AWS CAF and Migration Paths

AWS CAF and Migration Paths

CAF organizes transformation across business, people, governance, platform, security, and operations; a migration path is chosen per workload, not once for an entire portfolio. This lesson applies the rule by selecting a readiness perspective and migration path from constraints and value.

Security delegates role creation to developers, but every role must remain below an approved ceiling even if a broader identity policy is added later. What is the most precise decision? Decision: Require the approved policy as a permissions boundary and grant the task through a separate identity policy. Reason: The intersection of the identity grant and boundary permits the task while enforcing the maximum.

An account already in Organizations must retain its workloads and account ID while becoming governed by Control Tower. What action fits? Decision: Meet prerequisites and enroll the existing account into a registered OU. Reason: Enrollment brings the existing account under controls while preserving ID and workloads.

A global application serves users in two Regions and needs local reads and writes in both with managed replication and multi-Region continuity. Which DynamoDB capability fits? Decision: Use a DynamoDB global table with multi-active replicas in both Regions. Reason: Global tables provide managed replication and multi-active replicas that serve reads and writes.

A SaaS provider assumes roles in many customer accounts. The design must prevent a confused deputy where one customer causes the provider to use another customer’s role. What condition fits? Decision: Require a unique external ID supplied by the provider in the trust policy, with the principal and permissions scoped, without treating the ID as a secret. Reason: The external ID binds AssumeRole to the intended customer context and addresses the confused-deputy problem.

An organization wants to find S3 buckets, KMS keys, and other resources whose resource policies allow access from outside trusted accounts. Which tool fits? Decision: IAM Access Analyzer with a defined zone of trust. Reason: Access Analyzer evaluates policies and generates findings for access outside the zone of trust.

Employees need one central SSO portal for multiple AWS accounts and assigned applications using one identity source. Which service fits? Decision: IAM Identity Center. Reason: Identity Center centrally manages workforce access, SSO, and account and application assignments.

An organization will retire its current CRM, buy a different SaaS product, and migrate data and processes into it. Which 7 Rs strategy applies? Decision: Repurchase. Reason: Repurchase replaces the application with a different product such as SaaS and migrates data or processes.

An organization wants to move a large set of virtualized workloads to a compatible cloud version of the same platform without redesigning each application or changing its architecture. Which 7 Rs strategy fits? Decision: Relocate. Reason: Relocate transfers the compatible environment at the platform level without rewriting applications.

A monolithic application cannot meet a requirement for independently released features and must have its components redesigned to use cloud-native capabilities. Which 7 Rs strategy fits? Decision: Refactor. Reason: Refactor redesigns components to meet a requirement that a simple move cannot provide.

Technology is available, but transformation is stalling because of gaps in skills, roles, culture, and adoption of new ways of working. Which AWS CAF perspective addresses the gap? Decision: People. Reason: People addresses skills, culture, leadership, organization design, and change acceleration.

Leadership must connect cloud investment to strategy, measurable business outcomes, and portfolio priorities. Which CAF perspective? Decision: The AWS CAF Business perspective. Business connects investment to strategy, value, outcomes, and portfolio priorities.

Initiatives conflict, with no unified management of portfolio, risk, benefits, and cloud finance. Which CAF perspective? Decision: The AWS CAF Governance perspective. Governance orchestrates initiatives across benefits, risks, programs, and cloud finance.

The gap is building a scalable hybrid foundation spanning architecture, engineering, provisioning, and application delivery. Which CAF perspective? Decision: The AWS CAF Platform perspective. Platform builds the cloud foundation and modern provisioning and delivery capabilities.

The organizational gap spans assurance, identity, vulnerabilities, infrastructure and data protection, and incident response. Which CAF perspective? Decision: The AWS CAF Security perspective. Security organizes these security capabilities across the transformation journey.

Cloud services must be delivered at an agreed level through observability, incident and problem management, change, performance, and continuity. Which CAF perspective? Decision: The AWS CAF Operations perspective. Operations focuses on service health, availability, and delivery at an agreed business level.

An eligible existing customer has an ongoing migration project that began before the service closed to new customers, uses multiple tools, and needs one place to track application progress. Which service fits? Decision: AWS Migration Hub.. Migration Hub provides a central place to connect migration tools and track application progress.

An eligible existing customer is completing an ongoing migration project begun before the service closed to new customers and needs server inventory, configuration, utilization, and dependency data. Which service fits? Decision: AWS Application Discovery Service.. Application Discovery Service collects inventory, utilization, and dependency evidence for application and wave planning.

