What are passive checks good for on Zabbix?

There are three basic types of checks in Zabbix:

Active checks are pushed from systems with the Zabbix agent installed. These checks do not require that any ports be open on the client (monitored) system (unless you want to be able to issue remote commands). However, there does need to be a port open on the Zabbix server for the agent(s) to connect to which is accessible to the agent(s). While active checks are quite scalable on a properly configured Zabbix server they do create more network traffic than passive checks as the agent must contact the server and get a list of parameters to return/checks to complete before returning results.

Passive checks are the Zabbix server polling the Zabbix agent on a system. These checks require that a port be open on the client (monitored) system which the Zabbix server can reach but there do not need to be any open ports on the Zabbix server for the agent(s). This could be useful if, for example, there is a NAT/PAT device or stateful firewall in in front of the Zabbix server and it is not possible to open a port on the Zabbix server for the agents to connect to. In addition, the Zabbix server has complete control over how frequently the client system is polled and which parameters are polled.

Simple checks do not require an agent be installed. Some clients cannot have the agent installed for a variety of reasons or do not have an agent which will run on whatever OS they are running. As one example think about simple Internet of Things (IoT) devices. You may want to check that they are up but do not have the ability to install an agent. Similarly, you may want to ping test an upstream gateway at your ISP which you cannot install an agent on, a cash register/POS system, etc.