Problem Statement

Shared context — identical in all four questions in this set. The scenario and artifacts below are exactly the same across all four questions; only the Question section changes. If you have already read them in another question, skip straight to Question. You're building a small API gateway for your college's internal apps (results portal, mess feedback, hostel maintenance). You need to add rate limiting per student to prevent abuse and noisy-neighbor effects on a small backend pool. Requirements: Each student is allowed 60 requests per minute on average. Short bursts (e.g., a UI re-rendering and firing 5–10 calls in a second) should not be punished. The gateway runs on 3 nodes behind a load balancer; requests from the same student can land on any node. The gateway runs on a small VM — budget for shared state is modest. Adding a Redis instance is acceptable. The team is debating three options: Fixed window counters (count of requests in the current minute, reset at the top of the minut