1Z0-829 Java I/O API and Securing Applications Practice Question
Which TWO are secure coding practices for Java I/O that help prevent resource leaks and unauthorized access? (Choose two.)
⚠ Common exam trap
Oracle Java 17 exams often test the distinction between performance optimizations and security practices, so candidates may incorrectly select 'Always use BufferedReader' or 'Grant FilePermission' as security measures when they are actually about performance or access control misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mark sensitive fields in a Serializable class as transient to prevent serialization.
Marking sensitive fields as transient prevents them from being serialized, which mitigates the risk of exposing confidential data through serialization streams. This is a secure coding practice that directly addresses unauthorized access to sensitive information during I/O operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mark sensitive fields in a Serializable class as transient to prevent serialization.
Why this is correct
Prevents sensitive data from being exposed in serialized streams, reducing the risk of data leakage.
- ✗
Use Scanner instead of BufferedReader when reading untrusted input.
Why it's wrong here
Scanner does not inherently provide better security; both can be used safely with proper input validation.
- ✗
Always use BufferedReader for reading text files to improve performance.
Why it's wrong here
Performance improvement is not a security practice; it's about efficiency.
- ✓
Use try-with-resources for any stream, reader, or writer to ensure automatic closure.
Why this is correct
Guarantees resources are closed even if an exception occurs, preventing resource leaks that could lead to denial of service.
- ✗
Grant FilePermission in the security policy to restrict file access for untrusted code.
Why it's wrong here
While related to security, this is a policy configuration, not a coding practice within the code itself.
Go deeper
Related to this question
About these practice questions
One of 513 original 1Z0-829 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 1Z0-829
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is designing a service that processes multiple files concurrently. To avoid resource leaks, which practice is essential?
hard- A.Ensure each thread has its own copy of the file handle
- ✓ B.Use try-with-resources for each AutoCloseable resource
- C.Call close() on each stream in a separate try-catch block
- D.Use FileLock to prevent concurrent access
Why B: Try-with-resources guarantees that each AutoCloseable resource is closed automatically at the end of the statement, even if an exception occurs. This is essential when processing multiple files concurrently, as it prevents resource leaks without requiring explicit close() calls in finally blocks.
Variation 2. Which of the following correctly uses try-with-resources to ensure a FileInputStream is closed after use?
easy- A.FileInputStream fis = new FileInputStream("file.txt"); try { ... } finally { fis.close(); }
- ✓ B.try (FileInputStream fis = new FileInputStream("file.txt")) { ... }
- C.try { FileInputStream fis = new FileInputStream("file.txt"); ... } finally { fis.close(); }
- D.try (fis = new FileInputStream("file.txt")) { ... }
Why B: It uses the try-with-resources syntax (try (resource declaration) { ... }), which automatically closes the FileInputStream when the block exits, regardless of exceptions. This ensures the resource is closed without requiring an explicit finally block, as mandated by the AutoCloseable interface.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-829 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-829 exam.