Cloud Landing Zone Vocabulary

Key vocabulary

Term	Meaning
landing zone	A pre-configured, secure cloud environment that provides the foundational infrastructure (accounts, networking, security, logging) into which workloads are migrated.
account structure	The hierarchy of cloud accounts or subscriptions (e.g. prod, dev, security, logging) used to organise and isolate workloads.
guardrails	Automated policies (e.g. SCPs, Azure Policies) that enforce security and compliance rules across all accounts in the landing zone.
networking baseline	The foundational network configuration — VPCs/VNets, subnets, DNS, connectivity to on-premises — set up before any workloads land.
CAF (Cloud Adoption Framework)	A structured framework (AWS CAF, Azure CAF, Google CAF) that guides organisations through cloud strategy, planning, and adoption best practices.
"the landing zone is deployed"	A phrase indicating the foundational cloud environment is ready to receive workloads — a milestone before migration waves begin.
"the environment is ready"	Common phrase confirming that networking, accounts, and security controls are in place and migration can proceed.

1. The cloud architect says: "Before we migrate a single workload, we need to deploy the landing zone." What does a landing zone provide?

The first application migrated to the cloud as a proof of concept. A pre-configured, secure cloud environment with accounts, networking, logging, and security controls ready for workloads. A pricing model for reserved cloud capacity.

2. The security team sets up automated policies that prevent any account in the organisation from disabling encryption or creating public S3 buckets. What are these automated policy controls called?

Guardrails Network security groups Cost allocation tags

3. The cloud team establishes separate cloud accounts for production, development, security logging, and shared services before any migration begins. What aspect of the landing zone are they defining?

The networking baseline The account structure The migration wave sequence

4. The team configures VPCs, subnets, private DNS, and a Direct Connect link to the on-premises data centre — all before the first workload is moved. What is this foundational network setup called?

Network peering topology Networking baseline Transit gateway configuration

5. The programme manager emails the team: "The landing zone is deployed — the environment is ready for Wave 1." What does this message confirm?

The first application has been successfully migrated and is running in production. The foundational cloud infrastructure (accounts, networking, security) is in place and migration waves can begin. The cloud contract has been signed and billing has started.

Key vocabulary

Exercise complete!