Zone-Based Firewall: zones, sessions and what gets back in
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
The Zone-Based Policy Firewall is the stateful firewall in IOS and IOS-XE: the interfaces join zones, and the policy is written on pairs of zones (zone-pairs), in a single direction. Traffic permitted with inspect creates a session, and the reply is permitted automatically; pass lets traffic through without state, drop drops. Everything you haven't written falls under the default rules: intra-zone permitted, inter-zone with no zone-pair drop, zone ↔ no zone drop, the self zone (the router) permitted until the first zone-pair with it. The incidents come from zone-pairs missing in the direction of initiation, from pass used instead of inspect, from routing protocols forgotten on self and from ACLs written with the public addresses instead of the private ones.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms (IOS, IOS-XE, ASA / FTD) and between versions. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a hotel with several wings: the guest rooms, the public car park, the conference hall. Between the wings, doors with a doorman, each in a single direction. The doorman puts a wristband on you when you go out and writes you down in the register; only those with a wristband get back in, as long as it hasn't expired. For anyone who isn't on his list, the door stays closed, silently.
The model holds up to §7. From §8 on (NAT, VPN, VRF, HA), it stretches; see the full analogy and its limits in §13.