GCED Exam Dumps : GIAC Certified Enterprise Defender

Many administrators are hesitant to upgrade the IOS on routers based on past experience with the code introducing instability into the network. It is often difficult to completely test an IOS software upgrade in a production environment because the monolithic kernel requires that the IOS be replaced before the device can be tested. Because of these reasons, IOS upgrades to resolve security flaws are often left undone in many organizations.

The pass action is defined because it is sometimes easier to specify the class of data to ignore rather than the data you want to see. This can cut down the number of false positives and help keep down the size of log data.

False positives occur because rules failed and indicated a threat that is really not one. They should be minimized whenever possible.

The pass action causes the packet to be ignored, not passed on further. It is an active command, not a placeholder.