How would you answer an interview scenario involving dependency vulnerability management?

In an interview, I would first define dependency vulnerability management and the problem it solves, then explain how I would maintain an inventory or SBOM where useful, scan continuously, prioritize exploitable findings, update promptly, remove unused packages, pin trustworthy sources, and verify that emergency upgrades do not introduce regressions. I would also call out the main failure mode: treating every scanner finding as equally urgent creates alert fatigue, while ignoring transitive or container dependencies leaves significant exposure unaddressed. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.