A logistics company is designing a new stateless order-intake service in a single Region inside its AWS Organization. The tier runs on Amazon EC2 behind an Application Load Balancer with a relational database, and a new reliability standard requires the whole service to survive the loss of one Availability Zone automatically, with no manual intervention and the lowest practical operational overhead. The workload has no cross-Region or global latency requirement, so the architects want only in-Region changes. Which THREE design choices together make the service withstand a single Availability Zone failure? Select THREE.
- ASpread the EC2 Auto Scaling group across at least three subnets in different Availability Zones and register the targets with the Application Load Balancer in those same zones. Correct
- BDeploy the relational database as an Amazon RDS Multi-AZ instance so a standby in a second Availability Zone takes over automatically when the primary's zone is impaired. Correct
- CEnable the Application Load Balancer in subnets across the same set of Availability Zones so it has healthy nodes to route through if one zone goes offline. Correct
- DCreate a cross-Region read replica of the database in a second Region and promote it whenever the primary Availability Zone becomes unhealthy during normal operation.
- EPlace the entire Auto Scaling group and the database in one Availability Zone and rely on automated instance recovery to relaunch any instance that fails inside that zone.
Why A is correct: An Auto Scaling group spanning multiple Availability Zones lets healthy zones keep serving and replace lost capacity automatically if one zone fails, which is the compute element of in-Region resilience.
Why B is correct: RDS Multi-AZ maintains a synchronous standby in another zone and fails over to it automatically with no manual step, removing the database as a single-zone point of failure at low operational overhead.
Why C is correct: An Application Load Balancer is only zonally resilient when enabled in several Availability Zones, so giving it subnets in each zone lets it keep distributing traffic to healthy targets when one zone is lost.
Why D is wrong: A cross-Region replica addresses Regional disaster recovery, not single-zone failure, and promoting it for a routine zonal fault adds latency, cost and manual steps the in-Region requirement explicitly avoids.
Why E is wrong: Concentrating everything in one Availability Zone leaves the service fully exposed to that zone's loss, and instance recovery only restarts a single host, so it cannot survive a whole zone going offline.