How would you answer an interview scenario involving OAuth 2.0?

In an interview, I would first define OAuth 2.0 and the problem it solves, then explain how I would choose an appropriate flow, use authorization code with PKCE for interactive public clients, validate redirect URIs, minimize scopes, protect tokens, and use a trusted authorization server. I would also call out the main failure mode: treating OAuth access tokens as proof of user identity without considering token purpose or OpenID Connect semantics can lead to incorrect authentication decisions. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.