A workload uses an Application Load Balancer across two Availability Zones. The application tier must remain available if one zone fails, and sessions cannot depend on a specific instance. Which design best meets the requirement?