How would you answer an interview scenario involving API rate limiting?

In an interview, I would first define API rate limiting and the problem it solves, then explain how I would choose the right partition key and algorithm, set limits per workload, return 429 when throttled, communicate retry guidance, and monitor rejected traffic before tuning thresholds. I would also call out the main failure mode: one global limit for every client and endpoint can punish legitimate users while still failing to protect an expensive hotspot. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.