Question 1

What are the migration strategies, the "7 Rs"?

Accepted Answer

Rehost (lift and shift), replatform (lift and optimise, such as moving a database to RDS), repurchase (move to a SaaS product), refactor or re-architect (redesign for cloud-native), relocate (move VMware workloads without conversion), retain (leave it where it is for now) and retire (decommission what nobody uses). The valuable part is knowing retire and retain are real answers rather than failures. In most portfolio assessments a meaningful share of applications turn out to be unused or not worth moving, and identifying those early is the cheapest win in the programme.

Question 2

How do you decide which strategy applies to a given application?

Accepted Answer

Assess business value, technical fit and change appetite against the deadline. Rehost when a data-centre exit date forces speed and the application works as is. Replatform when a managed service removes real operational burden for limited change. Refactor when the application is strategically important and its architecture blocks the business. Repurchase for commodity functions. The driver to name explicitly is the deadline: a hard exit date forces rehost first and modernisation later. Attempting to refactor everything during a time-boxed exit is the classic way these programmes overrun.

Question 3

What are the phases of a migration programme?

Accepted Answer

Assess — inventory applications, dependencies, utilisation and cost, and build the business case. Mobilise — landing zone, security, networking, operating model, skills. Migrate and modernise — move in waves starting with low-risk applications. Then optimise and, critically, decommission the source. Decommissioning is the step teams skip, which means paying for both environments indefinitely and losing most of the business case. Making it an explicit, tracked deliverable per wave is what a seasoned migration lead insists on.

Question 4

What is AWS Migration Hub and Application Discovery Service?

Accepted Answer

Application Discovery Service collects server inventory, utilisation and network dependency data through an agent or agentless collector. Migration Hub aggregates that into applications and move groups, tracks migration progress across tools, and produces strategy recommendations and cost estimates. The dependency data is the valuable output: it produces move groups so interdependent applications migrate together. Discovering a chatty dependency after cutover, rather than before, is the most common cause of a migration rollback.

Question 5

Why do move groups matter?

Accepted Answer

Because splitting two chatty components across the data centre and AWS usually breaks performance — a call that took a microsecond over a backplane now takes milliseconds over a WAN, and a chatty protocol amplifies that. Move groups keep interdependent systems together in the same wave. Latency amplification is the specific mechanism to explain: an application making a thousand database round trips per page becomes unusable across a WAN even though each individual call is only a few milliseconds slower. That arithmetic is what makes the point concrete.

Question 6

What is AWS Application Migration Service?

Accepted Answer

MGN performs continuous block-level replication from source servers — physical, virtual or other-cloud — into a low-cost staging area in AWS, then launches them as EC2 instances at cutover with minimal downtime, including test launches that do not disrupt the source. Non-disruptive test launches are the feature that makes cutover credible: you validate the migrated instance in an isolated VPC before touching production. Continuous replication keeps the cutover window to minutes rather than the hours a full copy would take.

Question 7

How do you migrate a database to AWS with minimal downtime?

Accepted Answer

AWS Database Migration Service in continuous replication mode: a full load followed by ongoing change data capture from the source, so cutover is only the time to stop writes, let replication drain and repoint the application. The Schema Conversion Tool handles heterogeneous migrations, and DMS validation compares source and target data. The blockers to check early are unsupported features, stored procedures and extensions, because discovering them at cutover is fatal to the schedule. Rehearsing the cutover to measure the actual drain time rather than assuming it is instant is the other discipline.

Question 8

How would you move 500 TB of data into AWS?

Accepted Answer

Calculate transfer time over available bandwidth first. If feasible, DataSync with parallelism, verification and scheduling. If the network would take months, Snowball Edge devices. For ongoing sync after the bulk move, DataSync incremental tasks or Storage Gateway. The arithmetic is what makes the answer credible: 500 TB over a saturated 1 Gbps link is roughly 50 days at perfect efficiency, and real efficiency is much lower. Rejecting "we will run the CLI in a loop" as a plan is part of the answer.

Question 9

What is a landing zone and why build it before migrating?

Accepted Answer

A landing zone is the pre-built foundation — Organizations and account structure, identity federation, IAM model, network topology and IP plan, guardrails, logging, monitoring, billing and IaC pipelines — that workloads land into. Building it first means every migrated workload inherits governance rather than being retrofitted. The decisions painful to change later are the ones to emphasise: the account structure, the CIDR plan and the identity model. Control Tower is the accelerator to name rather than building it by hand.

Question 10

What is AWS Control Tower?

