A bank runs a 12-year-old .NET monolith for payments that cannot tolerate downtime or big-bang rewrites. Leaders want incremental moves to microservices and serverless for fraud checks first, then other domains over 18 months. Which refactor modernization pattern enables low-risk incremental decomposition of the monolith?

The strangler fig pattern with an ALB facade is correct because it places a routing layer in front of the .NET monolith and incrementally intercepts only fraud-check calls to new Lambda microservices, allowing parallel running, gradual traffic shifting, and rollback with zero downtime while preserving payments continuity over the 18-month roadmap. The containerized ECS variant fails on hosting concept because while it preserves incremental fraud-first decomposition, it delivers containers requiring ongoing cluster management rather than the requested serverless model for elastic fraud workloads. The rebuild-then-migrate-all-together variant fails on delivery concept because although it builds the right serverless fraud capability, it reintroduces big-bang risk by moving all payment domains in one event, violating the cannot-tolerate-downtime and phased migration constraints. The ledger-first strangler variant fails on sequencing concept because despite using correct incremental serverless mechanics, it prioritizes the wrong bounded context and leaves high-value fraud risk in the monolith, contradicting the explicit fraud-checks-first driver. As an exam caveat, do not select an answer merely for containing strangler, ALB, or Lambda keywords without verifying target architecture, migration granularity, and domain order against every stem constraint. As a practical check, confirm facade route percentages, anti-corruption layers, dual-run fraud scoring parity, and canary rollback criteria before increasing traffic to the new services.