A fintech runs payment authorization on EKS across two AZs with ALB health checks and CloudWatch latency alarms. Leaders want proof a single AZ loss keeps p99 under 400ms before peak season, with automatic rollback if steady state breaks. Which chaos engineering approach validates AZ resilience with controlled failure?

The correct approach is right because an FIS experiment template formalizes the chaos hypothesis that payment authorization remains healthy when one AZ is impaired, defines steady state as p99 latency under 400ms measured via CloudWatch, and binds AZ-scoped network disruption to stop conditions that automatically halt and roll back when steady state breaks, which directly proves single-AZ resilience before peak with controlled failure. A sound FIS run that injects AZ disruption with the same p99 hypothesis but requires manual approval to halt fails by safety concept because it lacks automatic rollback and therefore does not satisfy the requirement for self-protecting controlled experimentation. A sound FIS template that tests availability with stop conditions and auto rollback fails by measurement concept because high availability or success rate can remain green while p99 latency exceeds 400ms, so it never validates the stated latency SLO. A well-designed Route 53 rehearsal to a standby Region with latency checks and auto rollback fails by scope concept because cross-Region DNS failover proves geographic recovery, not that the remaining AZ and ALB targets absorb loss within the same Region. Exam caveat is to match fault scope and steady-state metric exactly to the stem rather than selecting any mature resilience test with monitoring. Practical check is to confirm the template targets only subnets or targets in one AZ, maps the CloudWatch p99 alarm to stop conditions, and rehearses rollback in staging.