GIAC Exam GCED Topic 1 Question 54 Discussion

Actual exam question for GIAC's GCED exam

Question #: 54
Topic #: 1

[All GCED Questions]

Why would the pass action be used in a Snort configuration file?

AThe pass action simplifies some filtering by specifying what to ignore.

BThe pass action passes the packet onto further rules for immediate analysis.

CThe pass action serves as a placeholder in the snort configuration file for future rule updates.

DUsing the pass action allows a packet to be passed to an external process.

EThe pass action increases the number of false positives, better testing the rules.

Show Suggested Answer

Suggested Answer: A

by Kasandra at Oct 23, 2024, 08:49 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

4 hours ago

A placeholder for future rule updates? That's a bit of a stretch. I doubt the Snort developers would design it that way.

upvoted 0 times

...

5 days ago

Ah, the pass action passes the packet on for further analysis. That's really helpful for layered security approaches.

upvoted 0 times

...

12 days ago

The pass action simplifies some filtering by specifying what to ignore. This makes a lot of sense for optimizing Snort's performance.

upvoted 0 times

...

13 days ago

I believe the pass action is also used to pass the packet onto further rules for analysis.

upvoted 0 times

...

22 days ago

I agree with you, Geraldine. It helps specify what to ignore.

upvoted 0 times

...

24 days ago

I think the pass action is used to simplify filtering.

upvoted 0 times

...