I haven't submitted my exam yet, but here is my $0.02 on locking the criteriaFind() method.
The book "Effective Java" (which is a great book, by the way) says
you should synchronize any code that reads or writes shared, mutable data.
I've seen quite a number of posts by people that did not synchronize methods that *read* shared data.
Testing on your own is unlikely to discover a problem with this (especially since our testing probably won't call the Data.add() or delete() methods), but I still don't think it's a good idea.
Would you trust your criteriaFind() method running at the same time that some other process was adding or removing a record from the database?