A stateless web tier runs in an Auto Scaling group behind an ALB. Traffic varies throughout the day. Operations wants the group to add and remove instances automatically to keep average CPU utilization near 50%, without maintaining several step thresholds. Which policy is the best fit?

1. A scaling policy based only on the aggregate CPU sum across all instances.
2. A target-tracking scaling policy using ASGAverageCPUUtilization with a target value of 50.
3. A scheduled action that sets desired capacity to two instances every morning.
4. Use a simple scale-out policy at 50% CPU without configuring any scale-in behavior.