What activity helps ensure ongoing effectiveness after enabling GAS?

• A. Installing extra plugins regardless of risk.
• B. Regularly reviewing advisory assignments, updating dependencies, and monitoring for new advisories.
• C. Turning off alerts to reduce noise.
• D. Only upgrading when a critical CVE is reported in the wild.

Answer: (B)

After enabling GAS, keeping it effective relies on a steady maintenance routine that focuses on ownership, up-to-date components, and staying informed about new risks. Regularly reviewing advisory assignments ensures there’s clear accountability for who handles remediation and verification, so issues don’t slip through the cracks. Updating dependencies promptly reduces exposure by applying patches or moving to secure versions, shrinking the window during which vulnerabilities could be exploited. Monitoring for new advisories keeps you ahead of potential threats, letting you assess impact, adjust dependencies, and apply mitigations quickly.

Other options miss the mark because they either introduce unnecessary risk or reduce visibility. Installing extra plugins without evaluating risk can add more vulnerabilities and noise. Turning off alerts defeats the purpose of proactive security. Waiting to upgrade only when a CVE shows up in the wild is reactive and leaves your project vulnerable in the gap between disclosure and remediation.