# VPC Requirements and Network Boundaries

*MuleSoft Platform Architect Study Guide · Architecting and deploying API implementations · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/architecting-and-deploying-api-implementations/vpc-requirements-and-network-boundaries*

Choose classic CloudHub VPC boundaries, ownership and worker access controls while keeping network placement separate from environments and load balancers.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Architecting and deploying API implementations
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Identify requirements that call for the use of an Anypoint Virtual Private Cloud (VPC).

## What the exam expects

- Identify requirements for isolated classic CloudHub networks.
- Place VPC ownership where intended business groups can inherit access.
- Separate environment associations, worker placement and firewall permissions.
- Account for disruptive foundational changes and VPN entitlements.

An **Anypoint VPC** is an isolated network for classic CloudHub workers; a **CIDR block** defines its address space; an **environment association** contributes to placement; a **firewall rule** admits specified inbound worker traffic ([VPC overview](https://docs.mulesoft.com/cloudhub/virtual-private-cloud), [provisioning](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept), [firewall scope](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Isolation | A VPC is a distinct worker network segment. | [Overview](https://docs.mulesoft.com/cloudhub/virtual-private-cloud) |
| Environments | Several environments can share one VPC. | [Overview](https://docs.mulesoft.com/cloudhub/virtual-private-cloud) |
| Sharing | Ownership supports downward hierarchy sharing. | [Provisioning](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| Foundational changes | Remove workers, change settings, then redeploy. | [Provisioning](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| VPN allocation | Entitlements need not attach one per VPC. | [Provisioning](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept) |
| Rule scope | Inbound worker connections only. | [Firewall](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept) |
| Internal custom ports | Private endpoint and matching source/port permission are required. | [Firewall](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept) |
| Rule deletion | No confirmation dialog appears. | [Firewall](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept) |

## Check yourself

- Which port range can a classic VPC firewall rule not configure?
- When the VPC license limit has been reached, what happens to the creation control?
- When editing a firewall rule, what does its Type field select?

## Sources

- [Virtual Private Cloud](https://docs.mulesoft.com/cloudhub/virtual-private-cloud)
- [Provision a VPC](https://docs.mulesoft.com/cloudhub/vpc-provisioning-concept)
- [VPC Firewall Rules](https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams