A network team stores desired IOS XE interface descriptions, VLANs and SNMP settings in git and wants a nightly run that reports which supported tasks would change, changes nothing when devices already comply, and writes no separate state file. Which automation approach satisfies all three requirements?

The correct approach keeps the source of truth in git and uses idempotent IOS XE modules whose check-mode support lets Ansible report proposed changes without altering compliant devices; diff adds useful detail, and the playbook need not maintain a separate state file. The Terraform approach is a sound way to model infrastructure and preview repeatable changes with a plan, but Terraform relies on a state backend to track managed resources, conflicting with the requirement to write no separate state file. Running the Ansible modules directly in normal mode is also a common idempotent reconciliation pattern and avoids separate state, but it applies changes during the run rather than providing the requested report of what would change beforehand. Rendering a complete configuration and using ios_config with diff can reconcile from git and show configuration differences without separate state, but it reports a whole-configuration diff rather than which supported tasks would change, so it misses the task-level preview requirement. Exam caveat: check mode is not equally supported by every module or task, so verify support for each operation rather than assuming the whole play is safely previewable. Practical check: test the play against a representative device with check and diff enabled, confirm compliant settings show no changes, and inspect that proposed changes are reported without reaching the device.