Supported servers need lift-and-shift with continuous replication and a test cutover. Which service? Decision: AWS Application Migration Service.. Application Migration Service automates rehosting through replication and test and cutover instances.

Leadership wants migration waves immediately, but gaps in skills, governance, platform, security, and operations have not been measured. What should happen first? Decision: Run a Migration Readiness Assessment across AWS CAF perspectives and record gaps and owners. A Migration Readiness Assessment identifies strengths, gaps, and remediation owners across AWS CAF perspectives before wave planning.

An order front end depends on a database and a shared identity service, but the plan puts each server into an independent wave by server number. How should waves be built? Decision: Group applications from dependencies, business priority, complexity, and migration strategy, and validate the sequence. Migration waves are built around applications, dependencies, business priority, complexity, and migration strategy—not independent server lists.

An organization has a supported .NET Framework repository and wants to move it to modern cross-platform .NET with planning, transformation, and reports, while developers review the output and prove it with builds and tests. Which tool matches? Decision: AWS Transform for .NET with human review, builds, and tests. This is a specific supported AWS Transform for .NET use case, and the output is not accepted until developers review it and builds and tests pass.

An organization completed assess and identified readiness gaps and an initial portfolio. Before large migration waves execute, what does the mobilize phase establish? Decision: Close readiness gaps and establish the landing zone, operating model, tools, and skills for repeatable execution. Mobilize closes readiness gaps and establishes the landing zone, operating model, tools, and skills before migration at scale.

Support for a licensed ticketing system is ending, and the organization approved a SaaS product that fits the workflow with data migration and user configuration. Which strategy applies? Decision: Repurchase by replacing the product with SaaS, migrating data, and adopting its workflow. This is repurchase because the organization adopts a replacement product rather than moving the same virtualized estate.

A portfolio contains a low-value replaceable service, a high-value system needing independent releases, and a workload temporarily bound to hardware. What is the correct strategy method? Decision: Assign each workload a strategy from value, dependencies, change tolerance, and deadline, documenting each rationale. The item tests a per-workload strategy method, not another replatform selection.

A data center must close in six months and the scope contains 120 interconnected VMware virtual machines. The team must temporarily preserve vSphere tooling, the operating model, and compatible licensing, and the schedule does not allow guest changes. Which strategy fits? The decisive constraint is moving the VMware estate while temporarily preserving its virtualization layer, operating tooling, and guests; that is relocate rather than rehost. Acceptance remains gated by network, dependency, and rollback evidence before closure.

An organization plans to migrate 80 applications, but has no wave entry, exit, or rollback criteria. What is the correct next step? Decision: Define entry, exit, rollback, and owner criteria, then run a bounded pilot wave and scale only after it passes. This tests wave execution gates, not another Retire classification.

An existing Migration Hub Strategy Recommendations customer is continuing an ongoing project and has inventory, dependencies, and source code, but modernization dispositions are not assigned. Which resource fits its current eligibility? The case needs modernization dispositions from inventory, dependency, and source evidence, and the customer is eligible because it is continuing an ongoing project. Strategy Recommendations performs that analysis; the alternatives estimate economics, execute a specific transformation, or track progress.

A pilot-wave cutover plan requires at least 99.5% login success across 10,000 attempts and otherwise triggers rollback. After cutover, success is 98.8% and the old environment remains recoverable. What is the decision? Observed success of 98.8% misses the pre-approved 99.5% gate while rollback remains available, so the gate must be applied now. Continuing would turn a bounded reversible failure into wider impact.

Assess found an expertise gap blocking the landing zone and migration factory. What action fits? The proven gap blocks two foundations needed for scale. A specialist supplies immediate capability, while deliverables, acceptance criteria, and knowledge transfer turn it into repeatable organizational capacity rather than uncontrolled dependency.

CRM migration to SaaS is complete, but record reconciliation is 99.6% against a 100% gate, the retention-record restore test failed, and the old system remains a valid rollback path. What is the decommission decision? Strategy selection is complete, but decommissioning is a separate effect governed by data, retention, and integration gates. Failed reconciliation and restore evidence prevent removal of the recoverable path; the same tests must pass after repair before shutdown is authorized.

Business units are adopting cloud, but each team rebuilds patterns, controls, and training alone, so mistakes repeat and knowledge does not transfer. Which adoption intervention fits? The problem is repeatable capability, organization, and knowledge rather than another 7R label. A cloud enablement team combines business, platform, security, and operations to produce reusable patterns, guardrails, and coaching, then measures adoption without becoming a central approval bottleneck that implements everything.

