Fire-station clocks must always use the approved municipal NTP servers even after local troubleshooting. Which automation style should config management prefer?

Fire-station clocks that must remain on approved municipal NTP servers need declarative desired-state configuration: automation declares that NTP (or chrony/systemd-timesyncd settings) must point at the approved servers and converges any drift on each run. Declarative ensure semantics repeatedly reconcile reality to policy, which is exactly what you want after local troubleshooting may have pointed a clock at a random public pool "just to get it working."

An imperative shell snippet that appends random public NTP pools when empty fails because imperative one-shots accumulate unmanaged state, may not remove bad entries, and actively introduce non-approved time sources. Hand-editing chrony.conf during each outage without recording the change fails on auditability and durability—the next outage repeats the tribal-knowledge edit and drift returns. Disabling time sync entirely to avoid configuration complexity fails the operational requirement for correct municipal time, breaking log correlation, certificate validity windows, and scheduled jobs across firehouse systems.

Exam caveat: declarative versus imperative is about how intent is expressed and enforced, not about which NTP daemon binary is installed. A declarative policy can still use different OS tooling underneath; what matters is continuous ensure of the approved servers.

Operational check: point a test fire-station host at a public NTP pool, run converge, and confirm approved municipal servers are restored and unauthorized pools removed; review config-management reports for NTP compliance; and ensure outage runbooks stop leaving undocumented hand edits as the steady state.