GH-500 Study Guide

GH-500 measures whether you can secure code, secrets, and dependencies with GitHub Advanced Security: configuring GitHub Secret Protection, supply chain security, and GitHub Code Security, triaging and remediating the alerts they raise, and rolling them out and governing them across organizations and enterprises. Expect to decide which feature, setting, rule, or role meets a requirement, at which level (repository, organization, or enterprise) it is configured, and what happens to an alert after a bypass, dismissal, or fix.

The exam has six domains. The security suites and ecosystem, Secret Protection, supply chain security, and security operations each carry 15-20%, while Code Security and administration each carry 10-15%. None of them is small enough to skip, so plan to cover every domain. Code scanning also appears outside its own domain, in security operations (customizing CodeQL query suites) and administration (default or approved custom CodeQL workflows), so do not let its smaller weight tempt you to skim it.

Describe GitHub Security suites, features, and ecosystem — 15-20%

How the security suites are structured and navigated, how GitHub Code Security, GitHub Secret Protection, and supply chain security differ, which features public repositories get compared with enterprise environments, security overview, how Secret Protection and Code Security work together across a secure development lifecycle, prevention-first compared with gate-based strategies, security campaigns, detection mechanisms, choosing and acting on alerts and the implications of dismissing them, developer, security, and administrator responsibilities, alert access, roles, delegated bypass, and enforcement, and supply chain concepts across the lifecycle.

Configure and use Secret Protection (formerly secret scanning) — 15-20%

Enabling GitHub Secret Protection for repositories and organizations, its settings and availability, how it behaves in public compared with private and enterprise repositories, push protection, validity checks and prioritized alerting, the alert lifecycle (creation, status, and dismissal), responding to leaked secrets and remediating them, role-based and delegated bypass, alert recipients and exclusions, and custom patterns.

Configure and use supply chain security (formerly Dependabot/Dependency Review) — 15-20%

Dependency security tools, vulnerability databases, and SBOMs, generating and reading the dependency graph, SBOM export options and formats, Dependabot alerts and security updates with prioritization and EPSS scores, remediating alerts through pull requests, auto-dismiss behavior, dependency review (pre-merge checks, license and compliance validation, and configuration), grouping and update strategies, permissions and alert assignment, workflow management, and notifications, webhooks, and integrations.

Configure and use Code Security (formerly Code Scanning with CodeQL) — 10-15%

Native and third-party code scanning, choosing between CodeQL and other analysis tools, SARIF ingestion and interoperability, enabling code scanning with GitHub Actions or an external CI system, code scanning workflows and workflow templates, matrix builds and scan frequency, reviewing results including data flow, alert lifecycles, autofix, and remediation, dismissing alerts and managing severity and category, advanced configuration, and troubleshooting failed or slow scans.

Security operations: best practices, prioritization, and remediation — 15-20%

CVE, CWE, and GitHub Security Advisory concepts, end-to-end remediation across alerts and advisories, defining and enforcing severity and remediation rulesets, campaign-based remediation and bulk alert management, automated dismissal and documentation, customizing CodeQL query suites and language-specific analysis, tailoring detection to an organization's risk profile, security roles, delegated exceptions, and alert ownership, collaborating on alerts and campaigns across teams, cross-suite rulesets and policies, and shift-left prevention with push protection, dependency scanning, and pre-merge analysis.

GitHub Security suites administration — 10-15%

Enabling the security products at enterprise, organization, and repository level, feature availability and differences between GitHub Enterprise Cloud and GitHub Enterprise Server, enabling Code Security, Secret Protection, and supply chain features, default configurations and inheritance, enterprise and organization security policies and rulesets, enforcement boundaries, bypass permissions, and exceptions, administrator, security manager, and developer roles, permissions for managing and dismissing alerts, default or approved custom CodeQL workflows, and APIs and automation for security configuration and governance at scale.

The full bullet-level list lives in the official study guide. Treat it as your checklist. Its administration section lists two bullets twice, under two headings (default or approved custom CodeQL workflows, and APIs and automation for configuration and governance at scale), so the six sections above are the complete list.

The Official GH-500 Study Guide

How This Maps to CertiAce Practice Modules

The CertiAce question bank is organized by the eight modules of the official GitHub Advanced Security learning paths on Microsoft Learn (Part 1 and Part 2), so you can drill each area in isolation. CertiAce GH-500 practice questions are single-choice, multiple-select, build list (ordering), dropdown, and yes/no table items, with no case studies. Security operations has no module of its own in the course, so its topics are folded into the modules below:

The Manage sensitive data and security policies module also touches on identity settings such as SAML single sign-on and two-factor authentication. Those belong to GH-100: GitHub Administration rather than the GH-500 skills list, so CertiAce GH-500 questions on that module stay on security policies, vulnerability reporting, advisories, and rulesets.

GH-500 has no prerequisite certification, and the other GitHub certifications above do not list one either. GH-900 is not required, but the GH-500 audience profile expects familiarity with GitHub fundamentals, CI/CD, and secure development concepts, so GH-900 is a natural first step if you are new to GitHub. If you already work with GitHub's security features, go straight to GH-500. GH-100 is the closest companion: its largest domain is implementing secure software development and compliance, which includes administering features such as GitHub Advanced Security.

The exam is written for people with experience using GitHub Advanced Security to secure code, secrets, and dependencies, and its audience profile expects familiarity with GitHub fundamentals, CI/CD, and secure development concepts. Check yourself against this table. Anything unfamiliar is where your preparation should start:

How long you need depends on where you start. Treat these estimates as planning guidance and adjust them to your starting knowledge and weekly study hours:

Step 1: Read the Official Study Guide

Skim the full skills-measured list once, and mark every bullet you could not explain to a colleague. That marked-up list is your personal syllabus: everything else in this plan exists to clear it. The July 2026 update changed the exam significantly (objectives were added, removed, moved, and reworded), so check any older material against the current list before relying on it. Most questions cover generally available features, but commonly used preview features may also appear.

