# Exercise 1: Design a Two-Tier VPC CIDR Layout

```
STEP 1. Given a VPC of 10.20.0.0/16, design 4 subnets: public-a, public-b
        (one per AZ) and private-a, private-b (one per AZ), each /24,
        with no overlaps.
STEP 2. Write the `aws ec2 create-subnet` command for each.
STEP 3. Write the route table + route + association commands that make
        public-a and public-b route to an Internet Gateway, and leave
        private-a / private-b on the main route table (no internet route
        yet — that's the next topic).
STEP 4. Answer the two reasoning questions at the bottom in a comment.
```

## Your Subnet Plan (TODO — fill in real, non-overlapping CIDRs)

```
public-a:  TODO.TODO.TODO.TODO/24   (us-east-1a)
public-b:  TODO.TODO.TODO.TODO/24   (us-east-1b)
private-a: TODO.TODO.TODO.TODO/24   (us-east-1a)
private-b: TODO.TODO.TODO.TODO/24   (us-east-1b)
```

## Commands (TODO)

```bash
VPC_ID=vpc-TODO

aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block TODO --availability-zone us-east-1a
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block TODO --availability-zone us-east-1b
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block TODO --availability-zone us-east-1a
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block TODO --availability-zone us-east-1b

aws ec2 create-route-table --vpc-id $VPC_ID
# TODO: create-route to 0.0.0.0/0 via an internet gateway id
# TODO: associate the route table with public-a and public-b ONLY
```

## Reasoning Questions (answer as comments)

1. Why must `public-a` and `public-b` be in different Availability Zones instead of both in `us-east-1a`?
2. If you forget the `associate-route-table` step for `public-b`, what route table does it fall back to, and what would you actually observe (not "an error" — describe the real symptom)?

## Requirements Checklist

- [ ] All four subnet CIDRs are non-overlapping and fit inside `10.20.0.0/16`.
- [ ] `public-a`/`public-b` are in two different AZs; same for `private-a`/`private-b`.
- [ ] Exactly one custom route table created, with a `0.0.0.0/0 -> igw-xxxx` route.
- [ ] That route table is associated with `public-a` and `public-b` only — not the private subnets.
- [ ] Both reasoning questions answered in your own words, referencing the "falls back to the main route table silently" behavior from the theory file.