While this may seem like a rudimentary question regarding your knowledge of Java, your interviewer is looking to ideally hear that you understand the principle differences between string and character arrays. Asking about the storage of passwords within a system gives you the opportunity here to point out the differences between the two. In the end, while explaining the differences, be sure to tie it back to the original question on why strings shouldn't be used to store passwords.