Exam GCED Topic 8 Question 64 Discussion

Actual exam question for GIAC's GCED exam
Question #: 64
Topic #: 8
Why would the pass action be used in a Snort configuration file?

Suggested Answer: A Vote an answer

The pass action is defined because it is sometimes easier to specify the class of data to ignore rather than the data you want to see. This can cut down the number of false positives and help keep down the size of log data.
False positives occur because rules failed and indicated a threat that is really not one. They should be minimized whenever possible.
The pass action causes the packet to be ignored, not passed on further. It is an active command, not a placeholder.

by Frank at Jan 01, 2026, 02:40 AM

Limited Time Offer

15%

Off

Get Premium GCED Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10