Accepted Answer

Control Tower sets up and governs a multi-account environment: it creates an organisation with a landing zone, log archive and audit accounts, applies preventive and detective guardrails as SCPs and Config rules, and provides Account Factory for provisioning new accounts with standard configuration. The value is that it encodes the multi-account landing zone pattern rather than requiring you to build it. The consideration is that it is opinionated, so heavily customised environments sometimes outgrow it and move to a custom foundation.

Question 11

What is a migration wave and how do you sequence them?

Accepted Answer

A wave is a batch of applications migrated together, defined by move groups. Sequence by risk and learning: start with low-risk, low-dependency applications to build capability and prove the landing zone, then progressively more critical systems, keeping the most complex for when the team is experienced. The counter-intuitive point is not to start with the easiest *and* least visible application, because a pilot with no business visibility fails to build momentum or funding. A low-risk but visible application is the better first wave.

Question 12

How do you plan a cutover and a rollback?

Accepted Answer

Define the exact sequence and timings, the freeze window, validation checks with pass criteria, the communication plan, and a rollback trigger with its own time limit. Rehearse the whole thing in a non-production run, and agree who makes the go or no-go decision. The rollback time limit is what most plans omit: without a defined point of no return, teams keep trying to fix forward past the window and turn a short outage into a long one. Naming that decision point is what an experienced migration lead does.

Question 13

What is the AWS Well-Architected Framework?

Accepted Answer

A set of six pillars for evaluating architectures — operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability — with a question set per pillar and the Well-Architected Tool for recording reviews, tracking high-risk issues and producing improvement plans. The value in an interview is using the pillars as a structure for design answers and naming which pillar you are trading away in a given decision. Lenses — serverless, SaaS, machine learning, financial services — are the extensions worth mentioning.

Question 14

How would you run a Well-Architected review?

Accepted Answer

Scope it to one workload with the team that owns it, work through the pillar questions honestly, record high and medium risk issues, then prioritise them into a remediation plan with owners and dates. Repeat periodically, since a workload drifts as it evolves. The honesty point matters: a review where everyone says the right thing produces no findings and no value. Framing it as a collaborative improvement exercise rather than an audit is what gets useful answers out of the team.

Question 15

What is the difference between lift-and-shift and lift-and-optimise?

Accepted Answer

Lift and shift moves the workload unchanged — fastest and lowest risk, but carries over inefficiencies and delivers little cloud benefit. Lift and optimise makes targeted changes during the move — right-sizing, replacing a self-managed database with RDS, moving files to S3 — for more effort and a materially better outcome. The pragmatic position is that some optimisation during the move is almost always worth it, because right-sizing and managed-service substitution are cheap changes with large recurring benefit, while full re-architecture is not. Naming that middle path is the balanced answer.

Question 16

How do you build the business case for a migration?

Accepted Answer

Compare total cost of ownership: current data-centre costs including hardware refresh, power, space, licensing and staff, against right-sized AWS costs modelled from measured utilisation with expected discounts. Add the value of agility, resilience and avoided capital expenditure, and be explicit about migration cost and dual-running during transition. Right-sizing from measured utilisation is where most of the saving comes from, because on-premises servers are provisioned for peak and years of growth. A like-for-like specification comparison usually shows cloud as more expensive and is the wrong analysis.

Question 17

What are the most common reasons migrations fail?

Accepted Answer

Unknown dependencies discovered at cutover; underestimating data transfer time; no landing zone so governance is retrofitted; attempting to modernise and migrate simultaneously; insufficient skills; no decommissioning so costs double; and treating it as a purely technical project without business ownership of each application. The dual-running cost is what destroys business cases quietly: if the source is never switched off, the programme delivers negative savings regardless of technical success. Naming it as a tracked deliverable rather than an assumption is the practical insight.

Question 18

How do you handle applications that cannot be migrated?

Accepted Answer

Retain them and connect them properly — Direct Connect or VPN for network reachability, identity federation for consistent access control, and log forwarding so they appear in the same observability platform. Plan their eventual replacement or retirement on a separate track with a review date and an owner. The organisational risk is that the exception list grows until the hybrid state is permanent and unmanaged. Attaching a review date and an owner to each retained application is the governance step that prevents it becoming the default.

Question 19

How do you handle licensing when migrating commercial software?

Accepted Answer

Check whether licences are portable to the cloud, whether they are counted per physical core — which may require Dedicated Hosts — and whether the vendor offers a bring-your-own-licence or a licence-included option. AWS License Manager tracks entitlements and can enforce limits. Dedicated Hosts for per-physical-core licensing is the specific AWS answer, and it is a real cost and design factor rather than a footnote. Discovering a licensing constraint after designing the compute layer forces a redesign, so it belongs in assessment.

Question 20

What is VMware Cloud on AWS or a relocate migration?

