Salesforce Certified MuleSoft Platform Architect – Complete Winter '26 Guide

Anypoint Platform Architecture: Control Plane and Runtime Plane

Control Plane manages all platform operations: Runtime Manager, API Manager, Exchange, Access Management. Runtime Plane executes Mule applications: CloudHub (MuleSoft-managed cloud), Customer-Hosted Mule Runtime (on-premise or customer's cloud), Runtime Fabric (containerised deployment on Kubernetes). CloudHub 1.0 uses proprietary workers; CloudHub 2.0 uses Kubernetes pods. The Platform Architect selects the deployment model based on: data residency requirements, security policies, operational capability, and cost model.

Runtime Fabric: Container-Based Deployment

Anypoint Runtime Fabric (RTF) runs Mule apps in containers on customer-managed Kubernetes clusters. RTF components: Agent (connects cluster to Control Plane), Ingress controller (routes traffic), Monitoring (Titanium). RTF enables: bring-your-own-cloud deployment, air-gapped deployments, co-location with existing Kubernetes workloads. Namespace isolation provides security between applications. Resource allocation defines CPU and memory limits per Mule app. The exam tests RTF vs CloudHub trade-offs and RTF architecture components.

API-Led Governance at Scale

At enterprise scale, governance is critical. API Rating in Exchange evaluates quality (documentation completeness, test coverage, security). Certified assets signal reuse approval. API Catalog provides dependency lineage — shows which APIs depend on which. Conformance checks validate that API specs follow organisational standards (naming conventions, required security schemes, documentation). The Platform Architect designs the governance framework — tooling, process, and incentives to drive reuse and prevent shadow IT integration.

Security Architecture: VPC, VPN, and Encryption

CloudHub VPC (Virtual Private Cloud) isolates the CloudHub network from the public internet. VPC Peering connects the CloudHub VPC to the customer's cloud VPC. VPN (site-to-site) connects CloudHub to on-premise data centres. Dedicated Load Balancer provides static IPs for inbound CloudHub traffic. TLS termination at the load balancer. At-rest encryption is handled by CloudHub's underlying infrastructure (AWS KMS). Anypoint Security Tokenization replaces sensitive data with tokens — PCI DSS compliant.

Operational Excellence: Monitoring and SLAs

Anypoint Monitoring provides: metrics (CPU, heap, response time, throughput), dashboards (pre-built and custom), alerts (threshold-based, anomaly detection). Log Management aggregates application logs with search and filtering. Visualizer shows the API dependency graph — which apps call which APIs, in real-time. SLA enforcement: rate limiting policies in API Manager enforce per-client SLAs. The Platform Architect defines the monitoring strategy — KPIs, alert thresholds, escalation runbooks, and capacity planning processes.

Deployment Model Selection

Know when to use CloudHub 1.0 (managed, simple), CloudHub 2.0 (container-based, more control), Runtime Fabric (self-managed, on-prem or private cloud), and standalone Mule runtimes. Match deployment model to requirements.

High Availability Design

Understand how to design HA: multiple workers in CloudHub, Runtime Fabric cluster configuration, persistent queues for message durability, and load balancer configuration for zero-downtime deployments.

Disaster Recovery Strategy

Know how to plan DR for Anypoint Platform: multi-region CloudHub deployments, VPC peering, database backup strategies, and RTO/RPO targets for different integration tiers.

Platform Security Architecture

Know how to configure VPCs, VPNs, and Dedicated Load Balancers in CloudHub. Understand how Runtime Fabric handles network isolation, TLS termination, and credential management via Anypoint Secrets Manager.

Capacity Planning

Understand worker sizing (0.1 vCore to 8 vCore), how to calculate required capacity based on throughput, concurrency, and payload size, and how auto-scaling works in CloudHub 2.0 and Runtime Fabric.