static, final & transient: interview questions & scenarios

Model answer

• final: a modifier. Assign once for variables, do not override for methods, and do not extend for classes.
• finally: a block after try/catch that runs whether or not an exception was thrown, except when the JVM halts, crashes or the process is killed.
• finalize(): an old Object hook the GC might call before reclaiming an object. It is deprecated since Java 9 and deprecated for removal since Java 18 through JEP 421. Use try-with-resources, or Cleaner as a safety net.

Model answer

final locks the reference, not the object. final List<String> tags = new ArrayList<>(); means tags always points to the same list, so tags = new ArrayList<>() will not compile, but tags.add("vip") is fine.

Immutability is a property of the object's class. Use List.of(...) or List.copyOf(...), or a record with immutable components. For a field, combine both: a private final field holding an unmodifiable list.

Model answer

class Base    { static String who() { return "Base"; }    String me() { return "Base"; } }
class Derived extends Base {
    static String who() { return "Derived"; }
    @Override String me() { return "Derived"; }
}

Base b = new Derived();
System.out.println(b.who() + " " + b.me());   // Base Derived

Static methods are hidden, not overridden. b.who() compiles to invokestatic Base.who, chosen from the declared type of b. b.me() is an invokevirtual, dispatched on the runtime class, so it runs Derived.me().

This is the picture interviewers want you to have in your head: one call is selected from the variable type, the other from the object type.

Fig. 1

The diagram shows a Base reference pointing to a Derived object, with static dispatch going to Base.who and virtual dispatch going to Derived.me.

Model answer

Once, on the class's first active use (JLS 12.4.1): creating an instance, calling a static method, assigning a static field, reading a static field that is not a compile-time constant, initialising a subclass, reflection like Class.forName, or being the main class.

It does not run when you read a compile-time constant, create an array with new Config[10], use Config.class, or read a parent's static field through a subclass name. Loading a class and initialising it are different steps.

Model answer

In HotSpot, since JDK 7, static fields live in the class's java.lang.Class object (the mirror) on the regular Java heap. The class metadata, meaning bytecode, method tables and the constant pool, lives in Metaspace, native memory that replaced PermGen in Java 8.

Static fields exist once per class per class loader, and they stay reachable as long as the class is loaded, which for application classes usually means for the lifetime of the JVM.

Here is the split I want you to draw if the interviewer asks where the memory actually is.

Fig. 1

The diagram separates the Class mirror on the Java heap from class metadata in Metaspace, with static fields reachable through the mirror.

Model answer

count++ on a static int is a read, an add and a write. Two threads can read the same value, both add one, and one write overwrites the other. static gives you one shared copy; it does not make the update atomic.

I would use AtomicLong for a correct counter, LongAdder for a hot metrics counter with many writers and occasional reads, or synchronized when the counter must update together with other state. volatile alone only gives visibility, not atomicity.

Model answer

They are left at their type defaults: null, 0, false. Deserialization does not run the class's own constructors or field initialisers; it only runs the no-arg constructor of the first non-serializable superclass, usually Object. So transient Map<String, Object> cache = new HashMap<>() comes back as null, and transient int retries = 3 comes back as 0.

To restore them, write a private readObject(ObjectInputStream in) that calls in.defaultReadObject() and then recomputes the transient fields, or initialise them lazily in a getter.

Model answer

A lambda can run later, possibly on another thread, after the method that created it has returned and its stack frame is gone. Java captures a copy of the value, not the local variable itself. If the variable could still change, the lambda's copy and the method's variable could silently disagree.

Fields do not have this rule, because a lambda reads them through this, which is a captured reference to a heap object.

Model answer

A static utility class (Math, Collections, my own MoneyFormat) fits stateless, pure functions with no dependencies. Give it a private constructor.

When there is state or a dependency, I prefer an object: it can implement an interface, be injected and mocked in tests, be lazily initialised, and become two instances later without changing callers. In Spring, that is a regular bean. A hand-written lazy singleton uses the holder idiom, which is thread-safe because class initialisation runs once under a JVM lock.

public final class RateCard {
    private RateCard() { }
    private static final class Holder { static final RateCard INSTANCE = new RateCard(); }
    public static RateCard get() { return Holder.INSTANCE; }
}

Model answer

When a constructor completes, its final fields are frozen. Any thread that later obtains a reference to the object, even through a data race with no volatile or locking, is guaranteed to see the final fields' initialised values, and the state of objects reachable through them as of the end of the constructor. Non-final fields get no such guarantee: another thread may see 0 or null.

The condition is that this must not escape the constructor, for example by registering a listener or storing this in a static field. If it escapes, other threads can see the object before the freeze.

Model answer

A static final field of primitive or String type initialised with a constant expression is a constant variable. javac copies its value into every class that uses it, so the caller never reads the field at runtime. Swapping the jar does not change already-compiled clients; they need to be recompiled.

For values that may change, avoid constant variables: expose them through a static method, load them from configuration, or initialise them with a non-constant expression such as Integer.valueOf(500).

Model answer

class Pricing {
    static final Pricing INSTANCE = new Pricing();
    static final BigDecimal GST = new BigDecimal("0.18");
    final BigDecimal rate;
    Pricing() { rate = GST; }
}
System.out.println(Pricing.INSTANCE.rate);   // null

Static initialisers run in textual order. INSTANCE is created first, and its constructor reads GST before GST has been assigned, so it sees null.

Fix it by declaring GST before INSTANCE, or with the holder idiom so the instance is created after all statics are ready. If GST were a static final double GST = 0.18, a constant variable, it would be inlined and the bug would disappear, which is why this one is easy to miss.

Model answer

ObjectInputStream.readObject() instantiates whatever serializable classes the stream names, from anywhere on the classpath, and runs their readObject or readResolve hooks without calling normal constructors. Attackers chain those hooks across library classes, called gadget chains, to reach code execution.

Defences, in order: do not deserialize untrusted Java-serialized data; use JSON, Protobuf or Avro for cross-service data; if you must use Java serialization, install an ObjectInputFilter allow-list; and validate invariants in your own readObject methods or use the serialization proxy pattern.