Start here. This is the direct spoken answer to practice first.
Why this question matters
Healthy pushback is not stubbornness. It shows the candidate can protect the product while still helping the team move.
I pushed back on a requirement to let support staff impersonate users without much friction. The goal was valid: faster troubleshooting. The risky part was invisible privileged access. I explained that impersonation needed a session boundary, reason, expiry, audit trail, and blocked sensitive actions. Then I proposed a smaller version that let support view the account context without allowing destructive changes.