An administrator is designing a vSAN cluster and wants to minimize the risk of data unavailability if a single host fails. Which vSAN object policy setting directly defines how many host failures can be tolerated for data availability?