Explain synchronization of collections when iterators are used?

Iteration over collections in Java is not thread safe, even if you are using one of the synchronized wrappers (Collections.synchronizedMap(...)):

It is imperative that the user manually synchronize on the returned map when iterating over any of its collection views:

Map m = Collections.synchronizedMap(new HashMap());
...
Set s = m.keySet();  // Needn't be in synchronized block
...
synchronized(m) {  // Synchronizing on m, not s!
    Iterator i = s.iterator(); // Must be in synchronized block
    while (i.hasNext())
        foo(i.next());
}

Java Collection Framework docs

Other calls to synchronized collections are safe, as the wrapper classes surround them with synchronized blocks, which use the wrapper collection as their monitor:

public int size() {
    synchronized( this ) {
        return collection.size();
    }
}

with collection being the original collection. This works for all methods exposed by a collection/map, except for the iteration stuff.

The key set of a map is made synchronized just the same way: the synchronized wrapper does not return the original key set at all. Instead, it returns a special synchronized wrapper of the collection's original key set. The same applies to the entry set and the value set.

I understand that collections like the Hashtable are synchronized

The HashTable's entry set uses a SynchronizedSet which is a type of SynchronizedCollection.

If you modify any collection synchronized or not while using an iterator on it, the iterator will throw a ConcurrentModificationException.

An iterator is an Object that acts on a collection, being given the collection's state during construction. This lets you decide when you want to see the next item in the collection, if ever. You must use an iterator on a collection you know won't be modified, or only plan to modify using the iterator.

The reason ConcurrentModificationException is thrown is because of a check iterators make on the collection's current modification count, if it doesn't match the expected value, the exception is thrown. All collections increment a modification count variable each time something is added or removed.

How does the iterator, in particular, do its synchronization, especially when it is using entrySet()

So the iterator doesn't do synchronization and is not safe to use when you expect the collection to be modified by other threads, (or the current thread outside of the iterator).

However, SynchronizedCollection does provide a way to go though the collection synchronously. Its implementation of the forEach method is synchronized.

public void forEach(Consumer<? super E> consumer)

Just keep in mind, forEach uses an enhanced for loop which uses an iterator internally. This means forEach is only for reviewing the collection's contents, not for modifying it while looking through. Otherwise ConcurrentModificationException will be thrown.

can someone explain to me how it works, and at what point(s) access is restricted to concurrent calls

SynchronizedCollection causes threads to take turns accessing the collection if they want to use the synchronized methods such as (add, remove, forEach).

It works by introducing a synchronized block similar to how it's shown in the following code:

public boolean add(Object o) {
  synchronized(this) {
  super.add(o);
  }
}

A synchronized block is introduced around all of the operations you can perform on the collection except for the following methods:

iterator(), spliterator(), stream(), parallelStream()

Java Official Documentation