The city wants 311 VDI to survive a single Connection Server crash. Which high-availability pattern matches that goal?

Surviving a single Connection Server crash for 311 VDI means adding a second Connection Server behind a load balancer. In municipal EUC terms, treat the endpoint as a window into city systems when the architecture says so, not as the system of record for the files or apps in the stem. Distractor concept: DRS does not handle broker failure via host load balancing. Distractor concept: Nightly snapshot of one clerk VM is not Horizon broker HA. Distractor concept: DMZ placement of UAG is remote access placement, not broker HA by itself. Exam caveat: Broker HA = multiple Connection Servers + load balancing; DRS, snapshots, and UAG placement are different controls. Operational check: Place two brokers behind a VIP, stop one, and confirm new 311 launches still succeed. Record the chosen control and the rejected failure modes in the civic change ticket or runbook so on-call staff and auditors share the same rationale after the next maintenance window. Re-validate after personnel or image changes that the same control still meets the city's continuity, security, and support expectations for this service. Helpdesk coaching tip aligned to the conversational brief: One broker crashing should not darken every 311 window. A second Connection Server behind a VIP is the spare front desk. DRS and a DMZ UAG do not stand in for that extra broker.