One misbehaving client with a retry loop can take down a service faster than any DDoS. Rate limiting is the cheap, boring control that decides who gets served — here's how the five classic algorithms actually work, and how to make one correct across a fleet.
Picking token bucket vs sliding window is the easy part. The real interview is what happens when the limiter runs on fifty machines: where the counter lives, why 'local counters' quietly lets 50× your limit through, and how to enforce one global cap without a round-trip on every request.