risk

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

Interviewers ask for the list to see whether you are current. They ask how you would use it to see whether you understand it is an awareness document, not a standard.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

Turn a filter-based launch claim into an actionable decision note: evidence, permission gaps, useful interim scope, owners and completion conditions.

Rate the supported consequence and conditions, explain retry assumptions and separate severity from deployment risk and response priority.