How would you answer an interview scenario involving JWT authentication?

In an interview, I would first define JWT authentication and the problem it solves, then explain how I would use trusted signing keys, validate issuer and audience, enforce expiration, rotate keys, keep tokens short-lived where practical, and never treat unsigned or merely decoded JWT contents as authenticated identity. I would also call out the main failure mode: decoding a JWT without cryptographic and claim validation allows attackers to present arbitrary claims that look structurally valid. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.