Availability zones (failure domains)
You divide one site into independent halls. Each hall has its own power feed and its own cooling, so a tripped breaker or a dead chiller only darkens part of the floor instead of all of it. The rest of the site keeps serving customers while you deal with the failure in the affected hall.
Customers on a "multi-AZ" contract get a copy of their service running in each hall at once. When a hall goes down, their other copy is already live and carrying traffic, so they ride straight through an outage that would have taken a single-hall customer offline. They pay more for it because it costs you twice the hardware to deliver.
Detailed explanation
An AZ is an independent power + cooling failure domain inside a region. An AZ-outage incident takes every host in that AZ offline in one stroke; the blast radius is the whole hall, not one rack. Sizing redundancy is a question of how many AZs you can spread replicas across.
Multi-AZ only buys you anything if the placement constraint forces replicas onto distinct AZ ids. Anti-affinity rules do exactly that. A multi-AZ customer survives a full AZ outage because the allocator guaranteed their second replica never landed in the AZ that just died — single-AZ deployments cannot mathematically promise 99.99%.