1Z0-829 Java I/O API and Securing Applications Practice Test 5 — 15 Questions

Question 1

A developer needs to create a temporary file that will be automatically deleted when the JVM terminates. Which approach correctly achieves this?

Accepted Answer

File.createTempFile("pre", ".txt").deleteOnExit(). `File.createTempFile("pre", ".txt")` creates a temporary file in the default temporary-file directory, and chaining `.deleteOnExit()` registers that file for deletion when the JVM terminates. This combination ensures both the creation of a temporary file and its automatic cleanup upon JVM shutdown, fulfilling the requirement precisely.

Answer

new File("tmp.txt").deleteOnExit()

Answer

Files.createTempDirectory("tmp").toFile().deleteOnExit()

Answer

Files.createTempFile("pre", ".txt")

Question 2

A method receives an InputStream and needs to compute its MD5 hash while reading the data. Which approach is most efficient?

Accepted Answer

Use DigestInputStream wrapping the original stream, then read the stream. `DigestInputStream` is a built-in Java class that computes a message digest (e.g., MD5) on the fly as data is read from the underlying stream. This avoids buffering the entire stream into memory, making it both memory-efficient and CPU-efficient for large or streaming data sources.

Answer

Read all bytes into a byte array, then compute hash using MessageDigest

Answer

Use a custom filter that hashes bytes during read

Answer

Use Scanner to read tokens and update hash

Question 3

A serialized object has an explicitly declared serialVersionUID of 123L. After a code change, a new field is added to the class but the serialVersionUID is left unchanged. What happens when deserializing an old stream?

Accepted Answer

Deserialization succeeds and the new field is set to its default value.. When a serialized object has an unchanged serialVersionUID, the Java deserialization mechanism treats the class as compatible. The new field is not present in the old stream, so it is simply initialized to its default value (e.g., null for objects, 0 for primitives) without throwing an exception. This behavior is defined by the Java Object Serialization Specification, which allows forward compatibility as long as the serialVersionUID matches.

Answer

Deserialization succeeds only if the new field is marked transient.

Answer

Deserialization throws StreamCorruptedException due to missing field.

Answer

Deserialization throws InvalidClassException because the class definition has changed.

Question 4

Which two of the following are valid methods to create a new directory using the NIO.2 Files class? (Select two.)

Accepted Answer

Files.createDirectory(Path). Option C, Files.createDirectory(Path), is correct because it is the standard NIO.2 method that creates a single new directory, throwing an exception if the parent path does not exist or if the directory already exists. Option D, Files.createDirectories(Path), is also correct because it creates a directory and any nonexistent parent directories, and unlike createDirectory it does not throw an exception if the directory already exists. Option A, Files.mkdir(Path), is not a method of the java.nio.file.Files class; mkdir() belongs to java.io.File. Option B, Files.createNewDirectory(Path), does not exist in the NIO.2 API. Option E, Files.makeDirectory(Path), is likewise not a real method in the Files class.

Answer

Files.mkdir(Path)

Answer

Files.createNewDirectory(Path)

Answer

Files.makeDirectory(Path)

Question 5

Which two statements are true about FileInputStream? (Select two.)

Accepted Answer

It extends java.io.InputStream.. Option B is correct because FileInputStream is a concrete subclass of java.io.InputStream, inheriting its abstract read() methods and the standard byte-oriented input contract. Option C is correct because InputStream implements java.io.Closeable, so FileInputStream also implements Closeable and provides close() to release the underlying file descriptor. Option A is wrong because mark()/reset() are not supported by FileInputStream; markSupported() returns false, and reset() throws IOException. Option D is wrong because byte-order concerns apply to DataInputStream/DataOutputStream, not to FileInputStream, which just reads raw bytes. Option E is wrong because FileInputStream reads bytes, not characters; character reading requires a Reader such as FileReader or InputStreamReader.

Answer

It supports mark() and reset().

Answer

It reads data in big-endian order.

Answer

It can be used to read characters.

Question 6

Which three actions help secure a Java application that uses serialization? (Select three.)

Accepted Answer

Overriding resolveClass() in ObjectInputStream to validate class names.. Option A is correct because overriding resolveClass() in a custom ObjectInputStream lets you validate or whitelist class names before they are loaded during deserialization, blocking gadget-chain classes that attackers try to instantiate. Option B is correct because implementing ObjectInputFilter (or setting one via ObjectInputFilter.Config / ObjectInputStream.setObjectInputFilter) enforces a JEP 290 deserialization filter that rejects classes, array lengths, or graph depth outside an allowed range, which is the modern, recommended defense against deserialization attacks. Option C is correct because marking sensitive fields transient excludes them from the serialized byte stream, so secrets such as passwords or keys are never written out or restored during deserialization. Option D is not appropriate because SecureRandom is for generating unpredictable cryptographic values, not for serialVersionUID, which is only a version-compatibility identifier and need not be secret or random. Option E is not a security control: explicitly declaring serialVersionUID as a long constant only stabilizes version compatibility during deserialization and does nothing to prevent malicious class loading or data exposure.

Answer

Using SecureRandom to generate serialVersionUID.

Answer

Declaring serialVersionUID explicitly as a long constant.

Question 7

Refer to the exhibit. What is the purpose of this code?

Accepted Answer

Encrypt data.txt and write to data.enc. The code uses a CipherOutputStream with a cipher initialized in ENCRYPT_MODE, reading from data.txt and writing to data.enc, thus encrypting the plaintext file and producing an encrypted output file. This is the standard pattern for file encryption in Java using the JCA (Java Cryptography Architecture).

Answer

Compress data.txt and write to data.enc

Answer

Encrypt data.enc and write to data.txt

Answer

Decrypt data.txt and write to data.enc

Question 8

Which class is best suited for reading integer tokens from a string containing space-separated integers?

