1Z0-829 Java I/O API and Securing Applications Practice Test 5 — 15 Questions

Question 1

Which class from the java.nio.file package is most appropriate for efficiently transferring data between two channels on the same machine?

Accepted Answer

FileChannel.transferTo(long, long, WritableByteChannel). `FileChannel.transferTo()` (and its counterpart `transferFrom()`) uses the operating system's zero-copy mechanism (e.g., `sendfile()` on Linux or `TransmitFile()` on Windows) to move data directly between file system caches and the target channel without intermediate buffers or user-space copies. This makes it the most efficient approach for transferring data between two channels on the same machine, as it minimizes CPU overhead and memory bandwidth usage.

Answer

Files.copy(Path, Path)

Answer

RandomAccessFile.getChannel().write(ByteBuffer)

Answer

InputStream.transferTo(OutputStream)

Question 2

Which class provides a convenient means to read text from a file line by line?

Accepted Answer

BufferedReader. BufferedReader (option D) is the correct answer because it provides the `readLine()` method, which reads text from a character-input stream line by line, efficiently buffering characters to avoid frequent disk reads. When wrapped around a FileReader, it enables convenient and performant line-by-line reading of text files.

Answer

FileReader

Answer

Scanner

Answer

FileInputStream

Question 3

A class implements Serializable. Which modification ensures that a specific field (password) is not included in the serialized stream?

Accepted Answer

Declare the field as transient. The `transient` modifier is the correct mechanism in Java to exclude a specific field from the default serialization process. When a class implements `Serializable`, all non-transient instance fields are serialized by default. Marking the `password` field as `transient` ensures it is skipped during serialization and restored as `null` (or default value) upon deserialization.

Answer

Declare the field as volatile

Answer

Declare the field as static

Answer

Declare the field as final

Question 4

Which TWO secure coding practices should be followed when developing a Java application that handles user input? (Choose two.)

Accepted Answer

Use PreparedStatement for database queries with user input.. Using PreparedStatement with parameterized queries prevents SQL injection by separating SQL logic from user input. The database driver automatically escapes special characters in the input, ensuring that user-supplied data is treated as literal values, not executable SQL code.

Answer

Serialize sensitive data without encryption for performance.

Answer

Grant java.security.AllPermission to the application's codebase.

Answer

Use java.util.Random for generating session tokens.

Question 5

A Java application uses FileChannel to copy a file to a remote network drive. The developer wants to ensure atomic file replacement on the destination. Which approach is correct?

Accepted Answer

Use Files.move() with StandardCopyOption.ATOMIC_MOVE.. `Files.move()` with `StandardCopyOption.ATOMIC_MOVE` guarantees that the file replacement on the destination file system is atomic — either the entire move succeeds or the original state remains intact. This is essential for remote network drives where partial writes or concurrent access could leave the destination in an inconsistent state. The `ATOMIC_MOVE` option leverages file system–level atomic rename operations (e.g., NFS or SMB support) to ensure no intermediate state is visible.

Answer

Delete the destination file, then rename the temporary file.

Answer

Use FileChannel.transferTo() to write directly.

Answer

Use Files.copy() with REPLACE_EXISTING option.

Question 6

Which interface should be implemented to create a custom filter for deserialization in Java?

Accepted Answer

ObjectInputFilter. The `ObjectInputFilter` interface (introduced in Java 9) allows you to define a custom filter that validates classes and data being deserialized from an `ObjectInputStream`. By implementing this interface, you can reject potentially malicious or unexpected classes during deserialization, which is a key security measure against deserialization attacks.

Answer

Serializable

Answer

ObjectOutput

Answer

FilterOutputStream

Question 7

A developer is writing a utility to copy a large binary file (e.g., 500 MB) from one location to another while minimizing memory overhead and ensuring data integrity. Which approach is most appropriate?

Accepted Answer

Use a custom loop reading into a byte array of 8KB and writing to the output stream.. Reading and writing in fixed-size chunks (e.g., 8KB) minimizes memory overhead by avoiding loading the entire 500 MB file into memory, while still providing efficient I/O through buffered operations. This approach ensures data integrity by processing the file sequentially without relying on character-based streams, which are unsuitable for binary data.

Answer

Use BufferedReader and BufferedWriter for binary data.

Answer

Use Files.copy() with StandardCopyOption.REPLACE_EXISTING.

Answer

Use FileInputStream.readAllBytes() and FileOutputStream.write().

Question 8

A financial application deserializes objects received over the network using ObjectInputStream. To prevent deserialization attacks, which secure coding practice should be implemented?

Accepted Answer

Use an ObjectInputFilter to whitelist allowed classes.. ObjectInputFilter (introduced in Java 9) allows you to define a filter that whitelists only trusted classes during deserialization. By rejecting untrusted classes before they are deserialized, you prevent deserialization attacks such as remote code execution via gadget chains. This is the recommended secure coding practice per Oracle's secure coding guidelines for the Java I/O API.

Answer

Override readObject() in each serializable class to validate data.

Answer

Declare all fields as transient to prevent unwanted data exposure.

Answer

Encrypt the serialized data with AES before transmission.

Question 9

A web application allows users to specify filenames for uploaded documents. The application saves files to a directory using the provided name. Which secure programming practice should be applied to prevent path traversal attacks?

