Assurance agents: who measures the user's experience, and from where
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
Classic monitoring (SNMP, syslog, NetFlow) tells you whether the devices are healthy; assurance tells you what the path is like for the user, from where the user sits. Three agents: Cloud (on the internet, already installed), Enterprise (in your network: VM, Docker, C9300 / C8300 via app-hosting) and Endpoint (on the laptop and RoomOS, passive + active). They all report to the platform over TCP 443; the tests have layers (Network, DNS, Web, Voice, BGP) and are read together. Catalyst Center doesn't install an agent: it pushes the telemetry (MDT :25103, syslog, NetFlow, network-assurance) through which the device becomes its own agent. On top of it all: baseline, alert rules with minimum sources and X of Y rounds, integrations through API, webhook, OpenTelemetry and ITSM. Most incidents: an agent that's RUNNING but Offline (DNS, VLAN, 443) and a telemetry certificate for another Catalyst Center.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms, standards and Cisco products. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a chain of stores that isn't satisfied with “the shelves are full” reports: it sends undercover inspectors — some already out on the street in other cities, one employed in every store, plus an app on loyal customers' phones — to find out what the customer's path to the checkout is really like.
The model holds up to §11. From §12 on (hijacks, leaks, DDoS at internet scale), it breaks; see the full analogy and its limits in §15.