Accepted Answer

Relocate moves VMware-based workloads to a VMware-compatible environment on AWS infrastructure without conversion, so virtual machines run unchanged with the same tooling. It gives the fastest possible exit from a data centre, with modernisation deferred entirely to later. It is the answer to an extremely tight exit deadline with a large VMware estate. The consideration is that it delivers no cloud-native benefit by itself, so it must be paired with a credible modernisation plan or it becomes a permanent hosted data centre.

Question 21

How do you migrate from another cloud to AWS?

Accepted Answer

Map services rather than translating literally, move data with DataSync or the service's native export, redesign identity because the models differ substantially, and plan for networking differences. Run in parallel with replication where possible, cut consumers over progressively, and validate before decommissioning. The identity point is the one candidates underestimate: policy models differ enough that a mechanical translation produces either over-permissive or broken access. Redesigning identity is a workstream rather than a conversion script.

Question 22

How do you validate that a migration succeeded?

Accepted Answer

Functional testing against agreed acceptance criteria; performance comparison against a baseline captured *before* cutover; data reconciliation with counts and checksums; integration verification with upstream and downstream systems; and a monitoring period before declaring success and decommissioning the source. Capturing the performance baseline before migrating is the step that must be planned in advance, because "it feels slower" is unresolvable without it. Data reconciliation with checksums rather than a spot check is the other rigorous element.

Question 23

How do you decommission source infrastructure safely?

Accepted Answer

Confirm no traffic reaches it using flow logs and monitoring over an agreed observation period; verify data backups are retained per policy; power it down rather than deleting for a cooling-off period; then decommission fully, cancel licences and contracts, and confirm the cost reduction appears in the next billing cycle. The observation period with traffic monitoring is what catches forgotten integrations — a nightly job or a partner system nobody documented. Verifying the cost actually fell is the step that closes the business case rather than assuming it.

Question 24

How do you upskill a team during a migration?

Accepted Answer

Pair experienced cloud engineers with the existing team on real workloads rather than relying on courses alone; start with lower-risk waves to build confidence; establish a cloud centre of excellence producing reusable patterns and modules; and use certifications to structure learning while insisting on hands-on work. The point interviewers value is that a partner doing the migration for you leaves an operational gap when they leave. Building capability during the programme rather than after it is the difference between a migration and a permanent outsourcing dependency.

Question 25

What is a cloud centre of excellence and what should it own?

Accepted Answer

A small central team owning the landing zone, shared IaC modules, reference architectures, guardrails, cost governance and enablement, while application teams own their own workloads. It is an enabling function producing paved paths, not an approval gate. The failure mode to name is a CCoE that becomes a ticket queue every change must pass through, recreating the bottleneck cloud was meant to remove. Framing it as producing paved paths rather than approvals is what distinguishes a good model.

Question 26

What is the AWS Migration Acceleration Program?

Accepted Answer

MAP is AWS's structured migration programme with three phases — assess, mobilise, and migrate and modernise — combining methodology, tooling, partner support and funding incentives tied to migrated workloads. It comes up frequently at consultancies and partners because it is how large migrations are commercially structured. The technically relevant part is the phased methodology, which mirrors good practice regardless of the funding.

Question 27

How would you approach a data-centre exit with a fixed eighteen-month deadline?

Accepted Answer

Assess and build the landing zone in parallel in the first months; classify the portfolio biased towards rehost and retire given the deadline; sequence waves by dependency and risk with a visible early pilot; run migration factories with repeatable runbooks; defer modernisation to a post-exit track; track decommissioning per wave; and hold a buffer at the end for the hardest applications. The judgement being tested is resisting the temptation to modernise during a deadline-driven exit. Rehost now, modernise later is the correct call, and being willing to defend that against a preference for cloud-native purity is what an experienced lead does.

Question 28

How do you handle security and compliance during a migration?

Accepted Answer

Build the security foundation into the landing zone before workloads arrive — identity federation, guardrails, encryption defaults, logging to a locked account, GuardDuty and Security Hub organisation-wide. Map each workload's compliance requirements to controls, and use Artifact and Audit Manager for evidence. Retrofitting security after workloads have landed is dramatically harder, because you are changing running systems rather than setting defaults. Naming that sequencing — controls before workloads — is the point.

Question 29

What networking differences should you plan for when migrating to AWS?

Accepted Answer

VPCs are regional so multi-region needs peering or Transit Gateway; security groups are stateful and can reference each other, which is the idiomatic pattern; NACLs are stateless and easy to misconfigure; and the CIDR plan must not overlap with on-premises or partner networks because it cannot be changed later. The CIDR plan is the least reversible decision and the one most often rushed. Naming that overlapping ranges make peering and hybrid connectivity impossible without renumbering is what makes the point land.

Question 30

How do you manage risk during a large migration?

