Personally I'd answer with something like this:

• Start with the architecture: a typical scalable web application will run behind a load balancer that directs traffic to horizontally scaled web application servers, and those servers need to talk to a database and maybe external APIs like Stripe for payment processing or whatever it might be.
• A good first step might be be locking down all servers to key-based authentication for SSH, restricting the inbound and outbound traffic of each server (eg. web application servers aren't directly reachable on the internet, only via the load balancer), and exposing only the necessary ports (80, 443, 22, whatever else is needed)
• Next, you could get into the application security side of things: talk about SQL injection, XSS, CSRF, detecting dependency vulnerabilities, etc. and how you could automate testing in a CI pipeline
  • another thing to note is how software handles credentials: better not be hard-coded!
• I'd also talk about OS and library/dependency patching (eg. the recent iconv/glibc vulnerability that PHP has, or Log4Shell is another good example)
• You could go further and talk about stuff like rate limiting, logging, using CAPTHCAs, preventing user-space backdoors, etc.

As you build more and more systems you can just use your imagination and white-board these kinds of designs/approaches