I/O · interview question

Which statements about Java serialization are true? Select all that apply.

Select all that applyMedium

A class must implement `Serializable` to be serialized with `ObjectOutputStream`.`transient` fields aren't serialized.`static` fields are serialized along with the object.Deserializing untrusted data is a security risk.`serialVersionUID` must be unique across all classes in an application.

Answer and explanation

Correct answer

A. A class must implement Serializable to be serialized with ObjectOutputStream.
B. transient fields aren't serialized.
D. Deserializing untrusted data is a security risk.

Why

Deserialization can instantiate arbitrary classes and trigger gadget chains. Prefer JSON or protobuf for external data, or use serialization filters.

References

The Java Tutorials: Basic I/O
Joshua Bloch, Effective Java, 3rd ed. (2018)

Test yourself on I/O

A free test with instant, explained results. No account needed.

Start free test