1Z0-829 Java I/O API and Securing Applications Practice Test 6 — 15 Questions

Question 1

A company needs to read a large text file (over 2 GB) line by line in a Java application while minimizing memory footprint. Which approach is most efficient?

Accepted Answer

Use Files.lines(path) with try-with-resources. `Files.lines(path)` returns a `Stream<String>` that lazily reads lines from the file, processing them one at a time without loading the entire file into memory. Combined with try-with-resources, the underlying `BufferedReader` is automatically closed, ensuring efficient resource management even for files over 2 GB.

Answer

Use Files.readAllLines(path)

Answer

Use FileOutputStream with read() loop

Answer

Use Scanner with File and loop hasNextLine()

Question 2

An application deserializes objects from a network stream. To protect against deserialization attacks, which approach is most effective in Java 17?

Accepted Answer

Set an ObjectInputFilter on the ObjectInputStream. Setting an ObjectInputFilter on the ObjectInputStream allows you to define a filter that can reject deserialization of arbitrary or malicious classes, which is the primary defense against deserialization attacks. This mechanism, introduced in Java 9 and enhanced in later versions, lets you whitelist or blacklist classes based on patterns, limits on array sizes, or depth of object graphs, directly mitigating the risk of remote code execution or denial-of-service via crafted serialized data.

Answer

Declare all fields as transient

Answer

Use try-with-resources to auto-close the stream

Answer

Mark the class as final

Question 3

Which of the following correctly uses try-with-resources to ensure a FileInputStream is closed after use?

Accepted Answer

try (FileInputStream fis = new FileInputStream("file.txt")) { ... }. It uses the try-with-resources syntax (try (resource declaration) { ... }), which automatically closes the FileInputStream when the block exits, regardless of exceptions. This ensures the resource is closed without requiring an explicit finally block, as mandated by the AutoCloseable interface.

Answer

FileInputStream fis = new FileInputStream("file.txt"); try { ... } finally { fis.close(); }

Answer

try { FileInputStream fis = new FileInputStream("file.txt"); ... } finally { fis.close(); }

Answer

try (fis = new FileInputStream("file.txt")) { ... }

Question 4

Which is the best practice for securing a Java application that reads sensitive configuration files?

Accepted Answer

Restrict access to the file using operating system permissions.. Restricting access to sensitive files using operating system permissions is a fundamental security practice that applies regardless of the Java version. In Java 17, the Security Manager is deprecated for removal (JEP 411), so relying on a Java security policy file (Option B) is no longer considered a best practice. OS-level permissions provide a robust, platform-native access control that does not depend on deprecated features. Options C and D are insufficient: making a file read-only does not prevent unauthorized access, and storing credentials in source code is highly insecure.

Answer

Define a Java security policy file with FilePermission for the configuration file.

Answer

Make the file read-only at the OS level.

Answer

Store credentials in the source code and use encryption.

Question 5

A financial services company runs a Java 17 application on a server with 8 GB RAM. The application reads daily transaction files in CSV format (each file is about 500 MB). It processes each line, validates it against a SQL database, and writes results to an output file. Recently, after processing about 60% of a file, the application crashes with an OutOfMemoryError: Java heap space. The heap size is set to 2 GB. The code uses Files.readAllLines() to load the entire file into a List<String>, then iterates. The team is evaluating solutions to avoid memory issues. Which approach is the best course of action?

Accepted Answer

Replace Files.readAllLines() with Files.lines() and process the stream line by line.. Files.readAllLines() loads the entire 500 MB CSV file into memory as a List, which causes the OutOfMemoryError when combined with other heap usage. Replacing it with Files.lines() returns a Stream that reads lines lazily, processing each line one at a time without holding the entire file in memory. This directly solves the heap space issue without requiring additional hardware or manual file splitting.

Answer

Increase the JVM heap size to 4 GB.

Answer

Enable class data sharing to reduce memory footprint.

Answer

Split the file into 100 MB chunks and process each chunk sequentially.

Question 6

Which class provides a convenient means to read text from a file line by line?

