A fintech payment API runs on EC2 across two AZs in one Region and must survive AZ loss, instance failures, and traffic spikes without manual intervention while keeping p99 latency low. Auditors require proven failover and automatic replacement of unhealthy hosts. Which technically resilient architecture delivers redundancy, fault tolerance, and self-healing?

The correct design works because an Auto Scaling group spread over three AZs eliminates single-AZ fate sharing, the Application Load Balancer proves failover by routing only to healthy targets, and Auto Scaling self-heals by replacing impaired hosts and adds capacity for spikes, preserving p99 latency. The fixed-capacity variant fails elasticity because without dynamic scaling policies it cannot grow automatically during surges or after AZ loss, so survivors saturate and breach the spike and latency mandate despite good redundancy. The manual-approval variant fails automation because requiring human sign-off before termination stops zero-touch replacement and failover, violating the without-manual-intervention and auditor mandates while inflating recovery time despite resilient topology. The Spot-only variant fails stability because exclusive reliance on interruptible spare capacity without an On-Demand base risks simultaneous reclaims and shortfalls, breaking survival of failures and consistent p99 despite AZ spread and savings. As an exam caveat, treat plausible incomplete designs as wrong when a single keyword like automatic, scaling, or p99 is violated rather than assuming any load-balanced multi-AZ pattern suffices. As a practical check, verify target-group health-check paths and thresholds, load-test scaling policies, and rehearse AZ failure with fault injection while tracking p99 and replacement duration.