A food-delivery platform processes orders through API Gateway, Lambda, DynamoDB, and SQS during peak dinners. A single AZ outage or Lambda throttle must not drop orders, and failed tasks must recover without manual steps. Which design delivers redundancy, fault tolerance, and self-healing?

The correct design meets redundancy, fault tolerance and self-healing together because multi-AZ distribution, durable buffering and automated recovery each cover a distinct failure. A load balancer spread across zones eliminates single-AZ exposure for intake, SQS decouples API acceptance from Lambda execution so peak bursts and throttles become queued waits with visibility timeouts and retries rather than dropped orders, DynamoDB global tables maintain replicated durable state that remains available during zonal failure, and Lambda retries with health-checked autoreplacement restore failed tasks without human action. The direct synchronous invoke design fails elasticity by removing decoupling, so any concurrency throttle returns errors to callers instead of persisting work for later execution. The single-AZ database design fails redundancy because durable front-end queuing cannot compensate when authoritative state is pinned to one fault domain that becomes unavailable. The manual DLQ re-drive design fails autonomy because preserving queues and replication still violates the explicit no-manual-steps mandate and lengthens mean time to recovery. Exam caveat is to distinguish scalable buffering from merely adding compute, since Auto Scaling without a queue still drops throttled requests. Practical check is to inject an AZ failure under load while throttling Lambda and confirm queued depth drains automatically with replica lag near zero and no operator replay.