An organization has a value hypothesis, completed readiness assessment, and closed capability gaps, but has not yet proven production adoption or outcome. Which CAF phase fits? The value hypothesis exists and foundational readiness is complete, but production value is unproven. Launch turns the hypothesis into bounded measured evidence before Scale takes on expansion risk.

Leadership proposes “use advanced analytics,” but there is no business-outcome owner, baseline, target, or stop criterion. What decision must precede technology selection? Without an outcome, owner, and measure, technology cannot be evaluated. The decision first defines accountable measurable value and a stop boundary; technology then becomes a means accepted or rejected by evidence.

A production pilot met adoption, latency, and unit-cost criteria across three customer segments, and the operating model proved repeatable. Which transformation phase comes next? Launch evidence is satisfied across representative segments and the model is repeatable. Scale expands production pilots and value to the desired scope while ensuring benefits persist, rather than repeating the MVP or ending measurement.

The program lacks a reliable application inventory, dependency map, and named owners, yet it is asked for a business case and wave plan. What should happen first? The business case and waves depend on knowing what moves, its dependencies, and organizational readiness. Assess produces inventory, readiness findings, gaps, and a directional foundation; Mobilize follows an understood current state.

Each new team takes four days to provision because the same manual requests repeat, although controls and quotas are already approved for every team. Which decision reduces time to value while preserving governance? The blocker is a repeated fixed provisioning path, not missing controls or recovery evidence. Turning approved specifications into a governed self-service product removes manual waiting while retaining inspectable boundaries, with lead time and rejection rate proving the benefit.

Wave A has two undocumented external dependencies and a contract date in six months. Wave B has no external dependency, a business window in four weeks, and tested runbook and rollback. What is the correct initial order? B has the nearer window and proven execution readiness without external dependency, making it a closable first wave. A has explicit prerequisite work, while its contract date still constrains the later gate; the order follows dependency, window, and readiness data.

The organization has defined transformation outcomes and opportunities, but business and technology groups have not agreed on skill and governance gaps, dependencies, or an owned action plan. Which AWS CAF phase fits now? After outcomes are clear, Align addresses the capability gaps and dependencies that stakeholders have not agreed or assigned to an owner in this scenario. Those unresolved or unowned gaps are the required gate here before Launch; this does not mean every AWS CAF capability must be closed before any bounded pilot.

Leadership has not yet defined why it is transforming with cloud: there is no value hypothesis, measurable business outcome, or prioritized opportunity. Which AWS CAF transformation-journey phase comes first? Envision establishes outcomes, opportunities, and the value hypothesis before there is a scope whose capabilities can be aligned or launched. Align follows a defined direction to identify gaps and an action plan; Launch and Scale require a more mature foundation.

An organization wants to validate its migration factory. The easiest application is isolated and uses neither shared identity nor the standard cutover path; a medium-risk application represents 60% of the portfolio and uses both with tested rollback. Which pilot fits? A pilot should prove a repeatable pattern, not manufacture an easy success that bypasses the factory. The representative application exercises common dependencies and gates while bounding risk and rollback.

An organization has an approved large migration scope, executive sponsor, and initial plan. It wants a structured AWS program to support migration at scale, not a tool that moves one server. Which resource fits? MAP is a program that supports customer migrations and operates through eligibility, agreement, and tracking requirements; it is not a particular workload-copy engine. Execution tools can be used within the program but do not replace the needed program structure and governance.

A company uses cloud capabilities to launch a new digital subscription for customers it did not previously serve, with a new value proposition, pricing, and revenue stream. Which AWS CAF transformation domain best describes the primary outcome? Product transformation reimagines business models, value propositions, products or services, and revenue models. Cloud technology enables the change, but the decisive outcome is a new commercial offering rather than technology alone.

An organization redesigns its operating model and forms persistent business and technology teams around products and value streams with agile improvement cycles. It has not launched a new digital offering or revenue stream. Which AWS CAF transformation domain best describes the primary change? Organizational transformation reimagines the operating model and organizes business and technology teams around products and value streams using agile methods. The case does not change the customer value proposition or revenue model, so it is not product transformation, and it is broader than automating one operating step.

DMS validation compares source and target row content alongside replication and reports mismatches for controlled revalidation. Equal row counts can hide different column values and therefore cannot establish content equality. Low lag measures replication timing, not the correctness of each row's values.