In practice
Cloaking, hidden text, doorway pages, scraped content and bought links are the recurring examples.
The practical test is simple: would you describe the tactic to the customer, or to Google, without rephrasing it?
Why it matters
Recovery from a manual action takes months and often never returns the site to where it was.
The tactics also tend to stop working on their own, which means paying twice — once to build, once to undo.