Draw the line clearly: "Parameters for things like pagination defaults or feature names — static, committed, same everywhere. Environment variables for database URLs, API keys, and secrets — different per environment, never committed."
Parameters are defined in services.yaml under the parameters key and are resolved at container compilation time. They are static values baked into the compiled container. Environment variables are read at runtime from the host environment or .env files. In services.yaml, use %parameter_name% for parameters and %env(VAR_NAME)% for environment variables. Access parameters in services via #[Autowire] attribute or constructor injection. In controllers extending AbstractController, use $this->getParameter(). Use parameters for: non-sensitive configuration that does not change between deployments. Use environment variables for: secrets (API keys, database credentials), values that differ between environments, and anything that should not be committed to version control. Strong candidates mention: env var processors (env(bool:), env(int:), env(json:)) for type casting.
Entry-level configuration question. Candidates who put secrets in parameters or who do not understand the compilation-time versus runtime distinction will mishandle configuration. Those who know when to use each and can explain env var processors handle configuration correctly.