How would you answer an interview scenario involving secure error handling?

In an interview, I would first define secure error handling and the problem it solves, then explain how I would map expected failures to stable error contracts, use generic messages for unexpected faults, attach correlation IDs, log details securely, avoid sensitive data in logs, and make authorization failures indistinguishable where resource existence is sensitive. I would also call out the main failure mode: returning raw exception text from production APIs can reveal implementation details and secrets while creating inconsistent contracts for clients. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.