You operate a web application that requires the processing capacity of 6 instances at all times during peak hours, using an Auto Scaling group spread evenly across three Availability Zones. If you want to maintain peak processing capacity even when one AZ goes down completely, which minimum capacity setting is the most appropriate?

Explanation

When instances are distributed evenly across three AZs, losing one AZ loses one third of the total at once. The remaining two thirds must cover the 6 instances needed at peak, so 6 / (1 - 1/3) = 9 instances are required. Placing 3 instances per AZ leaves 6 after losing one AZ.

Per-choice explanations

Practical Use

Simply "being Multi-AZ" does not make you resilient to an AZ failure. An EC2 Auto Scaling group tries to distribute instances evenly across the specified subnets (that is, AZs), but if one AZ goes down, the instances in that AZ are lost simultaneously. Therefore, to maintain the required processing capacity after an AZ failure, you need the concept of static stability, in which you provision capacity that already accounts for what will be lost. If the required capacity is N and the number of AZs is Z, the total number of instances needed to survive the loss of one AZ is the ceiling of N / (1 - 1/Z). That is twice N for 2 AZs, 1.5 times for 3 AZs, and about 1.34 times for 4 AZs, so the more AZs you use, the lower the required surplus ratio. One objection is that "if an AZ goes down, Auto Scaling will automatically replenish capacity in the remaining AZs, so surplus is unnecessary." In practice, however, replenishment takes time to launch, initialize, and pass health checks, and during an AZ failure other customers in the same Region also demand capacity at once, so you cannot count on immediately obtaining the capacity you need. The point of static stability is to already have the capacity you need running at the moment the failure occurs. As a related setting, changing the Auto Scaling group's health check type from EC2 to ELB also makes instances whose application is unresponsive due to a process failure eligible for replacement. On SAA-C03, this appears as a calculation question that asks you to choose a minimum capacity or desired capacity under the condition that performance must be maintained even if one AZ goes down. Remembering the ratios — 1.5 times the required capacity for a 3-AZ design and 2 times for a 2-AZ design — lets you answer instantly. Options with excessive instance counts are wrong from a cost optimization perspective, so it is important to read the question as asking for the smallest configuration that satisfies the requirement.