1Z0-829 Java I/O API and Securing Applications Practice Test 3 — 15 Questions

Question 1

A serialized object has an explicitly declared serialVersionUID of 123L. After a code change, a new field is added to the class but the serialVersionUID is left unchanged. What happens when deserializing an old stream?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deserialization succeeds and the new field is set to its default value.. When a serialized object has an unchanged serialVersionUID, the Java deserialization mechanism treats the class as compatible. The new field is not present in the old stream, so it is simply initialized to its default value (e.g., null for objects, 0 for primitives) without throwing an exception. This behavior is defined by the Java Object Serialization Specification, which allows forward compatibility as long as the serialVersionUID matches.

Answer

Deserialization succeeds only if the new field is marked transient.

Answer

Deserialization throws StreamCorruptedException due to missing field.

Answer

Deserialization throws InvalidClassException because the class definition has changed.

Question 2

Which two of the following are valid methods to create a new directory using the NIO.2 Files class? (Select two.)

Accepted Answer

Files.createDirectory(Path). The Files class in the java.nio.file package provides two static methods for creating directories: createDirectory(Path) creates a single directory, failing if the parent does not exist or if the directory already exists; createDirectories(Path) creates the directory and any nonexistent parent directories, succeeding silently if the target already exists. Both are valid and commonly used for NIO.2 directory creation.

Answer

Files.mkdir(Path)

Answer

Files.createNewDirectory(Path)

Answer

Files.makeDirectory(Path)

Question 3

Which two statements are true about FileInputStream? (Select two.)

Accepted Answer

It extends java.io.InputStream.. FileInputStream directly extends java.io.InputStream, inheriting its abstract methods for reading bytes from a file. Option C is correct because FileInputStream implements java.io.Closeable, which extends AutoCloseable, allowing it to be used in try-with-resources statements for automatic resource management.

Answer

It supports mark() and reset().

Answer

It reads data in big-endian order.

Answer

It can be used to read characters.

Question 4

Which three actions help secure a Java application that uses serialization? (Select three.)

Accepted Answer

Overriding resolveClass() in ObjectInputStream to validate class names.. Overriding `resolveClass()` in `ObjectInputStream` allows you to validate the class name before it is deserialized. This prevents deserialization attacks where an attacker sends a malicious class that could execute arbitrary code. By checking the class name against a whitelist, you can block untrusted classes from being loaded.

Answer

Using SecureRandom to generate serialVersionUID.

Answer

Declaring serialVersionUID explicitly as a long constant.

Question 5

Refer to the exhibit. Assuming the application is running from /home/application/lib/myapp.jar, which of the following actions is allowed by the policy?

Accepted Answer

All of the above. The policy grants all permissions (java.security.AllPermission) to the codebase file:/home/application/lib/myapp.jar, which means any action—including writing to /var/log/app.log, queuing a print job, and reading /etc/config/application.properties—is allowed. The AllPermission permission effectively disables all security checks for that code source, so all three listed actions are permitted.

Answer

Write to the file /var/log/app.log

Answer

Queue a print job using the system printer

Answer

Read the file /etc/config/application.properties

Question 6

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The class definition has changed and the serialVersionUID is not explicitly defined.. When a class definition changes (e.g., adding/removing fields) and the class does not explicitly declare a `serialVersionUID`, the JVM computes one automatically based on the class structure. After deserialization, if the computed UID differs from the UID stored in the serialized stream, an `InvalidClassException` is thrown. This is the most common cause of deserialization failures in practice.

Answer

The serialized object is corrupted.

Answer

The JVM versions are incompatible.

Answer

The file contains data that is not a serialized object.

Question 7

Refer to the exhibit. What is the purpose of this code?

Accepted Answer

Encrypt data.txt and write to data.enc. The code uses a CipherOutputStream with a cipher initialized in ENCRYPT_MODE, reading from data.txt and writing to data.enc, thus encrypting the plaintext file and producing an encrypted output file. This is the standard pattern for file encryption in Java using the JCA (Java Cryptography Architecture).

Answer

Compress data.txt and write to data.enc

Answer

Encrypt data.enc and write to data.txt

Answer

Decrypt data.txt and write to data.enc

Question 8

A developer needs to read a very large text file (over 1 GB) efficiently with minimal memory overhead. Which approach is most suitable?

Accepted Answer

Use FileChannel with a ByteBuffer to read in chunks.. FileChannel with a ByteBuffer allows reading a large file in configurable chunks, leveraging the operating system's native I/O for high throughput and minimal memory overhead. This approach avoids loading the entire file into memory and reduces context switching compared to stream-based readers.

Answer

Use Scanner to read tokens.

