A new service needs to authenticate users. Server-side sessions or JWTs — and what makes the answer different for a mobile app versus a browser?
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
A product with a web app, a mobile app and a small number of internal services that need to call each other. Requirements include "log out on all devices" and "revoke access immediately when an employee leaves".
What it is really testing
Whether the candidate can reason about revocation, statelessness and the storage medium instead of repeating "JWTs are stateless so they scale". The revocation requirement in the scenario is the discriminator: it is the thing self-contained tokens are worst at.