1Z0-829 Java I/O API and Securing Applications Practice Test 4 — 15 Questions

Question 1

A developer is implementing a custom deserialization filter to prevent attacks. Which two actions are required to properly implement and register a deserialization filter using the ObjectInputFilter interface? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Register the filter using ObjectInputFilter.Config.setSerialFilter on the ObjectInputStream instance.. Implementing a deserialization filter requires creating a class that implements ObjectInputFilter and overriding checkInput to enforce security policies. Then, the filter must be registered on the ObjectInputStream instance using setObjectInputFilter, or globally via ObjectInputFilter.Config.setSerialFilter. These two steps ensure the filter is active and validated during deserialization.

Answer

Implement the filter as a lambda expression that returns Status.REJECTED for all classes to block everything.

Answer

Override the readObject method in the class being deserialized to call the filter manually.

Answer

Use the @Serial annotation on the filter class to indicate it is a deserialization filter.

Question 2

A developer is using the java.nio.file API to copy a file from /source/data.txt to /target/data.txt. The target file exists and the developer wants to replace it atomically. The file system supports atomic moves. Which code snippet correctly achieves this?

Accepted Answer

Files.move(Path.of("/source/data.txt"), Path.of("/target/data.txt"), StandardCopyOption.REPLACE_EXISTING);. To atomically replace an existing target file with a source file, you should use Files.move with both StandardCopyOption.REPLACE_EXISTING and StandardCopyOption.ATOMIC_MOVE. The ATOMIC_MOVE option ensures the move is atomic if supported by the file system, and REPLACE_EXISTING allows overwriting the target. Using copy does not support atomic move, and using move without REPLACE_EXISTING fails if the target exists. Therefore, the correct snippet includes both options in Files.move.

Answer

Files.copy(Path.of("/source/data.txt"), Path.of("/target/data.txt"), StandardCopyOption.REPLACE_EXISTING);

Answer

Files.move(Path.of("/source/data.txt"), Path.of("/target/data.txt"), StandardCopyOption.ATOMIC_MOVE);

Answer

Files.copy(Path.of("/source/data.txt"), Path.of("/target/data.txt"), StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);

Question 3

A developer is tasked with reading a large binary file (1 GB) from a network share using the least amount of memory possible. Which approach should be used?

Accepted Answer

Use a FileInputStream wrapped in a BufferedInputStream with a 8 KB buffer. Using a FileInputStream wrapped in a BufferedInputStream with a small buffer (e.g., 8 KB) allows reading the file in chunks without loading the entire 1 GB into memory. This approach minimizes heap usage by processing data incrementally, which is essential for large binary files over a network share where memory constraints are critical.

Answer

Read the entire file into a byte array using Files.readAllBytes()

Answer

Use a FileReader wrapped in a BufferedReader to read lines

Answer

Use a RandomAccessFile to read the file in segments

Question 4

An application must read a configuration file that is updated frequently by another process. The developer wants to avoid stale data and minimize I/O operations. Which approach is best?

Accepted Answer

Use java.nio.file.WatchService to monitor the file for modifications and reload when notified. Java.nio.file.WatchService provides an event-driven mechanism to monitor file system changes, such as modifications to a configuration file. This approach avoids stale data by reloading the file only when a change is detected, and it minimizes I/O operations by eliminating the need for polling or repeated reads. The WatchService uses the underlying OS file system events (e.g., inotify on Linux, ReadDirectoryChanges on Windows) for efficient notification.

Answer

Read the file from disk every time it is accessed using Files.newInputStream()

Answer

Periodically check the file's lastModified timestamp using File.lastModified() and reload if changed

Answer

Read the file once at startup and cache the content in memory

Question 5

A developer needs to write text to a file with UTF-8 encoding. Which class should be used?

Accepted Answer

new OutputStreamWriter(new FileOutputStream(file), StandardCharsets.UTF_8). It explicitly constructs an OutputStreamWriter with a FileOutputStream and StandardCharsets.UTF_8, ensuring the text is written with UTF-8 encoding. This is the standard approach when you need precise control over the character encoding, as the OutputStreamWriter acts as a bridge from byte streams to character streams using the specified charset.