Accepted Answer

Use File.getCanonicalPath() to resolve the path and check it starts with the intended directory.. `File.getCanonicalPath()` resolves all symbolic links, `.` and `..` sequences, and platform-specific path conventions to produce an absolute, unique path. By then verifying that this canonical path starts with the intended base directory (e.g., `/var/uploads/`), the application can definitively reject any path that escapes outside the allowed directory, even if the user-supplied filename contains encoded or obfuscated traversal sequences.

Answer

Validate that the filename contains only alphanumeric characters.

Answer

Generate a random UUID for each file, ignoring the user-provided filename.

Answer

Replace all occurrences of ".." and "/" with an empty string.

Question 10

Which TWO approaches are recommended to secure Java I/O operations? (Choose two.)

Accepted Answer

Use try-with-resources to ensure proper resource closure.. Try-with-resources automatically closes each resource declared in its header when the block exits, whether normally or via exception. This eliminates the risk of resource leaks from forgotten or improperly handled close() calls, which is a fundamental security and reliability requirement for I/O operations.

Answer

Use BufferedInputStream to wrap FileInputStream for better performance.

Answer

Use Serializable interface for all data objects.

Answer

Use FileLock to prevent concurrent write access.

Question 11

Which THREE statements are true about Java NIO.2 and its interaction with blocking I/O? (Choose three.)

Accepted Answer

A Selector can be used to manage multiple non-blocking channels.. A Selector in Java NIO.2 is specifically designed to manage multiple non-blocking channels, enabling a single thread to monitor I/O readiness across many channels. This is a core feature of the NIO.2 multiplexed I/O model, where channels must be configured in non-blocking mode to be registered with a Selector.

Answer

FileChannel operations are always non-blocking.

Answer

BufferedInputStream extends FilterInputStream.

Question 12

A large-scale data processing platform uses Java to read and write files across multiple nodes. Recently, operations have slowed down significantly. The system uses FileInputStream and FileOutputStream wrapped in BufferedInputStream and BufferedOutputStream with default buffer sizes (8 KB). The operations team suspects that the default buffer size is causing excessive system calls. The files are typically 100 MB to 1 GB in size. Which change would most improve I/O performance while minimizing memory overhead?

Accepted Answer

Increase the buffer size to 64 KB.. Increasing the buffer size to 64 KB reduces the number of system calls (read/write) by allowing more data to be transferred per call. With default 8 KB buffers and 100 MB–1 GB files, the overhead of frequent kernel transitions is significant. A 64 KB buffer strikes a good balance between performance gain and memory overhead, as it is large enough to reduce syscalls substantially without consuming excessive heap space.

Answer

Switch to using FileChannel with direct ByteBuffers for all file operations.

Answer

Use memory-mapped files (MappedByteBuffer) for the entire file.

Answer

Replace FileInputStream with FileReader and FileOutputStream with FileWriter.

Question 13

A developer is building a file synchronization tool that runs on multiple threads. Multiple threads may read and write to the same file concurrently. The developer wants to ensure that a thread does not read a file while another thread is writing to it, and that concurrent reads are allowed. Which locking mechanism should be used?

Accepted Answer

Use java.nio.channels.FileLock with shared lock for reading and exclusive lock for writing.. Java.nio.channels.FileLock provides a platform-independent mechanism for locking files, supporting shared locks for concurrent reads and exclusive locks for writes. This ensures that a thread cannot read a file while another thread is writing to it, while allowing multiple threads to read simultaneously, which matches the requirement exactly.

Answer

Use a ReentrantReadWriteLock in Java with the file as a resource.

Answer

Use synchronized blocks on the File object.

Answer

Use a Semaphore with permits equal to the number of threads.

Question 14

A web application allows users to upload profile pictures. The application saves the files to a directory using the original filename provided by the user. After a security review, the team discovered a critical path traversal vulnerability. Which remediation is most effective in preventing exploitation while maintaining usability?

Accepted Answer

Generate a random UUID as the filename and store the original filename in a database.. Generating a random UUID as the filename eliminates the user's control over the file path, making path traversal attacks impossible. The original filename can be stored in a database for display purposes, preserving usability while ensuring the file is saved with a safe, unpredictable name.

Answer

Store the files in a database BLOB instead of the filesystem.

Answer

Sanitize the filename by removing all occurrences of "../" and "/".

Answer

Check that the file extension is allowed (e.g., .jpg, .png) and no special characters.

Question 15

A logging framework in Java has been writing logs to a file using a FileWriter with default buffer size. The logs are frequently lost when the application crashes because the buffer is not flushed. Which change ensures that log messages are written immediately without significantly impacting performance?

Accepted Answer

Use a PrintWriter wrapping a FileWriter and set autoFlush=true.. A PrintWriter wrapping a FileWriter with autoFlush=true ensures that every println, printf, or format call triggers an automatic flush of the underlying stream. This guarantees log messages are written to disk immediately upon each write, preventing data loss during a crash, while still allowing the FileWriter's internal buffer to aggregate small writes for performance. The autoFlush mechanism in PrintWriter is specifically designed for this use case in Java I/O.

Answer

Use a FileWriter with autoFlush=true.

Answer

Set the buffer size to 0 to disable buffering.

Answer

Call flush() after every log message.