Accepted Answer

Scanner. Scanner is best suited because it provides built-in methods like nextInt() that can parse space-separated integer tokens directly from a string, handling whitespace delimiters automatically. It is designed for parsing formatted input, making it the ideal choice for this task.

Answer

InputStreamReader

Answer

BufferedReader

Answer

DataInputStream

Question 9

A developer wants to copy all files from one directory to another, preserving file attributes (e.g., last modified time, permissions). Which NIO.2 method is most appropriate?

Accepted Answer

Files.copy(source, target, COPY_ATTRIBUTES). The `Files.copy(source, target, COPY_ATTRIBUTES)` method from the NIO.2 API copies the content of the file and, when the `COPY_ATTRIBUTES` option is specified, also preserves the file's metadata attributes such as last modified time, last access time, and permissions (where supported by the underlying file system). This option is specifically designed for copying with attribute preservation, making it the most appropriate choice for the developer's requirement.

Answer

Files.copy(source, target, REPLACE_EXISTING)

Answer

Files.move(source, target, ATOMIC_MOVE)

Answer

Files.walkFileTree() with a custom FileVisitor that copies files

Question 10

Which interface is designed for recursively walking a file tree?

Accepted Answer

FileVisitor. The `FileVisitor` interface is designed for recursively walking a file tree, as it provides callback methods (`preVisitDirectory`, `postVisitDirectory`, `visitFile`, `visitFileFailed`) that are invoked during a depth-first traversal of a file tree, typically used with `Files.walkFileTree()`. This allows you to process each file and directory in the tree, including subdirectories, making it the correct choice for recursive file tree walking.

Answer

DirectoryStream

Answer

FilenameFilter

Answer

FileFilter

Question 11

To generate a cryptographically secure random number for a key generation algorithm, which class should be used?

Accepted Answer

SecureRandom. D is correct because `SecureRandom` is specifically designed to produce cryptographically strong random numbers suitable for key generation, using algorithms like SHA1PRNG or NativePRNG that meet FIPS 140-2 standards. Unlike other random number generators, it ensures unpredictability and resistance to reverse engineering, which is critical for security-sensitive operations.

Answer

ThreadLocalRandom

Answer

Math.random()

Answer

Random

Question 12

In a JAAS login module, after the login() method returns true, which method must be called to commit the authentication and add principals to the Subject?

Accepted Answer

commit(). In a JAAS login module, after the `login()` method returns `true`, the `commit()` method must be called to associate the authenticated principals and credentials with the `Subject`. The `commit()` method is responsible for adding the successfully authenticated principals to the Subject, making them available for subsequent authorization checks. This is part of the two-phase authentication protocol defined by the `javax.security.auth.spi.LoginModule` interface.

Answer

login()

Answer

initialize()

Answer

abort()

Question 13

Which TWO statements are true regarding reading files with the NIO.2 API?

Accepted Answer

Files.newBufferedReader() provides buffered character input.. Option B is correct because Files.newBufferedReader(Path, Charset) returns a BufferedReader that reads characters through an internal buffer, which is the standard NIO.2 way to obtain buffered character input from a file. Option C is correct because Files.lines(Path) returns a lazily populated Stream that must be closed, so using it inside try-with-resources safely streams lines without loading the whole file into memory. Option A is wrong because Files.readAllLines() loads every line into a List in memory, which is not efficient for large files. Option D is wrong because Files.newInputStream() returns a plain InputStream (a SeekableByteChannel-based stream), not a FileChannel wrapper. Option E is wrong because Files.readAllBytes() reads the entire file into a single byte array, which is unsuitable for large binary files.

Answer

Files.readAllLines() is memory efficient for large files.

Answer

Files.newInputStream() wraps a FileChannel for high performance.

Answer

Files.readAllBytes() is the best choice for large binary files.

Question 14

Which TWO practices improve the security of Java serialization?

Accepted Answer

Mark sensitive fields as transient to exclude them from serialization.. Option B is correct because marking sensitive fields (e.g., passwords, keys) as transient excludes them from the default serialization process, so their values are never written to the byte stream and cannot be recovered by an attacker deserializing the object. Option D is correct because overriding readObject() lets you validate and sanitize field values after deserialization, rejecting malformed or malicious state before it is used, which mitigates gadget-chain and tampering attacks. Option A is not a security practice: throwing NotSerializableException from writeObject() merely prevents serialization of that class and does not protect against deserialization of crafted streams. Option C is wrong because serialVersionUID is only a version-compatibility identifier; a random value does not prevent malicious serialization and can actually break legitimate deserialization. Option E is not inherently secure: Externalizable gives full control over the wire format but shifts the burden of validation to the developer and, without explicit checks in readExternal(), can be just as vulnerable as default serialization.

Answer

Disable serialization by throwing NotSerializableException from writeObject().

Answer

Set a random serialVersionUID to prevent malicious serialization.

Answer

Use Externalizable for full control over serialization format.

Question 15

Refer to the exhibit. What is the most likely cause of this exception?

Accepted Answer

The file contains non-object data (e.g., text) instead of a serialized Java object.. A `java.io.StreamCorruptedException` with the message 'invalid stream header: 546F6D' indicates that the input stream does not begin with the expected magic number `0xACED` (the standard Java serialization stream header). The hex value `546F6D` corresponds to the ASCII string 'Tom', which is plain text, not serialized object data. This occurs when a file containing non-object data (e.g., text) is read by `ObjectInputStream`.

Answer

The serialized object was tampered with after serialization.

Answer

The serial version UIDs of the class and stream do not match.

Answer

The stream's magic number is wrong due to a network error.