Why would the pass action be used in a Snort configuration file?

The correct answer is A. The pass action simplifies some filtering by specifying what to ignore. The pass action is defined because it is sometimes easier to specify the class of data to ignore rather than the data you want to see. This can cut down the number of false positives and help keep down the size of log data. False positives occur because rules failed and…

Perimeter Security and Intrusion Detection

Question

Options

AThe pass action simplifies some filtering by specifying what to ignore.
BThe pass action passes the packet onto further rules for immediate analysis.
CThe pass action serves as a placeholder in the snort configuration file for future rule updates.
DUsing the pass action allows a packet to be passed to an external process.
EThe pass action increases the number of false positives, better testing the rules.

How the community answered

(52 responses)

A
92% (48)
B
2% (1)
C
4% (2)
D
2% (1)

Explanation

The pass action is defined because it is sometimes easier to specify the class of data to ignore rather than the data you want to see. This can cut down the number of false positives and help keep down the size of log data. False positives occur because rules failed and indicated a threat that is really not one. They should be minimized whenever possible. The pass action causes the packet to be ignored, not passed on further. It is an active command, not a placeholder.

Topics

#Snort rules#IDS configuration#rule actions#packet filtering

Community Discussion

No community discussion yet for this question.

Full GCED Practice