1Z0-829 Java I/O API and Securing Applications Practice Test 4 — 15 Questions

Question 1

In a JAAS login module, after the login() method returns true, which method must be called to commit the authentication and add principals to the Subject?

Accepted Answer

commit(). In a JAAS login module, after the `login()` method returns `true`, the `commit()` method must be called to associate the authenticated principals and credentials with the `Subject`. The `commit()` method is responsible for adding the successfully authenticated principals to the Subject, making them available for subsequent authorization checks. This is part of the two-phase authentication protocol defined by the `javax.security.auth.spi.LoginModule` interface.

Answer

login()

Answer

initialize()

Answer

abort()

Question 2

Which TWO statements are true regarding reading files with the NIO.2 API?

Accepted Answer

Files.newBufferedReader() provides buffered character input.. `Files.newBufferedReader()` returns a `BufferedReader` that wraps a `FileReader` (or underlying `FileChannel`), providing efficient buffered character input. This method is designed for reading text files line-by-line with reduced I/O operations, making it suitable for large or stream-oriented text processing.

Answer

Files.readAllLines() is memory efficient for large files.

Answer

Files.newInputStream() wraps a FileChannel for high performance.

Answer

Files.readAllBytes() is the best choice for large binary files.

Question 3

Which THREE are recommended practices to prevent privilege escalation when using doPrivileged in a security-sensitive Java application?

Accepted Answer

Restrict the codebase URLs in policy files to only trusted code locations.. Restricting codebase URLs in policy files to only trusted code locations limits the sources from which privileged code can be loaded. This prevents an attacker from injecting malicious code from an untrusted URL that could otherwise be granted elevated permissions via doPrivileged. By narrowing the codebase, you reduce the attack surface for privilege escalation attacks.

Answer

Use SubjectDomainCombiner to merge multiple protection domains.

Answer

Always use a SecurityManager to enforce the policy.

Question 4

Which TWO practices improve the security of Java serialization?

Accepted Answer

Mark sensitive fields as transient to exclude them from serialization.. Marking sensitive fields as transient prevents them from being serialized, ensuring that confidential data (e.g., passwords, cryptographic keys) is not exposed through the serialized stream. Option D is correct because implementing readObject() allows you to validate and sanitize deserialized fields, protecting against deserialization attacks where crafted data could corrupt the object state or trigger malicious behavior.

Answer

Disable serialization by throwing NotSerializableException from writeObject().

Answer

Set a random serialVersionUID to prevent malicious serialization.

Answer

Use Externalizable for full control over serialization format.

Question 5

Refer to the exhibit. Which algorithm was used to generate the certificate fingerprint shown?

Accepted Answer

MD5. The certificate fingerprint shown is a 32-character hexadecimal string, which corresponds to a 128-bit hash. MD5 produces a 128-bit (16-byte) hash, displayed as 32 hex digits. This matches the fingerprint format exactly, confirming that MD5 was used.

Answer

SHA-1

Answer

SHA-384

Answer

SHA-256

Question 6

Refer to the exhibit. Which of the following best describes the effective permissions granted to the application?

Accepted Answer

The application can read and write files under /data/ and connect to any socket.. The exhibit shows a Java security policy granting the application `java.net.SocketPermission` with `connect,resolve` actions and `java.io.FilePermission` with `read,write` actions on `/data/-`. This means the application can connect to any socket (since the target name is `*`) and read/write any file under `/data/`. Option B correctly captures both permissions.

Answer

The application can connect to any network socket.

Answer

The application can only read files under /data/ and connect to sockets.

Answer

The application can read and write any file under /data/.

Question 7

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The file contains non-object data (e.g., text) instead of a serialized Java object.. A `java.io.StreamCorruptedException` with the message 'invalid stream header: 546F6D' indicates that the input stream does not begin with the expected magic number `0xACED` (the standard Java serialization stream header). The hex value `546F6D` corresponds to the ASCII string 'Tom', which is plain text, not serialized object data. This occurs when a file containing non-object data (e.g., text) is read by `ObjectInputStream`.

Answer

The serialized object was tampered with after serialization.

Answer

The serial version UIDs of the class and stream do not match.

Answer

The stream's magic number is wrong due to a network error.

Question 8

A company needs to read a large text file (over 2 GB) line by line in a Java application while minimizing memory footprint. Which approach is most efficient?

Accepted Answer

Use Files.lines(path) with try-with-resources. `Files.lines(path)` returns a `Stream<String>` that lazily reads lines from the file, processing them one at a time without loading the entire file into memory. Combined with try-with-resources, the underlying `BufferedReader` is automatically closed, ensuring efficient resource management even for files over 2 GB.

Answer

Use Files.readAllLines(path)

Answer

Use FileOutputStream with read() loop

Answer

Use Scanner with File and loop hasNextLine()

Question 9

An application deserializes objects from a network stream. To protect against deserialization attacks, which approach is most effective in Java 17?

Accepted Answer

Set an ObjectInputFilter on the ObjectInputStream. Setting an ObjectInputFilter on the ObjectInputStream allows you to define a filter that can reject deserialization of arbitrary or malicious classes, which is the primary defense against deserialization attacks. This mechanism, introduced in Java 9 and enhanced in later versions, lets you whitelist or blacklist classes based on patterns, limits on array sizes, or depth of object graphs, directly mitigating the risk of remote code execution or denial-of-service via crafted serialized data.

Answer

Declare all fields as transient

Answer

Use try-with-resources to auto-close the stream

Answer

Mark the class as final

Question 10

Which of the following correctly uses try-with-resources to ensure a FileInputStream is closed after use?

Accepted Answer

try (FileInputStream fis = new FileInputStream("file.txt")) { ... }. It uses the try-with-resources syntax (try (resource declaration) { ... }), which automatically closes the FileInputStream when the block exits, regardless of exceptions. This ensures the resource is closed without requiring an explicit finally block, as mandated by the AutoCloseable interface.

Answer

FileInputStream fis = new FileInputStream("file.txt"); try { ... } finally { fis.close(); }

Answer

try { FileInputStream fis = new FileInputStream("file.txt"); ... } finally { fis.close(); }

Answer

try (fis = new FileInputStream("file.txt")) { ... }

Question 11

Which THREE statements about the SecurityManager and security policies in Java 17 are true? (Choose three.)

Accepted Answer

The SecurityManager class is deprecated in Java 17.. The SecurityManager class is deprecated for removal in Java 17 (JEP 411). This deprecation means that while the class still exists for compatibility, it is no longer recommended for use and may be removed in a future release. The core reasoning is that the SecurityManager architecture is considered legacy and difficult to maintain, so Oracle has deprecated it to encourage developers to adopt alternative security mechanisms.

Answer

System.setProperty("java.security.policy", "policy.url") loads a new policy.

Answer

By default, Java 17 applications run with a SecurityManager installed.

Question 12

Which is the best practice for securing a Java application that reads sensitive configuration files?

Accepted Answer

Restrict access to the file using operating system permissions.. Restricting access to sensitive files using operating system permissions is a fundamental security practice that applies regardless of the Java version. In Java 17, the Security Manager is deprecated for removal (JEP 411), so relying on a Java security policy file (Option B) is no longer considered a best practice. OS-level permissions provide a robust, platform-native access control that does not depend on deprecated features. Options C and D are insufficient: making a file read-only does not prevent unauthorized access, and storing credentials in source code is highly insecure.

Answer

Define a Java security policy file with FilePermission for the configuration file.

Answer

Make the file read-only at the OS level.

Answer

Store credentials in the source code and use encryption.

Question 13

Refer to the exhibit. A developer runs a keytool command and sees the output above. Which command produced this output?

Accepted Answer

keytool -list -v -alias mykey -keystore keystore.jks. The `keytool -list -v -alias mykey -keystore keystore.jks` command displays detailed certificate information (including owner, issuer, serial number, validity, and fingerprint) for the specified alias in the JKS keystore. The `-v` flag produces verbose output, which matches the exhibit's detailed certificate listing.

Answer

keytool -exportcert -alias mykey -keystore keystore.jks -file cert.cer

Answer

keytool -importcert -alias mykey -keystore keystore.jks -file cert.cer

Answer

keytool -printcert -file cert.cer

Question 14

Refer to the exhibit. A security policy file is configured as shown. The application in app.jar tries to read a file named "${user.home}/data/db.properties". What is the result?

Accepted Answer

Access is allowed because app.jar has AllPermission.. The security policy grants AllPermission to app.jar, which supersedes any specific file permissions. AllPermission implies every possible permission, including read access to any file, regardless of path restrictions. Therefore, the application can read '${user.home}/data/db.properties' without denial.

Answer

Access is denied because the FilePermission for data files is missing.

Answer

Access is denied because app.jar's AllPermission is not sufficient.

Answer

Access is allowed because the first grant includes read permission for logs/-, which covers data.

Question 15

A financial services company runs a Java 17 application on a server with 8 GB RAM. The application reads daily transaction files in CSV format (each file is about 500 MB). It processes each line, validates it against a SQL database, and writes results to an output file. Recently, after processing about 60% of a file, the application crashes with an OutOfMemoryError: Java heap space. The heap size is set to 2 GB. The code uses Files.readAllLines() to load the entire file into a List<String>, then iterates. The team is evaluating solutions to avoid memory issues. Which approach is the best course of action?

Accepted Answer

Replace Files.readAllLines() with Files.lines() and process the stream line by line.. Files.readAllLines() loads the entire 500 MB CSV file into memory as a List, which causes the OutOfMemoryError when combined with other heap usage. Replacing it with Files.lines() returns a Stream that reads lines lazily, processing each line one at a time without holding the entire file in memory. This directly solves the heap space issue without requiring additional hardware or manual file splitting.

Answer

Increase the JVM heap size to 4 GB.

Answer

Enable class data sharing to reduce memory footprint.

Answer

Split the file into 100 MB chunks and process each chunk sequentially.