How would you answer an interview scenario involving GraphQL security?

In an interview, I would first define GraphQL security and the problem it solves, then explain how I would authorize resolvers or domain operations, validate inputs, enforce depth or complexity limits, rate-limit expensive operations, use persisted queries where helpful, and avoid exposing sensitive schema details unnecessarily. I would also call out the main failure mode: protecting only the single GraphQL endpoint while assuming every field is equally authorized can expose data through nested resolvers. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.