How would you answer an interview scenario involving attack surface analysis?

In an interview, I would first define attack surface analysis and the problem it solves, then explain how I would inventory endpoints and ports, identify privileged and internet-facing components, remove unused services, restrict administrative access, review third-party integrations, and repeat the analysis when architecture changes. I would also call out the main failure mode: focusing only on public HTTP endpoints can miss queues, storage, management interfaces, background workers, build systems, and credentials that are equally important attack paths. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.