Clustering and its evaluation, dimensionality reduction, density and isolation methods, and detecting anomalies with no labels to learn from.
3 questions in Machine Learning.
Model what normal looks like and score deviation from it, using distance or density methods, an isolation forest, or reconstruction error from an autoencoder. Then set the threshold from how many alerts the team can investigate per day, because an unlabelled score distribution cannot tell you where to cut.
Combine internal geometry measures such as silhouette with stability under resampling, then accept that neither picks k for you. A clustering is good when the segments are separable, reproducible on a resampled dataset, and distinct on a variable the business will act on. It also connects unsupervised learning to the point an interviewer is testing.
Dimensionality reduction helps when features are redundant, noisy or too expensive to serve, but it can hide the signal. PCA keeps variance, not relevance, and t-SNE or UMAP plots should guide exploration rather than prove model quality.