Municipal ops wants agent-based or agentless configuration management that repeatedly enforces desired package and service state across fleets of VMs. Which tool category purpose should they prioritize?

Municipal ops that want agent-based or agentless configuration management that repeatedly enforces desired package and service state across fleets of VMs should prioritize configuration automation such as Ansible to declare and enforce package state on hosts. Convergence toward desired state reduces configuration drift across civic server fleets. A metrics graphing UI that only draws charts and never changes host state observes but does not enforce packages. A container runtime that packages apps but does not converge OS package inventories solves a different problem. A CDN edge cache that stores static assets closer to citizens is content delivery, not host configuration management. Exam caveat: configuration management complements IaC—IaC often provisions resources while config tools harden and maintain guest state; exams expect the distinction. Operational check: apply an Ansible (or equivalent) playbook to a pilot VM class, verify packages and services match desired state on re-run (idempotency), schedule periodic enforcement, alert on drift, and store playbooks in the municipal Git repository. In municipal cloud operations, record the chosen control and the rejected alternatives in the change or incident ticket so future on-call staff understand which failure modes were avoided for city services. Re-validate after the next maintenance window that the same decision still holds under current provider limits, identity bindings, and application versions used by the civic platform team.