Accepted Answer

Wave-based delivery so failures are contained; rehearsed cutovers with defined rollback and a time limit; a maintained dependency map; parallel running with reconciliation where feasible; a communication plan; and a risk register reviewed regularly with owners. Every wave should produce lessons that change the next one. The feedback loop is what separates a programme that improves from one repeating the same failure twenty times. Naming a post-wave review with concrete runbook changes is the practice that delivers it.

Question 31

What metrics would you report to executives during a migration?

Accepted Answer

Applications migrated against plan, waves completed, source infrastructure decommissioned, run-rate cost in both environments, incidents caused by migration, and business outcomes such as deployment frequency or time to provision. Not raw technical counts like servers moved. Reporting decommissioning alongside migration is the honest pairing, because migrated-but-not-decommissioned is negative progress financially. Choosing outcome metrics over activity metrics distinguishes a programme lead from a project tracker.

Question 32

What is a proof of concept versus a pilot?

Accepted Answer

A proof of concept validates a technical question in isolation and is usually thrown away. A pilot migrates a real, production-bound application end to end through the real process, and its output is both a running workload and a validated migration method. A successful proof of concept proves very little about a programme that is mostly about process, dependencies and organisational readiness. Insisting on a real pilot before committing to waves is the right sequencing.

Question 33

How do you modernise after a lift-and-shift?

Accepted Answer

Prioritise by business value and pain: replace self-managed databases with RDS or Aurora; containerise services that deploy frequently; move batch jobs to Fargate or Lambda; adopt managed messaging; and decompose only where independent scaling or deployment genuinely requires it. Run it as a continuing track with its own backlog, not a project. Treating modernisation as an ongoing product investment rather than a phase is the framing that survives contact with reality, because a one-off modernisation project loses funding once the migration savings are booked.

Question 34

What is the sustainability pillar and what does it ask?

Accepted Answer

The sustainability pillar addresses the environmental impact of cloud workloads: maximising utilisation so fewer resources are provisioned, choosing efficient instance types such as Graviton, using managed services with higher aggregate utilisation, minimising data movement and storage, and choosing regions with lower carbon intensity. The useful observation is that most sustainability actions are also cost actions — right-sizing, deleting unused data, and higher utilisation reduce both. Framing it that way makes it actionable rather than aspirational.

Question 35

How do you estimate the AWS cost of an on-premises workload?

Accepted Answer

Collect actual utilisation — CPU, memory, storage, IOPS, network — over a representative period, right-size to AWS instance types from that rather than nameplate specifications, add storage, transfer and managed-service costs, apply expected discounts, and present a range with assumptions stated. Migration Evaluator and Migration Hub strategy recommendations do this from collected data, which is more defensible than a spreadsheet built from server specifications. Presenting a range rather than a single number is what survives scrutiny.

Question 36

What is the role of an AWS partner in a migration and how do you work with one?

Accepted Answer

Partners bring migration experience, accelerators, certified capacity and access to funding programmes. The engagement should be structured for knowledge transfer — joint teams rather than a delivery silo, shared repositories, documented runbooks — with clearly defined ownership at handover. This comes up constantly at consultancies and partners, and the answer that reads as experienced plans for handover from day one. A migration that leaves the customer unable to operate the result has not succeeded.

Question 37

How do you handle a workload with strict data residency requirements?

Accepted Answer

Restrict regions with SCPs and the aws:RequestedRegion condition; use only in-region services and verify each is available there; ensure backups, replicas and logs also stay in region, which designs frequently miss; and consider Outposts or Local Zones where the requirement is stricter than any region can satisfy. Backups and replicas are the part designs overlook: a cross-region backup copy or a global service configuration can silently move data out of jurisdiction. Enforcing residency with an SCP rather than convention is the control that actually holds.

Question 38

Design a migration plan for a 400-application enterprise estate.

Accepted Answer

Assess with Application Discovery Service and Migration Hub to build inventory, dependency map and utilisation baseline, classifying with the 7 Rs and expecting a meaningful retire population. Build a Control Tower landing zone with account structure, federated identity, network and CIDR plan, guardrails, centralised logging and IaC pipelines before any workload moves. Establish a CCoE producing paved paths. Run a visible pilot, then migration factories delivering waves by move group using MGN and DMS, with rehearsed cutovers and defined rollback. Track decommissioning as a wave deliverable, defer modernisation to a post-migration track prioritised by business value, and build internal capability through paired delivery. The closing scenario. The senior markers are landing zone before workloads, decommissioning as a tracked deliverable, deferring modernisation, and building capability during the programme — those four are where large migrations actually succeed or fail.

AWS Migration & Well-Architected Interview Questions and Answers

How to use this set