# Interview: hybrid is a design, not an apology Source: https://ai.techclick.in/blog_migrate_interview_hybrid Markdown: https://ai.techclick.in/blog_migrate_interview_hybrid.md Publisher: Techclick Infosec Pvt Ltd 16 hybrid-migration interview scenarios. Landing zone, identity, VPN, control map, rollback. Dummy pay-api lab. ## The ticket Twelve minutes. Whiteboard: dc01 10.20.30.10 , fgt-hq 203.0.113.10 , pay-api 10.20.30.40 , Azure hub 10.40.0.0/16 , AWS hub 10.50.0.0/16 . They will ask if hybrid is a failure. It is not. An accidental hybrid with two password islands is. Strong answer pattern Name the decision (R, landing, identity, path, control, rollback) → name the object (MG, tunnel, A record, NSG vs Firewall) → name the proof (IKE list, nslookup, POST /v1/pay, Sentinel hit) → name the trap. Weak: “we will lift and then see.” Strong: “wave-1 is pay-api rehost into sub-spoke-app after Connect sync and vpn-azure; success is POST /v1/pay; on-prem stays read-only.” Hero · whiteboard If you cannot draw wave-1, you are not ready. Lab data · dummy only On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40 . ## Hybrid forever vs exit Hybrid forever Exit Meaning On-prem stays a site. Cloud is another site. A program to empty the DC, last thing is identity/data. This lab Valid — dc01 retain, SQL may stay, pay-api rehost Valid — but not wave-1, and not this weekend Identity Connect / Cloud Sync stays Cutover directory only after apps do not need Kerberos Network VPN then maybe ER/DX Same, until the last subnet leaves Failure mode Two password islands, two writers Deleting on-prem before soak / before identity exit Hybrid is the default for wave-1. Exit is a portfolio, not a cutover step. ## What they score Landing zone · identity · network · control map · rollback. If your answer skips those five, it is a feature dump. ## 16 questions ### Q1 · Lift the DC this weekend? PM wants every VM on 10.20.30.0/24 moved. Strong No. 6 Rs per app. Wave-1 is pay-api only. dc01 is retain. ### Q2 · What is a landing zone? They point at a subscription with one VM. Strong Identity + MG/OU + hub + logging before the first workload VM. That sub is dirty. ### Q3 · Where does pay-api land? Junior used his personal subscription. Strong sub-spoke-app / Workloads OU. Spoke 10.41.0.0/16 or app VPC 10.51.0.0/16. Not sub-hub, not a sandbox. ### Q4 · New Entra passwords for everyone? Cloud team sent welcome mail. Strong No. Hybrid identity first — Connect or Cloud Sync from dc01. That mail is a password island. ### Q5 · Connect vs Cloud Sync? One forest, no federation yet. Strong Cloud Sync is enough for this lab. Connect if you need PTA/federation/complex topology. Neither replaces dc01 in wave-1. ### Q6 · AWS humans with access keys? Someone created IAM users. Strong IAM Identity Center, sourced from Entra/AD. Keys for humans are a finding, not a design. ### Q7 · ExpressRoute first? Circuit is eight weeks out. Strong VPN now: fgt-hq 203.0.113.10 to Azure 203.0.113.50 and/or AWS 203.0.113.60. ER/DX later for volume/SLA. ### Q8 · VPN up, app dead? IKE green. Users still on the old box. Strong DNS. nslookup pay-api.techclick-lab.in against dc01. Conditional forwarder / Private DNS / Route 53 is the silent breaker. ### Q9 · Overlapping CIDR? Someone wants the spoke to be 10.20.30.0/24. Strong Refuse. IPsec cannot route that overlap. This lab already has 10.40/10.41 and 10.50/10.51. ### Q10 · Lift or rebuild? OS is supportable, app is a black box. Strong Azure Migrate or MGN lift. Rebuild if OS is rotting or the target is PaaS — as a separate program. ### Q11 · IP + DNS + auth tonight? Junior wants one big change. Strong No. One variable and a rollback. Test name first. Production A record last. ### Q12 · NSG equals FortiGate? Checklist says “NSG allow 443.” Strong No. NSG/SG is 5-tuple. Map IPS/WAF/logs to Azure Firewall+WAF+Sentinel or AWS NFW+WAF+Security Hub. ### Q13 · Drop WAF because cloud is secure? Budget slide. Strong Shared responsibility does not cover your HTTP app. Map the control or accept the risk in writing. Do not drop it silently. ### Q14 · VM running — are we done? Portal is green. Strong No. Success is POST /v1/pay on the name, logs on the cloud IP, one writer. ### Q15 · Delete on-prem at flip? License saving. Strong No. Read-only until soak ends. Rollback is DNS back to 10.20.30.40. ### Q16 · Hybrid forever or exit? The closer. Strong Hybrid is a design: dc01 retain, VPN, synced identity, one app at a time. Exit is a later program — identity and data last — not a weekend. Accidental hybrid (two passwords, two writers, no control map) is the failure. ## Weak vs strong Weak Strong Lift everything / reboot the VM 6 Rs, wave-1 = pay-api We have a subscription MG/OU, hub 10.40 or 10.50, logs first Cloud-only accounts Connect / Cloud Sync + IAM Identity Center Wait for ExpressRoute VPN now, ER/DX later NSG is the firewall Control map including IPS/WAF/SIEM VM is running POST /v1/pay + rollback DNS ## How to prove it You are ready when You can walk Q1, Q8, Q12, Q14, Q16 in 90 seconds each with dummy IPs and one proof command each (IKE list, nslookup, control-map row, curl POST, DNS revert). ## Traps Memorising “6 Rs” without a wave-1 sentence still fails. Hybrid forever is allowed. Two writers and two password islands are not. ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Wave-1 answer if they say “move the DC”? Rehost every VM this weekend 6 Rs per app — pay-api only Delete dc01 first Wait for Direct Connect Correct: b . Q1. Q2 Landing zone minimum? Identity + MG/OU + hub + logging before first VM Any subscription named Prod A running VM ExpressRoute only Correct: a . Q2. Q3 VPN up, users still on 10.20.30.40. Ask… What does DNS return for the name? Is the FortiGate license NSE4? Did we buy WAF? Is the VM Running? Correct: a . Q8. Q4 NSG allow 443 replaces FortiGate? Yes No — map IPS/WAF/logs separately Only on AWS Only if FAZ is down Correct: b . Q12. Q5 Cutover success proof? Portal Running POST /v1/pay on the name, one writer Deleted on-prem New Entra passwords Correct: b . Q14. Q6 Hybrid forever is… Always a failure A valid design; accidental dual-IdP / dual-writer is the failure Forbidden by CAF The same as exit Correct: b . Q16. Check answers Reset On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview ## Sources - This series lessons 1–7 — 6 Rs, landing zone, identity, VPN/ER/DX, lift vs rebuild, control map, cutover. - AWS 6 Rs . - Azure CAF Migrate . - Entra Connect . - ExpressRoute · Direct Connect . - Azure hub-spoke · AWS TGW . Related: Azure landing zone · AWS Org / OU . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt