ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using an Auto Scaling group that spans at least two Availability Zones distributes instances so that a failure in one AZ does not take the entire service offline. Setting the group's minimum and desired capacity to two guarantees at least one instance per AZ at all times, and the health checks allow automatic replacement of failed instances, satisfying the resilience requirement without manual effort or significant extra cost. Attaching an ALB with cross-zone load balancing lets the load balancer route traffic only to healthy targets across the remaining AZs. Enabling AWS-provided default EBS encryption ensures that every new root or data volume created for the instances is encrypted automatically, meeting the compliance mandate without additional per-volume configuration. The other options either keep all instances in one AZ, rely on cross-Region failover (increasing cost and complexity), or use mechanisms (placement groups, S3 for root volumes) that do not provide the required multi-AZ high availability and automated recovery.