Name specific vulnerabilities and their mitigations. "I use parameterised queries to prevent SQL injection" is better than "I follow security best practices."
Strong answers cover OWASP Top 10: SQL injection (parameterised queries), XSS (output encoding, CSP), CSRF (tokens), broken authentication, sensitive data exposure, and insecure dependencies. Best candidates discuss security as a mindset throughout development, not a checklist at the end.
Every developer should have baseline security knowledge. Candidates who cannot name common vulnerabilities are a risk. Those who discuss defence-in-depth and security reviews demonstrate maturity.