Exam GH-500: GitHub Advanced Security is GitHub's DevSecOps certification. It was rewritten in July 2026 around GitHub's new security suites: Secret Protection (formerly secret scanning), Code Security (formerly code scanning with CodeQL) and supply chain security (formerly Dependabot and Dependency Review). It also covers security campaigns, push protection, EPSS-based prioritisation, SBOMs and enterprise rollout.
This guide follows the official study guide: six skill areas with weights, what was renamed, the workflow files you should know, a 5-week plan and 15 original scenario questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Exam | GH-500: GitHub Advanced Security |
| Passing score | 700 |
| Skills measured | As of July 2026 (significant rewrite) |
| Audience | Developers, DevSecOps and security engineers using GitHub security features |
| Price | Based on the country where you take the exam (Pearson VUE) |
Read the official GH-500 study guide before booking. Older courses use the old feature names, so map them with the table below.
Old names vs new names
| Before | Now (exam wording) |
|---|---|
| Secret scanning | Secret Protection |
| Code scanning with CodeQL | Code Security |
| Dependabot and Dependency Review | Supply chain security |
Skills measured and weights
| Skill area | Weight |
|---|---|
| Describe GitHub Security suites, features and ecosystem | 15–20% |
| Configure and use Secret Protection | 15–20% |
| Configure and use supply chain security | 15–20% |
| Configure and use Code Security | 10–15% |
| Security operations: best practices, prioritisation and remediation | 15–20% |
| GitHub Security suites administration | 10–15% |
What each area covers
- Suites and ecosystem: suite structure; Code Security vs Secret Protection vs supply chain; public vs enterprise availability; Security Overview; secure SDLC; prevention-first vs gate-based strategies; security campaigns; alert responsibilities; delegated bypass.
- Secret Protection: enabling at repo and org level; push protection; validity checks; alert lifecycle and dismissal; delegated bypass; alert recipients and exclusions; custom secret patterns.
- Supply chain: dependency graph; SBOM export; alerts and security updates prioritised with EPSS; remediation through campaigns and PRs; auto-dismiss; Dependency Review pre-merge checks (licences, compliance); grouped updates; permissions, webhooks and integrations.
- Code Security: CodeQL vs third-party tools; SARIF uploads; enabling with GitHub Actions or external CI; workflow templates, matrix builds, scan frequency; dataflow results; Copilot Autofix; severity and dismissal; troubleshooting scans.
- Security operations: CVE, CWE and GitHub Security Advisories; severity and remediation rulesets; bulk alert management; custom CodeQL query suites; alert ownership; cross-suite rulesets; shifting left.
- Administration: enabling suites at enterprise, organisation and repo level; Enterprise Cloud vs Enterprise Server; default configurations and inheritance; policies, rulesets, bypass and roles (admin, security manager, developer); APIs for configuration at scale.
Workflow files to know
# .github/workflows/codeql.yml: Code Security with CodeQL (advanced setup)
name: CodeQL
on:
push: { branches: [main] }
pull_request: { branches: [main] }
schedule: [{ cron: "30 1 * * 1" }]
jobs:
analyze:
runs-on: ubuntu-latest
permissions: { security-events: write, contents: read }
strategy:
matrix: { language: [javascript-typescript, python] }
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with: { languages: "${{ matrix.language }}", queries: security-extended }
- uses: github/codeql-action/analyze@v3
# .github/dependabot.yml: grouped weekly updates
version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule: { interval: weekly }
groups:
dev-dependencies: { dependency-type: development }5-week study plan
| Week | Focus | Lab (public repo or GHAS trial) |
|---|---|---|
| 1 | Suites, Security Overview, secure SDLC, roles | Enable all features on a test repo and explore Security Overview |
| 2 | Secret Protection: push protection, validity checks, custom patterns, bypass | Push a fake token and watch push protection block it |
| 3 | Supply chain: dependency graph, SBOM, Dependabot alerts and updates, Dependency Review | Add a vulnerable package; fix it with a Dependabot PR |
| 4 | Code Security: default vs advanced setup, SARIF, Autofix, custom query suites | CodeQL on a vulnerable sample app; triage five alerts |
| 5 | Campaigns, rulesets, enterprise rollout, APIs; review all objectives | Run a campaign across two repos; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. A developer tries to push an AWS key. What stops it before it reaches the repository?
Push protection in Secret Protection.
2. Only the security team should approve exceptions when push protection blocks a push. What do you configure?
Delegated bypass for push protection.
3. Your company's internal API tokens have a custom format. How do you detect them?
Define a custom secret pattern.
4. Which alerts should you fix first: secrets confirmed active or unknown ones?
Confirmed active ones; validity checks show which secrets still work.
5. A pull request adds a dependency with a known vulnerability and a banned licence. What blocks the merge?
Dependency Review as a required check.
6. Customers ask for a list of every component in your product. What do you export?
An SBOM from the dependency graph.
7. You have 400 dependency alerts. Which score helps you rank the ones likely to be exploited?
EPSS (Exploit Prediction Scoring System), together with severity.
8. Dependabot opens too many separate PRs. How do you reduce the noise?
Group updates in dependabot.yml.
9. Your team already uses a third-party SAST tool. How do its results appear in GitHub?
Upload them as SARIF files.
10. You want CodeQL with almost no configuration. Which setup?
Default setup.
11. You need extra queries and a custom build for a compiled language. Which setup?
Advanced setup with a CodeQL workflow file.
12. Developers want a suggested code fix for a CodeQL alert. Which feature?
Copilot Autofix.
13. One SQL injection pattern exists in 30 repositories. How do you coordinate the fix?
A security campaign.
14. Every new repository in the organisation must get the same security settings. What do you set?
A default security configuration applied at the organisation level.
15. What is the difference between a CVE and a CWE?
A CVE identifies a specific vulnerability; a CWE describes a type of weakness (for example CWE-89, SQL injection).
After GH-500
- Complete the GitHub set with GH-200 Actions, GH-300 Copilot and GH-900 Foundations.
- Read the DevSecOps career path and practise DevSecOps interview questions.
- See live DevSecOps and security jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches DevOps, DevSecOps, GitHub Actions and cloud security with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What is the GH-500 passing score?
700.
When did GH-500 change?
The skills measured were rewritten in July 2026 around GitHub's Secret Protection, Code Security and supply chain security suites.
What is Secret Protection?
The new name for GitHub secret scanning, including push protection, validity checks and custom patterns.
What is Code Security?
The new name for code scanning with CodeQL, plus third-party tools through SARIF and Copilot Autofix.
Which GH-500 areas have the most weight?
Suites and ecosystem, Secret Protection, supply chain security and security operations, each at 15–20%.
Who should take GH-500?
Developers, DevSecOps and security engineers who configure and triage GitHub security features.
