How would you answer an interview scenario involving OpenID Connect?

In an interview, I would first define OpenID Connect and the problem it solves, then explain how I would validate ID token signature, issuer, audience, nonce when applicable, expiration, and flow-specific requirements, while using access tokens separately for API authorization. I would also call out the main failure mode: sending an ID token to an API as though it were a general-purpose access token confuses authentication and authorization responsibilities. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.