Design and deploy a multi-layer VPC architecture: how would you segment networks (public, private, management), route between layers, and enforce security with subnets, route tables, and security groups? For a fleet of 2,000 servers, plan the CIDR allocations and estimate how many IPs are required, accounting for per-subnet reserved addresses and future growth. Propose a centralized way to manage both Linux and Windows instances (e.g., configuration management, patching, access control, inventory). Recommend a shared storage solution for concurrent access by multiple servers (e.g., NFS/EFS, SMB/FSx, or alternatives) and compare performance, consistency, and cost trade-offs. Finally, design single sign-on so users authenticate once to access multiple services, including the identity provider choice, trust relationships, and token flows.