Answer

BufferedWriter

Answer

FileWriter

Answer

PrintWriter with default constructor

Question 6

A developer is designing a service that processes multiple files concurrently. To avoid resource leaks, which practice is essential?

Accepted Answer

Use try-with-resources for each AutoCloseable resource. Try-with-resources guarantees that each AutoCloseable resource is closed automatically at the end of the statement, even if an exception occurs. This is essential when processing multiple files concurrently, as it prevents resource leaks without requiring explicit close() calls in finally blocks.

Answer

Ensure each thread has its own copy of the file handle

Answer

Call close() on each stream in a separate try-catch block

Answer

Use FileLock to prevent concurrent access

Question 7

Which statement about java.io and java.nio.file packages is true?

Accepted Answer

The java.nio.file package provides support for symbolic links and file attributes. The java.nio.file package (part of NIO.2) explicitly provides support for symbolic links via methods like Files.createSymbolicLink() and Files.isSymbolicLink(), and it offers comprehensive file attribute access through classes like BasicFileAttributes, DosFileAttributes, and PosixFileAttributes, which are not available in java.io.

Answer

Classes in java.nio.file are thread-safe by default

Answer

The java.io package includes the Path interface

Answer

The java.nio.file package is deprecated in favor of java.io

Question 8

A developer needs to copy a large directory tree from one location to another, preserving file attributes. Which method should be used?

Accepted Answer

Implement a FileVisitor using Files.walkFileTree and copy each file with COPY_ATTRIBUTES. `Files.walkFileTree` with a custom `FileVisitor` allows you to recursively traverse a directory tree and copy each file individually using `Files.copy` with `StandardCopyOption.COPY_ATTRIBUTES`. This is necessary because `Files.copy` on a directory does not copy the directory tree recursively; it only copies the top-level directory entry. The `FileVisitor` pattern ensures that subdirectories and files are visited and copied in depth-first order, preserving file attributes at each step.

Answer

Files.copy(source, target, StandardCopyOption.COPY_ATTRIBUTES)

Answer

Use Files.walk() and then Files.copy() for each entry

Answer

Use FileUtils.copyDirectory from Apache Commons IO

Question 9

Which THREE are valid ways to read the contents of a text file into a String in Java?

Accepted Answer

String content = Files.readString(Path.of("file.txt"));. `Files.readString()` (introduced in Java 11) reads the entire content of a text file into a `String` in one call, handling charset encoding (default UTF-8) and closing the file automatically. It is the simplest and most direct method for this task.

Answer

String content = new FileReader("file.txt").readString();

Answer

String content = Files.readAllLines(Path.of("file.txt"));

Question 10

Which THREE are benefits of using the NIO.2 API over the java.io API?

Accepted Answer

Simplified recursive file operations using FileVisitor.. The NIO.2 API introduces the `FileVisitor` interface, which simplifies recursive file operations by allowing you to implement methods like `preVisitDirectory`, `visitFile`, and `visitFileFailed` that are automatically called during a tree walk. This eliminates the need for manual recursion and boilerplate code required in the `java.io` API, making directory traversal more efficient and less error-prone.

Answer

Better performance for all I/O operations compared to java.io.

Answer

Automatic file compression when writing.

Question 11

A financial trading application processes real-time stock data from multiple exchanges. The application reads large binary files (each up to 500 MB) containing trade records, processes them, and writes summary reports to a shared network drive. The development team observes that the application occasionally throws a java.io.IOException: 'The process cannot access the file because it is being used by another process' when writing reports. The application is multi-threaded, and each thread writes to a separate file in the same directory. The team also notices that the application slows down significantly when the network drive is under heavy load. The application runs on Windows servers with Java 17. The code uses FileOutputStream for writing and does not explicitly close streams in some paths. Which course of action should the team take to resolve the issues and improve performance?

