Explain the difference between declarative and imperative IaC.

WHAT THIS TESTS: This question probes your mental model for infrastructure automation, specifically whether you distinguish between describing the desired end state and scripting the exact steps to get there. Interviewers care less about memorizing definitions and more about understanding the operational consequences of each approach, such as drift detection, convergence, and rollback behavior.

A GOOD ANSWER COVERS: First, a crisp distinction: declarative IaC defines what the infrastructure should look like and relies on a control loop or state engine to make reality match the specification, while imperative IaC defines how to build it through ordered commands or scripts. Second, concrete tool examples: Terraform or AWS CloudFormation for declarative, and Ansible playbooks or Bash scripts for imperative. Third, the trade-off scenario: declarative excels at managing long-lived cloud resources where drift detection and idempotent reconciliation matter, while imperative shines in procedural tasks like software installation, rolling upgrades, or legacy migrations where sequence and conditional logic are unavoidable. Fourth, nuance: many modern tools blend both styles, so acknowledge that Ansible has declarative modules but executes imperatively, and Terraform can contain imperative elements through provisioners.

COMMON WRONG ANSWERS: Calling one approach universally better without naming a context. Confusing idempotency with being declarative; a script can be idempotent yet still imperative. Labeling Ansible as purely declarative or Terraform as purely imperative. Failing to mention state management or drift. Giving vague examples without explaining why a tool fits one category.

LIKELY FOLLOW-UPS: How does Terraform handle state and why does that matter at scale? When would you use Ansible instead of Terraform? How do you manage secrets or dependencies across declarative and imperative pipelines? What happens when someone manually changes a resource managed by a declarative tool?

ONE CONCRETE EXAMPLE: Imagine you need to deploy a three-tier web application on AWS. For the VPC, subnets, load balancers, and RDS instance, you choose Terraform because you want the tool to track state, detect drift if an engineer changes a security group in the console, and converge back to the defined configuration automatically. For bootstrapping the instances, installing agents, and running database migrations in a specific order, you choose Ansible because those steps are inherently procedural and require conditional logic that maps poorly to a pure desired-state model.