Java Serialisation and Deserialisation

List of Java Serialization interview questions.

1. What is Java Serialization?
   Java Serialization is a mechanism for converting an object into a stream of bytes so that it can be saved into a file or transferred over the network.
2. How do you make a Java class serializable?
   To make a Java class serializable, you need to implement the Serializable interface.
3. What is the serialVersionUID in Java Serialization?
   The serialVersionUID is a unique identifier that is used to ensure that the serialized and deserialized objects are compatible. It is a version number of the class.
4. Can you serialize static fields in Java?
   Static fields are not serialized by default. If you want to serialize a static field, you need to implement the writeObject() and readObject() methods to handle the serialization and deserialization of the static fields.
5. What is Externalizable in Java Serialization?
   Externalizable is an interface in Java Serialization that provides more control over the serialization process than Serializable. It requires the implementation of two methods: writeExternal() and readExternal().
6. Can you customize the serialization process in Java?
   Yes, you can customize the serialization process in Java by implementing the writeObject() and readObject() methods in your serializable class.
7. What is the purpose of the transient keyword in Java Serialization?
   The transient keyword is used to indicate that a field should not be serialized. When a field is marked as transient, its value is not saved when the object is serialized.
8. Can you serialize an object that contains a reference to a non-serializable object?
   No, you cannot serialize an object that contains a reference to a non-serializable object. You need to mark the non-serializable object as transient or implement the Externalizable interface to handle the serialization and deserialization of the non-serializable object.
9. What is the difference between Serializable and Externalizable in Java?
   Serializable is a marker interface in Java that provides default serialization behavior, while Externalizable is an interface that provides more control over the serialization process.
10. What happens when you change the serialVersionUID of a serialized class?
    If you change the serialVersionUID of a serialized class, it can cause compatibility issues when you try to deserialize an object of the class with the new version. The deserialization process will fail and you will get an InvalidClassException.

Java deserialization interview question:

1. What is Java deserialization, and how does it work?
2. What are the vulnerabilities associated with Java deserialization?
3. What is the difference between serialization and deserialization in Java?
4. How can you prevent Java deserialization vulnerabilities?
5. What are the steps involved in custom deserialization in Java?
6. What is the serialVersionUID, and why is it important in deserialization?
7. What is the role of ObjectInputStream and ObjectOutputStream in Java deserialization?
8. Can you explain the concept of marshaling and unmarshalling in Java?
9. What is the difference between externalizable and serializable in Java?
10. What are the limitations of serialization and deserialization in Java?