How would you answer an interview scenario involving rate limiting and resilience in Web API?

I would partition rate limits by a meaningful identity such as API client, user, tenant, or IP depending on the threat model, rather than using only one global limit. I would set different policies for expensive endpoints, return 429 Too Many Requests with appropriate retry guidance, and monitor rejected traffic. I would combine rate limiting with timeouts, concurrency limits, circuit breakers for downstream dependencies, and capacity monitoring.