Q: You notice thousands of failed login attempts per minute hitting your `/api/v1/login` endpoint from hundreds of different rotating IP addresses. How do you defend against this brute-force attack?

Because the attacker is rotating IPs (a distributed brute force or credential stuffing attack), simply blocking a single IP address will not work.

• Application Rate Limiting: Implement strict rate limits based on the *username* being attempted, locking the account temporarily after 5 failed attempts (with careful consideration to avoid intentional denial-of-service against legitimate users).
• WAF Rules: Deploy a Web Application Firewall with managed rules to detect and block traffic from known malicious botnets, VPNs, and Tor exit nodes.
• Friction/Challenges: If behavior appears suspicious but isn't definitively malicious, inject a CAPTCHA challenge before processing the login request to mathematically prove the client is a human.