Infrastructure and Platform Migration
Domain scope
This domain covers landing zones, network, identity, compute, storage, and platform services. The exam tests whether the target environment is secure, repeatable, and operable before workloads arrive.
Core rules
- Design a landing zone first: account or subscription structure, identity federation, logging, guardrails, network segmentation, and cost tags. Use infrastructure as code so environments are reproducible.
- Plan connectivity with required bandwidth, latency, redundancy, and routing. Avoid overlapping CIDRs; define DNS forwarding and egress paths.
- Apply least privilege through roles and groups, not shared keys. Separate platform administration from workload administration.
- Size compute and storage from observed utilization, not peak nameplate. Account for quotas, service limits, and regional availability.
- Design backup and disaster recovery to RTO and RPO, then test restore. A backup that has never been restored is an assumption.
Worked example
A company builds a hub-and-spoke landing zone with a shared connectivity hub, separate production and nonproduction spokes, centralized logging, and federated identity. The old data center uses 10.0.0.0/16; the cloud proposal reuses it, which would break VPN routing. The architect re-addresses the cloud spokes to 10.20.0.0/16 and 10.30.0.0/16, updates firewall rules by application group rather than copying hundreds of legacy rules, and adds a documented egress path through a NAT gateway. Quotas for GPU instances are raised before the analytics wave.
Traps
Copying legacy firewall rules one-for-one; overlapping CIDRs; forgetting DNS and egress; assuming default quotas are sufficient; and building production and nonproduction with different, undocumented controls.