account with limited permissions. The developer wants to ensure the application can read the file but cannot write or execute it. Which set of POSIX file permissions should be set on the file to achieve this?

Accepted Answer

r--------. The application needs read-only access for the service account while preventing write and execute. Setting permissions to r-------- restricts access to the owner only, which should be the service account. This ensures the application can read the file but cannot modify or execute it, following the principle of least privilege.

Answer

rw-r-----

Answer

r--r--r--

Answer

r-x------

Question 11

A Java application running on a Linux server needs to read user-supplied text files from an untrusted directory. The security team requires that symbolic links in that directory are never followed when opening files for reading, to prevent access to sensitive files outside the directory. Which java.nio.file API combination best enforces this requirement?

Accepted Answer

Use Files.newInputStream with LinkOption.NOFOLLOW_LINKS as the first argument.. Files.newInputStream accepts OpenOption values, and LinkOption.NOFOLLOW_LINKS implements OpenOption, so it can be passed directly to open a file without following symbolic links. The check happens atomically during the open operation, avoiding the race condition inherent in checking attributes first. Other methods either do not accept LinkOption or are not designed for this use, making them unsuitable for the stated security policy.

Answer

Call Files.readAttributes with LinkOption.NOFOLLOW_LINKS to detect symlinks, then open with Files.newBufferedReader.

Answer

Use Files.readAllLines with LinkOption.NOFOLLOW_LINKS passed for each read.

Answer

Use Files.newByteChannel with StandardOpenOption.READ and LinkOption.NOFOLLOW_LINKS, then wrap it in a Reader.

Question 12

A Java SE 17 application uses a module named com.example.reader that reads a configuration file located at /etc/app/config.properties. The module is deployed as a modular JAR and launched with a module path. The file is outside the module and not in any directory listed in the module path. The developer wants the module to be allowed to read this specific file without granting broad file system permissions. Which approach should be used?

Accepted Answer

Use a policy file that grants FilePermission for the specific file path to the module's code source.. In Java SE 17, file system access for modules is controlled by the security policy when a SecurityManager is active. To allow a specific module to read a particular file, a policy file must grant FilePermission with the exact file path and 'read' action to that module's code source. This least-privilege approach avoids granting broad file permissions. The other options incorrectly involve module descriptors, deprecated SecurityManager APIs, or file open options that do not affect permissions.

Answer

Add a permission entry in the module's module-info.java using the 'permits' clause to allow reading /etc/app/config.properties.

Answer

Call System.setSecurityManager with a custom SecurityManager that overrides checkRead to allow the path.

Answer

Open the file using Files.newByteChannel with a FileAttribute view that includes a permission flag.

Question 13

A Java application running with a security manager needs to read a file located at /data/config.properties. The policy file grants read permission to /data/-. Which code snippet will successfully read the file?

Accepted Answer

Files.readAllLines(Paths.get("/data/config.properties")). With a security manager, file access requires appropriate permissions. The policy grants read access to /data/-, allowing all files under /data. The Files.readAllLines method performs a read operation that is permitted. Other options either use APIs that require additional steps to read content or are less direct. The NIO Files class is the standard for modern file I/O and correctly respects security policies.

Answer

new RandomAccessFile("/data/config.properties", "r")

Answer

new FileInputStream("/data/config.properties")

Answer

Files.newByteChannel(Paths.get("/data/config.properties"), StandardOpenOption.READ)

Question 14

A developer is implementing a custom deserialization filter to prevent deserialization attacks in a Java 17 application. The application receives serialized objects from a trusted internal service but must also accept objects from a less trusted partner service. The developer wants to allow classes only from the com.trusted and com.partner packages, and reject all others. Which code snippet correctly creates and applies such a filter?

Accepted Answer

ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("com.trusted.*;com.partner.*;!*");. The correct filter must allow classes from com.trusted and com.partner while rejecting all others. The pattern string uses semicolons to separate patterns, and the !* pattern rejects any class not previously matched. Thus, the filter with com.trusted.*;com.partner.*;!* achieves the desired security policy.

Answer

ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("com.trusted.*;com.partner.*");

Answer

ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("com.trusted.*,com.partner.*");

Answer

ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("!com.trusted.*;!com.partner.*;*");

Question 15

A developer needs to write a Java 17 application that reads a large file from a network file system. The file is accessed concurrently by multiple threads, and the developer wants to ensure that each thread reads a consistent view of the file. Which approach should be used to open the file?

Accepted Answer

Use Files.newInputStream with StandardOpenOption.READ and acquire a shared lock using FileChannel.lock(0, Long.MAX_VALUE, true).. To ensure a consistent view of a file accessed by multiple threads, a shared lock must be acquired. A shared lock allows multiple readers but prevents writers. Using Files.newInputStream with a FileChannel and acquiring a shared lock via FileChannel.lock(0, Long.MAX_VALUE, true) provides this coordination.

Answer

Use Files.newByteChannel with StandardOpenOption.READ and StandardOpenOption.SYNC.

Answer

Use Files.newBufferedReader with StandardCharsets.UTF_8 and rely on the operating system's file caching.

Answer

Use FileChannel.open with StandardOpenOption.READ and then call FileChannel.map to create a read-only memory-mapped buffer.