Puppet agent: who asks, who compiles, who changes
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
Puppet is agent-based, pull and declarative configuration management: on each node runs an agent that, every 30 minutes, gathers its facts and asks Puppet Server (TCP 8140, HTTPS with certificates) for a catalog — the list of resources with their desired state, compiled from manifests and Hiera specifically for that node. The agent compares each resource with reality through providers, changes only the differences, respects the relationships (require, notify) and sends a report to PuppetDB. Without a signed certificate there's no catalog; without explicit relationships the order is luck; without the server, the agent applies the last catalog from the cache. On NX-OS the agent runs natively, on IOS it works through a proxy with puppet device, and for ad-hoc operations Bolt and Ansible remain.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms, versions and tools. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a bakery chain: the head office keeps a book of standards, and in each bakery a shift manager calls the head office every half hour, describes their bakery, gets a customized list and goes shelf by shelf, changing only what differs. The head office sends no one; without a badge you don't get the list.
The model holds up to §10. From §11 on (a proxy for devices without an agent, exported resources, compile servers), it gets stretched; see the full analogy and its limits in §16.