Start here. This is the direct spoken answer to practice first.
Why this matters
Investigate an endpoint accepting invalid data or returning inconsistent validation errors. It matters in real backend work because clients depend on stable status codes, request and response shape, validation behavior, and compatibility after the endpoint ships. The practical angle is validation layers, DTO changes, model binding, error consistency, regression tests, and data cleanup, tied to a concrete production decision.
I first identify exactly which invalid input is accepted and whether the problem is binding, request validation, business validation, or domain invariants. I reproduce the request with the real payload and check what the endpoint receives after binding. Then I inspect recent DTO, validator, controller, and error-handling changes. I also check whether invalid data already reached storage. I would tie the choice back to the contract clients consume, because small API changes can become client breakages once the endpoint is in use.