Design a website with a user login, a password reset feature. And then go on from there.
E.g. talk about how to build your infrastructure. How to protect against CSRF. What is your stance in tokens in the front end. What about sessions. How to do force logout. Which database, why? When to use caching. How would you store Information about a password in a database in a safe manner. Salting hashing.
Synchronous vs asynchronous api. Idempotency. Different database transaction mechanism. How to do monitoring. Why is cardinality important for prometheus. How to do api first design.
This gives the candidate time to shine and I can at least understand where they are. And you can dig deeper.