One availability zone becomes unavailable. Walk through what happens to a typical three-tier application and what you would have changed.

What survives and what does not

Load balancer — regional, survives, and stops routing to targets in the failed zone once health checks fail. Note the detection delay: check interval times threshold, often tens of seconds, during which requests are still sent there.

Application instances — a third are gone. If the autoscaler is configured across zones, replacements launch elsewhere; if capacity was sized without headroom for a zone loss, the remaining two-thirds are now at 150% of their previous load and may fail in turn.

Managed database, multi-AZ — fails over automatically, with a connection interruption of seconds to a minute. Applications without proper reconnection handling experience this as an outage.

Managed database, single-AZ — gone. Recovery is a restore, measured in hours.

Cache cluster — if single-zone, it is gone entirely, and the application now runs with a cold cache under full load, which is frequently more damaging than the zone loss itself.

NAT gateway — if there is one, in the failed zone, then all private egress is dead, including from the surviving zones. This is the single most common hidden single point of failure.

Block volumes in that zone are unreachable; they cannot be attached across zones.

What I would have changed

A NAT gateway per zone, with route tables per zone. Cheap, and it removes the most common cross-cutting failure.

Capacity headroom for N-1 zones. Running three zones at 33% each means a zone loss puts you at 50% — fine. Running at 80% each means the survivors cannot absorb it. This must be sized deliberately.

Multi-AZ for every stateful component, including the cache, and accepting the roughly doubled cost. Cache is the one most often left single-zone on cost grounds, and it is the one whose loss hurts most.

Reconnection handling tested by deliberately failing over, so the database failover is a blip rather than an outage.

What a strong answer adds

Naming the cold cache as the dominant risk. A system running comfortably at 4× traffic on a warm cache cannot recover with an empty one: the database saturates, nothing completes, and the cache never fills. The mitigations — request coalescing, cache warming, load shedding during recovery — are design decisions taken long before the zone fails.