How would you answer an interview scenario involving cross-site request forgery CSRF?

In an interview, I would first define cross-site request forgery CSRF and the problem it solves, then explain how I would use anti-forgery tokens for cookie-authenticated state-changing requests, apply SameSite cookies appropriately, verify origin where useful, avoid state changes through GET, and understand that bearer tokens sent explicitly are a different threat model. I would also call out the main failure mode: assuming CORS alone prevents CSRF is unsafe because browsers can send some cross-origin requests even when script code cannot read the response. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.