Which Activity lifecycle callback is the correct place to release sensitive in-memory data (such as decrypted credentials) to minimize the window during which it resides in RAM?

Why B is correct

onPause() is the first callback guaranteed to execute before the activity becomes invisible, making it the earliest safe point to overwrite sensitive variables. onStop() fires later and the activity may already be snapshotted; onDestroy() is too late as the process may be killed without calling it; onSaveInstanceState() is designed for UI state persistence and should never receive credentials.