GitHub Advanced Security Certification Practise Exam

Who it is for

• Developers, security engineers, and administrators preparing for GitHub Advanced Security (GH-500).
• Practitioners who already use GitHub and CI/CD and need exam-style practice on Secret Protection, Code Security, supply chain alerts, and organization-scale governance.

What this exam covers

• Describe GitHub Security suites, features, and ecosystem — 15–20%
• Configure and use Secret Protection (formerly secret scanning) — 15–20%
• Configure and use supply chain security (formerly Dependabot/Dependency Review) — 15–20%
• Configure and use Code Security (formerly Code Scanning with CodeQL) — 10–15%
• Security operations: best practices, prioritization, and remediation — 15–20%
• GitHub Security suites administration — 10–15%

What you will practice

• Contrast Secret Protection, Code Security, and supply-chain features, then use Security Overview coverage, risk, and campaign views to find gaps.
• Enable secret scanning and push protection, write custom patterns, interpret bypass and dismissal flows, and rotate leaked credentials.
• Read the dependency graph and SBOMs, review pull request dependency changes, and prioritize Dependabot alerts with severity, EPSS, and relationship filters.
• Choose CodeQL default versus advanced setup, ingest SARIF, follow dataflow paths, and troubleshoot failed or incomplete scans.
• Run security campaigns, apply delegated dismissal, and shift detection left with push protection, dependency review, and pull request analysis.
• Roll out security configurations and global settings, assign security manager and custom roles, and automate enablement with the REST API.

About this practice exam

This exam is designed for practitioners who use GitHub Advanced Security to secure code, secrets, and dependencies across the software development lifecycle. Candidates configure security features, triage and remediate alerts, and apply prevention-first practices with policies, workflows, and automation. They are familiar with GitHub fundamentals, CI/CD, and secure development concepts.

The official GitHub Advanced Security exam (GH-500) is a proctored Microsoft certification. Microsoft publishes a scaled passing score of 700 and does not publish a fixed question count. Skills measured as of July 2026 are listed below.

The certification validates understanding of:

• GitHub Security suites and architecture: Secret Protection, Code Security, supply chain features, public versus enterprise availability, and Security Overview.
• Secret Protection: secret scanning, push protection, validity checks, custom patterns, delegated bypass, and alert remediation.
• Supply chain security: the dependency graph, SBOMs, Dependabot alerts and updates, dependency review, and alert prioritization including EPSS.
• Code Security: CodeQL default and advanced setup, third-party SARIF, dataflow alerts, Autofix, and scan troubleshooting.
• Security operations: campaigns, delegated alert dismissal, severity and exploitability prioritization, and shift-left controls.
• Administration at scale: security configurations, global settings, roles, enforcement, and APIs on GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server.