How would you answer an interview scenario involving cross-site scripting XSS?

In an interview, I would first define cross-site scripting XSS and the problem it solves, then explain how I would treat user-controlled content as data, rely on safe templating defaults, sanitize only when HTML is intentionally allowed, avoid dangerous DOM APIs, use Content Security Policy, and validate third-party content paths. I would also call out the main failure mode: input validation alone does not prevent XSS because safe handling depends on the output context where the data is inserted. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.