Accepted Answer

BufferedReader. BufferedReader (option D) is the correct answer because it provides the `readLine()` method, which reads text from a character-input stream line by line, efficiently buffering characters to avoid frequent disk reads. When wrapped around a FileReader, it enables convenient and performant line-by-line reading of text files.

Answer

FileReader

Answer

Scanner

Answer

FileInputStream

Question 7

A class implements Serializable. Which modification ensures that a specific field (password) is not included in the serialized stream?

Accepted Answer

Declare the field as transient. The `transient` modifier is the correct mechanism in Java to exclude a specific field from the default serialization process. When a class implements `Serializable`, all non-transient instance fields are serialized by default. Marking the `password` field as `transient` ensures it is skipped during serialization and restored as `null` (or default value) upon deserialization.

Answer

Declare the field as volatile

Answer

Declare the field as static

Answer

Declare the field as final

Question 8

Which TWO secure coding practices should be followed when developing a Java application that handles user input? (Choose two.)

Accepted Answer

Use PreparedStatement for database queries with user input.. Option A is correct because using PreparedStatement with parameterized queries ensures user input is treated as data rather than executable SQL, which prevents SQL injection attacks in Java applications. Option D is correct because validating and sanitizing all user input before processing enforces allowlist-based input constraints and removes or neutralizes dangerous characters, mitigating injection, XSS, and malformed-data attacks. Option B is incorrect because serializing sensitive data without encryption exposes it to interception or unauthorized disclosure, and performance is never a valid reason to skip encryption. Option C is incorrect because granting java.security.AllPermission to the application's codebase disables the Java security manager's protections and gives the code unrestricted access, violating least privilege. Option E is incorrect because java.util.Random is a predictable linear congruential generator and must not be used for security tokens; java.security.SecureRandom should be used instead.

Answer

Serialize sensitive data without encryption for performance.

Answer

Grant java.security.AllPermission to the application's codebase.

Answer

Use java.util.Random for generating session tokens.

Question 9

Which interface should be implemented to create a custom filter for deserialization in Java?

Accepted Answer

ObjectInputFilter. The `ObjectInputFilter` interface (introduced in Java 9) allows you to define a custom filter that validates classes and data being deserialized from an `ObjectInputStream`. By implementing this interface, you can reject potentially malicious or unexpected classes during deserialization, which is a key security measure against deserialization attacks.

Answer

Serializable

Answer

ObjectOutput

Answer

FilterOutputStream

Question 10

A financial application deserializes objects received over the network using ObjectInputStream. To prevent deserialization attacks, which secure coding practice should be implemented?

Accepted Answer

Use an ObjectInputFilter to whitelist allowed classes.. ObjectInputFilter (introduced in Java 9) allows you to define a filter that whitelists only trusted classes during deserialization. By rejecting untrusted classes before they are deserialized, you prevent deserialization attacks such as remote code execution via gadget chains. This is the recommended secure coding practice per Oracle's secure coding guidelines for the Java I/O API.

Answer

Override readObject() in each serializable class to validate data.

Answer

Declare all fields as transient to prevent unwanted data exposure.

Answer

Encrypt the serialized data with AES before transmission.

Question 11

A web application allows users to specify filenames for uploaded documents. The application saves files to a directory using the provided name. Which secure programming practice should be applied to prevent path traversal attacks?

Accepted Answer

Use File.getCanonicalPath() to resolve the path and check it starts with the intended directory.. `File.getCanonicalPath()` resolves all symbolic links, `.` and `..` sequences, and platform-specific path conventions to produce an absolute, unique path. By then verifying that this canonical path starts with the intended base directory (e.g., `/var/uploads/`), the application can definitively reject any path that escapes outside the allowed directory, even if the user-supplied filename contains encoded or obfuscated traversal sequences.

Answer

Validate that the filename contains only alphanumeric characters.

Answer

Generate a random UUID for each file, ignoring the user-provided filename.

Answer

Replace all occurrences of ".." and "/" with an empty string.

Question 12

Which TWO approaches are recommended to secure Java I/O operations? (Choose two.)

