A GraphQL-based API Gateway is vulnerable to a 'Denial of Wallet' attack where a single deeply nested query (recursion) can trigger thousands of backend database lookups. What is the most robust defense?

1. A Standard IP-based Rate Limiting (e.g., 10 req/sec) to ensure no single user sends too many queries.
2. B Implementing 'Query Complexity Analysis': The Gateway parses the AST (Abstract Syntax Tree), calculates a 'cost' for the query based on fields and depth, and rejects it before execution if it exceeds a budget.
3. C Rewriting all backend resolvers to use a NoSQL database, which is inherently immune to nested query performance issues.
4. D Increasing the GraphQL engine's thread pool size to handle the massive load of redundant lookups.