A web application runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer and must stay available if an entire Availability Zone fails. How should the architecture be designed?
Show answer and explanation
Answer: B
Reserving subnets in two or more Availability Zones lets the Auto Scaling group keep serving traffic with the instances in healthy zones while it replaces whatever an impaired zone took out. The ALB meanwhile removes targets in the failed zone from rotation, so client requests continue landing on healthy instances.
This is the baseline pattern for a stateless tier that must survive zonal failure — no extra products, just a multi-AZ group.
Why the other options are wrong
- A. All instances in a single zone fail together when that zone becomes impaired, regardless of how large the instance type is.
- C. Reserved Instances are a billing commitment, not a failure-isolation design, and adding multi-Region failover is a far heavier solution than spanning AZs for a single-Region workload.
- D. An Auto Scaling group has no Multi-AZ switch — multi-AZ behavior comes from listing subnets in multiple zones — and switching to an NLB does nothing to improve zonal fault tolerance.