Accepted Answer

Use try-with-resources to ensure proper resource closure.. Option A is correct because try-with-resources (introduced in Java 7) automatically invokes close() on any AutoCloseable resource such as InputStream, OutputStream, Reader, or Writer at the end of the try block, guaranteeing closure even if an exception is thrown and preventing resource leaks that could otherwise expose file handles or leave data unflushed. Option E is correct because path traversal attacks (e.g., "../" sequences) and injection of malicious filenames occur when untrusted input is concatenated directly into file paths; validating and sanitizing user input before constructing paths (or using canonical path checks) prevents unauthorized file access outside the intended directory. Option B is not a security measure — BufferedInputStream only improves I/O performance through buffering and does not address confidentiality, integrity, or access control. Option C is incorrect because implementing Serializable merely enables object serialization and actually introduces security risks such as deserialization vulnerabilities; it does not secure I/O operations. Option D is incorrect because FileLock only coordinates concurrent access among processes to prevent data corruption; it is not a recommended general security control and does not authenticate or authorize access.

Answer

Use BufferedInputStream to wrap FileInputStream for better performance.

Answer

Use Serializable interface for all data objects.

Answer

Use FileLock to prevent concurrent write access.

Question 13

A large-scale data processing platform uses Java to read and write files across multiple nodes. Recently, operations have slowed down significantly. The system uses FileInputStream and FileOutputStream wrapped in BufferedInputStream and BufferedOutputStream with default buffer sizes (8 KB). The operations team suspects that the default buffer size is causing excessive system calls. The files are typically 100 MB to 1 GB in size. Which change would most improve I/O performance while minimizing memory overhead?

Accepted Answer

Increase the buffer size to 64 KB.. Increasing the buffer size to 64 KB reduces the number of system calls (read/write) by allowing more data to be transferred per call. With default 8 KB buffers and 100 MB–1 GB files, the overhead of frequent kernel transitions is significant. A 64 KB buffer strikes a good balance between performance gain and memory overhead, as it is large enough to reduce syscalls substantially without consuming excessive heap space.

Answer

Switch to using FileChannel with direct ByteBuffers for all file operations.

Answer

Use memory-mapped files (MappedByteBuffer) for the entire file.

Answer

Replace FileInputStream with FileReader and FileOutputStream with FileWriter.

Question 14

An architect is designing a microservice that reads large CSV files (up to 500 MB) from a shared filesystem and processes each row. The processing is CPU-bound and must not block the main thread. The service is deployed in a container with limited memory (512 MB heap). Which approach is most suitable?

Accepted Answer

Use a BufferedReader on a separate thread, reading lines into a bounded queue, and a thread pool to process rows from the queue.. It uses a bounded blocking queue to decouple I/O (reading lines from the CSV) from CPU-bound processing, preventing the main thread from being blocked while also avoiding memory exhaustion. The bounded queue acts as a back-pressure mechanism, ensuring that the limited 512 MB heap is not overwhelmed by the 500 MB file. Processing rows via a thread pool allows parallel CPU-bound work without blocking the reading thread.

Answer

Use Files.readAllLines() to read the entire file into memory, then process in parallel using streams.

Answer

Use a FileChannel with a memory-mapped byte buffer of the entire file.

Answer

Use a java.nio.file.FileSystem with a WatchService to detect changes to the file.

Question 15

Refer to the exhibit. A Java application is deployed in /opt/app/lib/ and attempts to perform the following operations:
1) Read the file /data/config/settings.xml
2) Write to the file /logs/app.log
3) Read the file /data/config/subdir/extra.conf
Which statement is true?

Accepted Answer

Operations 1 and 2 are allowed; operation 3 is denied.. The Java application is deployed in /opt/app/lib/, so its code base is /opt/app/lib/. The security policy grants read permission for /data/config/*, which matches /data/config/settings.xml (operation 1) but does not match /data/config/subdir/extra.conf because the wildcard * does not descend into subdirectories (operation 3 is denied). Write permission is granted for /logs/*, so /logs/app.log (operation 2) is allowed. Thus, operations 1 and 2 are allowed, and operation 3 is denied.

Answer

All three operations are allowed because the code base matches.

Answer

Only operation 1 is allowed; operations 2 and 3 are denied.

Answer

Operations 1 and 3 are allowed; operation 2 is denied.