You enable dependency scanning. It reports 4,200 vulnerabilities across the estate, 380 critical. What do you do on Monday?

What the interviewer is testing

Whether you can turn an unusable number into a work programme, and whether you understand that blocking on it would stop delivery.

What not to do

Do not turn on blocking. Blocking on 4,200 findings stops every team on Monday, and the control is exempted by Wednesday. Once a control has been switched off under pressure it is very hard to reinstate.

The triage

The raw count overstates real risk substantially, and the reduction is legitimate rather than evasive:

Reachability. Is the vulnerable code path actually invoked? A large share of findings sit in transitive dependencies whose affected function is never called. Reachability analysis typically cuts the list by a large factor and is the highest-leverage filter.

Exposure. Internet-facing services with untrusted input first; internal batch jobs later.

Data sensitivity. Services handling regulated or personal data ahead of others.

Exploitability in context. A denial-of-service vulnerability in a service already behind rate limiting differs from remote code execution in a public endpoint. Published exploit availability matters more than the base severity score.

That usually turns 380 critical into a few dozen genuinely urgent items.

The programme

Immediately: block on new critical findings and on secrets, so the backlog stops growing. This is achievable on Monday and is the most important single step.

Weeks 1–4: fix the triaged urgent set, mostly through dependency version bumps automated across repositories.

Quarterly: drive the remainder down with a target per severity tier, and pursue the structural fix — a small set of maintained base images and shared libraries, so one upgrade resolves findings across many services.

What a strong answer adds

Measuring time to remediate rather than open finding count. The count is a function of the scanner's database and rises when new vulnerabilities are disclosed regardless of your work; time to remediate measures the capability you are actually building.

Common weak answers

Blocking immediately. Reporting the raw number to leadership as a risk position.