Your question is Threat Modeling with Layered Architecture. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Given a layered architecture diagram (internet-facing login page, CDN, app servers, Kubernetes clusters, APIs, database, external dependencies), pick a threat modeling framework and walk through the threats at each layer. Asked in the loop at the threat modeling stage. The candidate used STRIDE.