How would you answer an interview scenario involving authentication and authorization in Web API?

I would separate authentication from authorization. Authentication establishes who the caller is, typically through OAuth 2.0/OpenID Connect and a validated access token, while authorization decides whether that identity can perform the operation. For profile editing, I would use a policy that allows the resource owner or an administrator, enforce it server-side, apply least privilege, require HTTPS, and avoid trusting ownership or role information supplied by the client.