"Tell me about a time you had to explain the primary types of security controls—such as preventive, detective, and corrective controls—and their impact on operational risk to non-technical stakeholders. How did you make the tradeoffs clear, and what happened as a result?"
