Java Serialization Interview Questions: What Senior Candidates Should Be Ready to Explain

Serialization rarely appears in day-to-day Java work anymore, since most services exchange JSON or Protocol Buffers. Yet it keeps showing up in Java interviews, especially for senior roles, because it tests understanding of object identity, class evolution, and security. Here are the questions that come up most and how to answer them with depth. What is serialization, and how do you enable it? Serialization converts an object's state into a byte stream so it can be stored or sent over a network; deserialization rebuilds the object. A class opts in by implementing the java.io.Serializable marker interface. Mention that the whole object graph is serialized, so every referenced object must also be serializable or marked transient. What is serialVersionUID and why does it matter? It is a version identifier for the class. During deserialization, the JVM compares the stream's serialVersionUID with the local class. If they differ, it throws InvalidClassException. If you do not declare one, the compiler generates it from class details, so even harmless changes like adding a method can break compatibility. Strong answer: always declare it explicitly and change it only when you intend to break compatibility. What do transient and static mean here? Transient fields are skipped and restored to default values. Static fields belong to the class, not the instance, so they are never serialized. A good follow-up point: use transient for caches, derived values, and sensitive data such as passwords. What happens with inheritance? If a parent class is not serializable, its no-argument constructor runs during deserialization to initialize its fields, and those fields are not restored from the stream. If the parent lacks an accessible no-arg constructor, deserialization fails. This is a classic trick question. How can you customize serialization? Implement private writeObject and readObject methods to control the format, for example to encrypt a field or validate invariants on read. Implement Externalizable to take full control with writeExternal and readExternal, which requires a public no-arg constructor. Mention readResolve for preserving singletons, since deserialization otherwise creates a new instance. Why is Java serialization considered a security risk? Deserializing untrusted data can trigger code paths in classes on the classpath, known as gadget chains, leading to remote code execution. Modern answers mention avoiding native serialization for untrusted input, using deserialization filters introduced in Java 9 (ObjectInputFilter), and preferring formats like JSON with explicit schemas. Showing awareness of this is what separates senior candidates. How do records and serialization interact? Records can be serializable, and their deserialization always goes through the canonical constructor, which means validation in the constructor applies. That is safer than classic field-by-field restoration. What are alternatives? JSON libraries such as Jackson, Protocol Buffers, Avro, and Kryo. Discuss trade-offs: human readability, schema evolution, performance, and cross-language support. How to present your answers Interviewers chain these questions, moving from definition to edge case to design trade-off. Keep each answer short, then offer the deeper detail. If you tend to lose your train of thought under that kind of follow-up pressure, Linkjob AI (https://linkjob.ai) provides real-time help during job interviews and technical interviews, helping you keep your explanations clear and organized.