DMVPN: one hub, one interface, any number of spokes
Every mechanism gets a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, there is a simulator where you change it yourself.
TL;DR
DMVPN lays a private network over the Internet with one hub and any number of spokes, with no per-spoke configuration on the hub: one mGRE interface on the hub, NHRP so it learns where each spoke is (the spoke registers itself with its current public address) and IPsec to encrypt everything. In Phase 1, all traffic goes through the hub; in Phase 2, spokes resolve each other's next hop and build direct tunnels, but the hub can no longer summarize; in Phase 3, the hub sends a redirect on the first packet, the spoke installs a shortcut (the H route) and summarization is allowed again. The routing protocol needs exceptions for an interface with many neighbors, the MTU drops to 1400, spokes behind NAT register but cannot receive direct tunnels, and the underlay lives in a front-door VRF so the tunnel cannot route through itself.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between IOS versions, standards and platforms (FlexVPN, SD-WAN). In the animations, the configuration lines used at the current step highlight automatically; the ← → arrows change the step when the animation is focused.
The analogy, in short
Think of a company with a head office and traveling sales agents staying in ever-changing hotels: every agent calls the office each morning and says where they are staying today, the office keeps a single address book, and when two agents need to exchange envelopes, the office tells them which hotel to look for each other at, and from then on they send directly, in sealed envelopes.
The model holds up to §9. From §10 onward (two head offices, separate address books for the city and for the company), it stretches; see the full analogy and its limits in §15.