VLANs and trunks: several networks on the same cable
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
A VLAN splits a switch into several separate networks; between VLANs, traffic passes only through routing. A trunk carries several VLANs on the same cable, marking each frame with a 4-byte 802.1Q tag — except the native VLAN, which travels untagged and must be identical at both ends. Which VLANs get through is decided by the allowed list, the VLAN's existence on each switch, and STP. DTP and VTP (Cisco) automate trunks and the VLAN list, but they're also the most common sources of incidents and attacks; fixed modes, DTP off, a dedicated native VLAN and VTP v3 or transparent keep them under control.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = IEEE ↔ Cisco differences. In the animations, the configuration lines used at the current step are highlighted automatically; the ← → arrows change the step when the animation is focused.
The analogy, in short
Think of a building with several departments and a single freight elevator between buildings. Each parcel gets a label with its department in the elevator (the tag), and unlabeled parcels go to a department agreed in advance (native VLAN) — which must be the same in both buildings.
The model holds up to §7. From §8 on (attacks, QinQ, VXLAN), it breaks; see the full analogy and its limits in §12.