Answer

Use BufferedReader to read lines.

Answer

Use FileInputStream and read byte by byte.

Question 9

A class implements Serializable but the developer wants to completely prevent deserialization of its instances. Which approach accomplishes this?

Accepted Answer

Override readObject() to throw an InvalidClassException.. Overriding readObject() to throw an InvalidClassException (or any exception) prevents the deserialization mechanism from completing. When an ObjectInputStream calls readObject() on a class that defines its own readObject() method, that custom method is invoked instead of the default deserialization. Throwing an exception inside readObject() aborts the deserialization process, effectively blocking the reconstruction of the instance.

Answer

Override readResolve() to return a null.

Answer

Override writeObject() to encrypt the object.

Answer

Override writeReplace() to throw an exception.

Question 10

Which class is best suited for reading integer tokens from a string containing space-separated integers?

Accepted Answer

Scanner. Scanner is best suited because it provides built-in methods like nextInt() that can parse space-separated integer tokens directly from a string, handling whitespace delimiters automatically. It is designed for parsing formatted input, making it the ideal choice for this task.

Answer

InputStreamReader

Answer

BufferedReader

Answer

DataInputStream

Question 11

A web server application writes access logs to a file. To ensure that log entries are written to disk immediately even if the JVM crashes, which approach is most appropriate?

Accepted Answer

Use FileOutputStream and call flush() after each write.. FileOutputStream provides direct, unbuffered writes to the underlying file descriptor. While calling flush() does not force an immediate disk write (that requires sync() or FileChannel.force()), the unbuffered nature means data is passed to the operating system without intermediate caching in the JVM. Among the given options, this minimizes data loss risk because there is no JVM-level buffer that could hold unwritten data. Options B and C use buffering, which can delay writes, and D also uses an internal buffer. Note: For true guaranteed synchronous disk writes, additional system calls like FileDescriptor.sync() or FileChannel.force() are required.

Answer

Use BufferedWriter and call write() then flush() periodically.

Answer

Use PrintWriter with autoFlush enabled.

Answer

Use FileWriter without any buffering.

Question 12

A Java application needs to refer to a file using the path "data/input.txt". To ensure platform independence (correct file separator), which approach is recommended?

Accepted Answer

Paths.get("data", "input.txt"). `Paths.get("data", "input.txt")` uses the default file system's path separator, ensuring platform independence. This method internally calls `FileSystems.getDefault().getPath()` to construct the path with the correct separator for the operating system (e.g., '/' on Linux/macOS, '\' on Windows).

Answer

FileSystems.getDefault().getPath("data", "input.txt")

Answer

new File("data/input.txt").toPath().normalize()

Answer

new File("data/input.txt").toPath()

Question 13

A developer wants to copy all files from one directory to another, preserving file attributes (e.g., last modified time, permissions). Which NIO.2 method is most appropriate?

Accepted Answer

Files.copy(source, target, COPY_ATTRIBUTES). The `Files.copy(source, target, COPY_ATTRIBUTES)` method from the NIO.2 API copies the content of the file and, when the `COPY_ATTRIBUTES` option is specified, also preserves the file's metadata attributes such as last modified time, last access time, and permissions (where supported by the underlying file system). This option is specifically designed for copying with attribute preservation, making it the most appropriate choice for the developer's requirement.

Answer

Files.copy(source, target, REPLACE_EXISTING)

Answer

Files.move(source, target, ATOMIC_MOVE)

Answer

Files.walkFileTree() with a custom FileVisitor that copies files

Question 14

Which interface is designed for recursively walking a file tree?

Accepted Answer

FileVisitor [CORRECT]. The `FileVisitor` interface is designed for recursively walking a file tree, as it provides callback methods (`preVisitDirectory`, `postVisitDirectory`, `visitFile`, `visitFileFailed`) that are invoked during a depth-first traversal of a file tree, typically used with `Files.walkFileTree()`. This allows you to process each file and directory in the tree, including subdirectories, making it the correct choice for recursive file tree walking.

Answer

DirectoryStream [wrong]

Answer

FilenameFilter [wrong]

Answer

FileFilter [wrong]

Question 15

To generate a cryptographically secure random number for a key generation algorithm, which class should be used?

Accepted Answer

SecureRandom. D is correct because `SecureRandom` is specifically designed to produce cryptographically strong random numbers suitable for key generation, using algorithms like SHA1PRNG or NativePRNG that meet FIPS 140-2 standards. Unlike other random number generators, it ensures unpredictability and resistance to reverse engineering, which is critical for security-sensitive operations.

Answer

ThreadLocalRandom

Answer

Math.random()

Answer

Random