# Failure Domains and Disaster Recovery

*MuleSoft Platform Architect Study Guide · Deploying API implementations to CloudHub · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/deploying-api-implementations-to-cloudhub/failure-domains-and-disaster-recovery*

Match classic CloudHub recovery designs to tunnel, gateway, site and regional failures, and distinguish application restart settings from infrastructure recovery.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Deploying API implementations to CloudHub
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Identify and avoid single points of failure in CloudHub deployments of API implementations.

## What the exam expects

- Identify worker, availability-zone, region, tunnel, customer-gateway and customer-site failure boundaries.
- Match redundant paths to the component that must survive failure.
- Assign cross-region application, traffic, state and private-network responsibilities.
- Distinguish unresponsive-application recovery from impaired-worker replacement.

**HA** keeps a system accessible through component failure; **DR** restores service after a wider disruption; a **failure domain** groups components that can fail together; **RTO** describes tolerated recovery time; **RPO** describes tolerated data loss; a **customer gateway** terminates the customer's VPN connection ([HA and DR](https://docs.mulesoft.com/cloudhub/cloudhub-hadr), [VPN HA](https://docs.mulesoft.com/cloudhub/vpn-high-availability)). This lesson concerns classic CloudHub deployments.

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Within-region HA | Multiple workers are distributed across availability zones. | [HA/DR](https://docs.mulesoft.com/cloudhub/cloudhub-hadr) |
| Regional DR | Customers own the cross-region application and dependency strategy. | [HA/DR](https://docs.mulesoft.com/cloudhub/cloudhub-hadr) |
| Tunnel maintenance | Configure both supplied tunnels. | [VPN HA](https://docs.mulesoft.com/cloudhub/vpn-high-availability) |
| Gateway failure | Separate endpoints, public IPs and VPN connections are required. | [VPN HA](https://docs.mulesoft.com/cloudhub/vpn-high-availability) |
| Site failure | Put customer gateways in different data centers. | [VPN HA](https://docs.mulesoft.com/cloudhub/vpn-high-availability) |
| Regional state | Object Store v2 does not provide cross-region failover. | [HA/DR](https://docs.mulesoft.com/cloudhub/cloudhub-hadr) |
| Private recovery network | Provide an Anypoint VPC in each required region. | [HA/DR](https://docs.mulesoft.com/cloudhub/cloudhub-hadr) |
| Impaired worker | Replacement attempts are independent of the application-restart checkbox. | [Impaired workers](https://docs.mulesoft.com/cloudhub/cloudhub-impaired-worker) |
| Unresponsive application | With automatic restart disabled, notifications and logs require manual follow-up. | [Monitoring](https://docs.mulesoft.com/cloudhub/worker-monitoring) |

## Check yourself

- When `monitoringEnabled` is changed through the API, which lifecycle follow-up is required?
- Why is one failed readiness probe insufficient to expect the documented consecutive-failure warning?
- When planning around scheduled worker maintenance, where can the actual restart date be inspected?

## Sources

- [CloudHub High Availability and Disaster Recovery](https://docs.mulesoft.com/cloudhub/cloudhub-hadr)
- [Anypoint VPN High Availability](https://docs.mulesoft.com/cloudhub/vpn-high-availability)
- [Impaired Worker Monitoring](https://docs.mulesoft.com/cloudhub/cloudhub-impaired-worker)
- [Application Monitoring and Automatic Restarts](https://docs.mulesoft.com/cloudhub/worker-monitoring)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 4 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams