Microsoft Certified Solutions Developer (MCSD) Certification Practice Test

What class is used to get the value from a SecureString object?

1. SecureString

2. Marshal

3. StringBuilder

4. IntPtr

The correct answer is: Marshal

The correct choice is based on how the .NET Framework handles conversions of secure data types. The SecureString class is designed to provide a way to store sensitive text, such as passwords, in a way that minimizes the risk of exposure. To retrieve the value stored in a SecureString object, the Marshal class is utilized. The Marshal class contains methods for allocating and deallocating memory as well as for converting managed types to unmanaged types and vice versa. Specifically, the Marshal.PtrToStringUni method can be used to convert the unmanaged string held in memory to a managed string. This is essential because when dealing with SecureString, the actual content is kept in an encrypted state in memory, and you only use methods from the Marshal class to ensure that you handle sensitive data securely and correctly. While the SecureString class itself is used for securely storing the string, it does not provide a direct way to retrieve the string value. Instead, the IntPtr and StringBuilder classes play different roles; IntPtr is used to hold a pointer to the unmanaged memory, and StringBuilder is a mutable string type, but neither directly pertains to retrieving the value of a SecureString as required in this context.