1Z0-829 Java I/O API and Securing Applications Practice Question
Which TWO practices improve the security of Java serialization?
⚠ Common exam trap
A common mix-up: candidates confuse serialVersionUID as a security mechanism when it is actually a versioning control for class compatibility, not a defense against malicious serialization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mark sensitive fields as transient to exclude them from serialization.
Marking sensitive fields as transient prevents them from being serialized, ensuring that confidential data (e.g., passwords, cryptographic keys) is not exposed through the serialized stream. Option D is correct because implementing readObject() allows you to validate and sanitize deserialized fields, protecting against deserialization attacks where crafted data could corrupt the object state or trigger malicious behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable serialization by throwing NotSerializableException from writeObject().
Why it's wrong here
This prevents serialization but may break functionality; better to secure than disable.
- ✓
Mark sensitive fields as transient to exclude them from serialization.
Why this is correct
transient prevents sensitive data from being serialized.
- ✗
Set a random serialVersionUID to prevent malicious serialization.
Why it's wrong here
serialVersionUID is for version compatibility, not security.
- ✓
Implement readObject() to validate and sanitize fields.
Why this is correct
Validation in readObject() can prevent malicious data from being used.
- ✗
Use Externalizable for full control over serialization format.
Why it's wrong here
Externalizable is a design choice, not specifically a security practice.
Go deeper
Related to this question
About these practice questions
One of 513 original 1Z0-829 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-829 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-829 exam.