1Z0-829 Java I/O API and Securing Applications Practice Question
A class that stores sensitive user data implements Serializable. To minimize security exposure from deserialization attacks, which modification is the best practice?
⚠ Common exam trap
Test-takers frequently think overriding writeObject or implementing Externalizable gives full control over serialization, but they overlook that transient is the simplest and most secure way to exclude sensitive data from the serialized stream without introducing custom serialization logic that could be exploited.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Declare the sensitive fields as transient.
Declaring sensitive fields as transient prevents them from being serialized, so they are not written to the stream and cannot be deserialized. This directly eliminates the attack surface for deserialization exploits targeting those fields, as the default serialization mechanism skips transient fields entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Declare the sensitive fields as transient.
Why this is correct
Transient fields are not serialized, preventing them from being exposed in serialized data and reducing deserialization risks.
- ✗
Override writeObject to manually exclude the sensitive fields.
Why it's wrong here
Overriding `writeObject` allows customising the data written during serialization, effectively excluding sensitive fields from the stream. This is a valid technique for protecting data confidentiality or handling non-serializable fields, making it tempting for managing sensitive information. However, for deserialization attacks, the primary concern is often the execution of arbitrary code during object reconstruction, not merely the presence or absence of specific fields in the serialized stream. This modification does not mitigate the fundamental vulnerability that permits malicious code execution during deserialization, which is a key aspect of such attacks.
- ✗
Implement Externalizable and override readExternal and writeExternal.
Why it's wrong here
Implementing `Externalizable` provides complete control over the serialisation and deserialisation process, allowing developers to precisely manage which data is written to and read from the stream. While this *could* be used to omit sensitive fields, it does not inherently protect against deserialisation attacks, which exploit vulnerabilities in the deserialisation mechanism itself, rather than merely the presence of sensitive data. This option is tempting because `Externalizable` is the correct choice for optimising performance or managing versioning by customising the serialised form, or for selectively excluding non-critical data from the stream.
- ✗
Remove the implements Serializable clause from the class declaration.
Why it's wrong here
If the class needs to be serialized (e.g., for clustering), removing Serializable may break functionality. The question asks for minimizing exposure while keeping serialization.
Go deeper
Related to this question
About these practice questions
One of 513 original 1Z0-829 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-829 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-829 exam.