Accepted Answer

Switch to using try-with-resources for all FileOutputStream instances and wrap them in BufferedOutputStream with a larger buffer.. The primary issue is resource leaks from not closing FileOutputStream instances, which can cause file locking conflicts on Windows when multiple threads write to separate files in the same directory. Using try-with-resources ensures streams are closed reliably, eliminating the 'file in use' IOException. Wrapping with BufferedOutputStream and a larger buffer reduces the number of write operations to the network drive, mitigating slowdowns under heavy load by batching data and minimizing latency.

Answer

Increase the thread pool size to handle more concurrent writes.

Answer

Use FileChannel with FileLock to synchronize access.

Answer

Write to local temporary files and then copy to the network drive.

Question 12

Which TWO statements about Java serialization are true?

Accepted Answer

During deserialization, the constructor of the serialized class is not invoked.. Option B is correct because Java deserialization reconstructs objects from the byte stream by allocating the object via the JVM without calling any constructor of the serializable class (constructors of non-serializable superclasses are invoked, but the class's own constructor is not). Option D is correct because serialization captures the state of an object's instance fields, and static fields belong to the class rather than to any instance, so they are never written to the stream. Option A is wrong because serialVersionUID is optional; if not declared, the JVM computes one automatically from the class structure, though explicit declaration is recommended. Option C is wrong because Externalizable extends Serializable, so an Externalizable class is already Serializable and must implement writeExternal and readExternal. Option E is wrong because transient fields are explicitly excluded from serialization and are restored to their default values (e.g., null, 0, false) after deserialization.

Answer

The serialVersionUID must be explicitly declared in every serializable class.

Answer

A class that implements Externalizable does not need to implement Serializable.

Answer

Fields marked as transient are serialized by default.

Question 13

You are developing a Java application that processes sensitive user data. The application runs on a server with strict security policies. You need to read configuration properties from a file located at /etc/app/config.properties. The application uses a SecurityManager. During testing, you get a security exception: java.security.AccessControlException: access denied (java.io.FilePermission /etc/app/config.properties read). You have already added a file permission grant in the policy file for the application codebase. However, the exception persists. What is the most likely cause?

Accepted Answer

A library or caller on the execution stack does not have the required FilePermission.. Even if the application's own codebase has the required FilePermission, any library or caller on the execution stack that does not have the permission will cause an AccessControlException. The SecurityManager performs stack inspection: every class on the call stack must have the required permission. If a library or framework method invoked by your code lacks the grant, the check fails.

Answer

The application codebase URL in the policy file is incorrect.

Answer

The file path is relative and needs to be resolved against user.dir.

Answer

The policy file is not being loaded because the JVM was not started with -Djava.security.policy.

Question 14

A Java application running on a server reads configuration from a file 'config.properties' located in the same directory as the JAR. The application uses java.util.Properties.load(InputStream) to read the file. Recently, the file was modified by an unauthorized user, and the application started throwing runtime exceptions due to corrupted property values. The security team requires that the file be protected from unauthorized modifications while still being readable by the application. Which action should be taken to ensure the integrity of the configuration file?

Accepted Answer

Digitally sign the file and verify the signature before loading properties.. Digital signing provides both integrity and authenticity. By signing the file with a private key and verifying the signature with a public key before calling Properties.load(InputStream), the application can detect any unauthorized modification. This directly addresses the security requirement without relying on encryption (which protects confidentiality, not integrity) or file permissions (which can be bypassed by a privileged attacker).

Answer

Encrypt the file using AES and decrypt it in the application.

Answer

Set the file permissions to read-only for the application user.

Answer

Store the file in a ZIP archive with a checksum.

Question 15

A company uses serialization to transfer objects between microservices. To prevent deserialization attacks, they want to restrict which classes can be deserialized. Which approach should be used in Java 17?

Accepted Answer

Use ObjectInputFilter with a custom filter. Java 17 provides the `ObjectInputFilter` API (introduced in Java 9) as the standard mechanism to restrict which classes can be deserialized. By setting a custom filter via `ObjectInputStream.setObjectInputFilter()` or a system-wide `jdk.serialFilter` property, you can whitelist or blacklist classes based on patterns, effectively preventing deserialization attacks without modifying the serialization stream itself.

Answer

Override resolveClass in ObjectInputStream

Answer

Use SecurityManager with a policy file

Answer

Implement Externalizable and control fields