AI for Reviewing Rate Limit Design Choices

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-ai-coding-AI-rate-limit-design-review-creators

1. What is the primary value of using an LLM when choosing a rate limiting algorithm for an API?

   1. To automatically deploy the rate limiter to production
   2. To replace the need for defining abuse patterns
   3. To act as a sounding board that summarizes algorithm tradeoffs
   4. To generate synthetic attack traffic for testing

2. Which rate limiting algorithm uses a bucket that refills at a constant rate and allows tokens to accumulate up to a maximum capacity?

   1. Fixed window counter
   2. Token bucket
   3. Leaky bucket
   4. Sliding-window counter

3. In token-bucket rate limiting, what happens when a request arrives and the bucket contains enough tokens to fulfill it?

   1. The bucket overflows and extra tokens are lost
   2. The request is queued until the next window
   3. The request is always denied to preserve tokens
   4. Tokens equal to the request cost are consumed and the request is allowed

4. Which rate limiting algorithm provides the strongest fairness guarantee by tracking the exact timestamp of every request within the window?

   1. Sliding-window log
   2. Sliding-window counter
   3. Token bucket
   4. Fixed window counter

5. What is the primary memory disadvantage of sliding-window log compared to other rate limiting approaches?

   1. It requires a database connection
   2. It cannot be distributed across servers
   3. Memory usage grows linearly with the number of requests in the window
   4. It requires storing every HTTP header

6. A rate limiter keyed only by IP address would fail to protect against which attack pattern?

   1. DNS amplification attacks
   2. A single user sending thousands of requests per second
   3. SQL injection attempts
   4. A distributed botnet where each node stays under the per-IP limit

7. In rate limiting terminology, what does 'thundering herd' refer to?

   1. When many requests are released simultaneously after a rate limit resets
   2. When a single IP generates excessive traffic
   3. When rate limiting causes legitimate users to retry
   4. When attackers use stolen credentials

8. What aspect of your specific system can an LLM NOT determine for your rate limiting design?

   1. Common failure modes like burst penalty
   2. Tradeoffs between token-bucket and sliding-window
   3. The actual attack patterns your system will face
   4. The mathematical properties of different algorithms

9. Which rate limiting algorithm would be most appropriate for an API that needs to allow occasional bursts while enforcing a strict average rate over time?

   1. Fixed window counter
   2. Sliding-window counter
   3. Token bucket
   4. Strict leaky bucket

10. What is 'burst penalty' in the context of rate limiting algorithms?

    1. When sustained traffic depletes accumulated tokens or credits, causing delays for subsequent requests
    2. A penalty applied to users who exceed the limit
    3. A bonus rate increase for new users
    4. The initial surge of traffic when a service launches

11. When an LLM recommends keying rate limits on multiple dimensions (e.g., user ID plus IP address), what problem is it trying to mitigate?

    1. Token bucket overflow
    2. False negatives where attackers stay under each individual dimension's limit
    3. Latency in rate limit checks
    4. Memory exhaustion

12. In a sliding-window counter algorithm, how is the count calculated when the window slides forward?

    1. The count is divided equally among all intervals
    2. The oldest time interval's count is subtracted and the newest interval's count is added
    3. All counters are cleared and started fresh
    4. The count is multiplied by the window size

13. What must be done to validate a rate limiting design before deploying to production?

    1. Get verbal approval from the team lead
    2. Run traffic samples and load testing
    3. Deploy to a small percentage of users
    4. Write documentation for users

14. Which algorithm strictly enforces a constant output rate regardless of input patterns?

    1. Token bucket
    2. Leaky bucket
    3. Sliding-window log
    4. Sliding-window counter

15. An LLM can surface which of the following when reviewing rate limiting designs?

    1. The precise number of users your API will have
    2. Your exact monthly cloud costs for implementation
    3. Failure modes like thundering herd and burst penalty
    4. The exact attack traffic you will receive next month