Agent-based vs agentless: who initiates, who holds the state
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator where you change it yourself.
TL;DR
Configuration management means the desired state written once, in a versioned file, and applied automatically and idempotently to all targets. The difference between the two families of tools is who initiates the connection and who holds the state: with an agent (Puppet, Chef, Salt), a program on the node calls its server, asks for the state and applies it itself, periodically — continuous correction, good scaling, but software to install and maintain on every node. Without an agent (Ansible, Terraform, NSO), the control station itself opens SSH, NETCONF or an API to every target and pushes the configuration — nothing on the target, up and running in ten minutes, but the state is applied only when you run. On Cisco devices without Guest Shell the agent cannot run, so Ansible is the default tool; its module runs on the control station and talks to the device over network_cli, netconf or httpapi. Idempotency comes from modules that check the state before acting; Terraform adds a state file and does provisioning, not configuration. Most incidents are about connectivity and identity: the firewall direction, the user, the connection plugin, the timeouts, the clock for certificates.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between tools, platforms and blueprints. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step while the animation is selected.
The analogy, in short
Think of a company with a head office and dozens of buildings across the country. With an agent: in every building lives a caretaker who calls head office every morning, receives the list for his building and fixes only what is not up to standard. Without an agent: nobody lives there; a team leaves head office with the register of buildings and everyone's keys, works through the list and leaves, and until the next visit nobody checks anything.
The model holds up to §11. From §12 onwards (pipelines, NSO with transactions, telemetry) it breaks down; see the full analogy and its limits in §15.