1Z0-829 Java I/O API and Securing Applications Practice Question
A financial application deserializes objects received over the network using ObjectInputStream. To prevent deserialization attacks, which secure coding practice should be implemented?
⚠ Common exam trap
Many candidates confuse data validation (Option B) or encryption (Option D) with deserialization attack prevention, but the core issue is controlling which classes are allowed to be deserialized, which only an ObjectInputFilter can enforce at the stream level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an ObjectInputFilter to whitelist allowed classes.
ObjectInputFilter (introduced in Java 9) allows you to define a filter that whitelists only trusted classes during deserialization. By rejecting untrusted classes before they are deserialized, you prevent deserialization attacks such as remote code execution via gadget chains. This is the recommended secure coding practice per Oracle's secure coding guidelines for the Java I/O API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an ObjectInputFilter to whitelist allowed classes.
Why this is correct
ObjectInputFilter provides a declarative way to restrict class loading during deserialization.
- ✗
Override readObject() in each serializable class to validate data.
Why it's wrong here
Overriding readObject() can help but is error-prone and not as comprehensive as a global filter.
- ✗
Declare all fields as transient to prevent unwanted data exposure.
Why it's wrong here
Transient fields prevent serialization of that field, but do not protect against deserialization attacks.
- ✗
Encrypt the serialized data with AES before transmission.
Why it's wrong here
Encryption protects confidentiality, not integrity of the deserialization process.
Go deeper
Related to this question
About these practice questions
This 1Z0-829 question is part of Courseiva's 513-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-829 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-829 exam.