The Official Study Guide

Step 2: Schedule Your Exam

Choose a realistic target date after reviewing the skills list and your available study time. A date on the calendar turns studying into a countdown, so pick one using the prep-time table above and plan backwards from it. You schedule through Pearson VUE and can take the exam online or at a test center.

The exam is offered in English, Spanish, Portuguese (Brazil), Korean, and Japanese. If the exam is not available in your native language, check the English as a Second Language accommodation and arrange any approved extra time before booking.

Certification and Exam Details Page

Request Accommodations

Step 3: Work Through the Official Learning Paths

Complete both GitHub Advanced Security learning paths on Microsoft Learn, Part 1 and Part 2. The CertiAce practice modules follow the same eight modules. Take notes on concepts you cannot explain in simple terms, and try each feature in your own repository as you go. GitHub's documentation changes faster than the training modules (the Manage sensitive data and security policies module, for example, says a leaked secret means you must rewrite history or contact GitHub Support, while the documentation's remediation tutorial starts by revoking the secret and treats cleaning Git history as a disruptive step to weigh against your obligations), so when a unit and docs.github.com disagree, go with the documentation. If you prefer instructor-led training, course GH-500T00 is available on Microsoft Learn.

GitHub Advanced Security Part 1 of 2

GitHub Advanced Security Part 2 of 2

Step 4: Use a Supplementary Video Resource

Microsoft Learn's GH-500 video series covers five of the eight course modules in five episodes plus a short course preview: an introduction to GitHub Advanced Security, managing sensitive data and security policies, Dependabot, secret scanning, and code scanning. It has no episodes for the two CodeQL modules or the administration module, and it was published in January 2026, before the July 2026 skills update, so keep your marked-up list next to it. Watch it alongside the learning paths for the topics it covers, and later rewatch the episodes on your weakest areas: a second pass is much faster than the first and surprisingly effective.

GH-500 Video Series (Microsoft Learn on YouTube)

Step 5: Get Hands-On Practice

GH-500 rewards people who have turned these features on and worked their alerts: the objectives ask which feature, setting, or role fits a requirement and what an alert, bypass, or dismissal does next. Secret scanning, push protection, code scanning with CodeQL, Copilot Autofix, and dependency review are available for free on public repositories, and the dependency graph, Dependabot alerts, and Dependabot security and version updates are available on every plan, so a public repository on a free account supports many of the core exercises. Aim for hands-on time with:

• Turning on Dependabot alerts and security updates for a repository with a vulnerable dependency, then reviewing the alert and merging the pull request a security update opens
• Adding a dependabot.yml file for version updates with a schedule and a group, and comparing its pull requests with security updates
• Exporting an SBOM from the dependency graph, and reading an advisory's GHSA ID, severity, and EPSS score in the GitHub Advisory Database
• Adding the dependency review action to pull requests and watching it fail a pull request that adds a vulnerable package
• Turning on secret scanning and push protection, pushing a sample credential, and comparing what each bypass reason does to the resulting alert
• Excluding a test folder with a secret_scanning.yml file, and closing a secret scanning alert with a reason after revoking the credential
• Enabling code scanning with default setup, then using advanced setup on another repository with a language matrix, a build mode, and the security-extended query suite
• Uploading a SARIF file from a third-party tool, then triaging and dismissing a code scanning alert and reviewing a Copilot Autofix suggestion on a pull request
• Adding a branch ruleset that blocks merging when code scanning finds alerts at a chosen severity
• Adding a SECURITY.md file, enabling private vulnerability reporting, and drafting a repository security advisory

Some objectives need more than a free account. Custom patterns, delegated bypass for push protection, delegated alert dismissal, and security campaigns need GitHub Secret Protection or GitHub Code Security, and security configurations, the security manager role, and enterprise policies need an organization or an enterprise account. A GitHub Enterprise Cloud trial gives you an enterprise account for 30 days without a payment method, with up to three new organizations and, on GitHub.com trials, GitHub Secret Protection and GitHub Code Security. The trial does not include GitHub Connect or access to GitHub Enterprise Server, so learn the Server differences from the official documentation.

Quickstart for securing your repository

Setting up a trial of GitHub Enterprise Cloud

GitHub Skills offers free, interactive exercises that run inside GitHub repositories, including introductions to secret protection and CodeQL, securing your repository's supply chain, and configuring a CodeQL language matrix.

GitHub Skills

Step 6: Benchmark Your Knowledge

Use CertiAce to benchmark your readiness module by module. The practice modules map to the exam domains as shown above, so use the module mapping and the topics behind your missed questions to identify the skills-measured areas to revisit. Microsoft also offers a free official practice assessment. Aim for consistent performance across every module, not one lucky high score.

CertiAce GH-500 Exam Practice

Free Official Practice Assessment

Step 7: Take the Exam

The day before, review only your weak topics: no brand-new material. On exam day, read each question for what it is truly asking: many GH-500 scenarios turn on which product or plan a feature needs, at which level (repository, organization, or enterprise) a setting lives, or what happens to an alert after a bypass, dismissal, or fix, so settle those first and eliminate the options that do not fit.

Worth knowing before you sit down:

• This is a closed-book exam: Microsoft Learn access is not available on GitHub exams.
• You can take unscheduled breaks, but the clock keeps running and you cannot return to questions you already saw.
• Watch the naming: the skills list uses the product names Secret Protection and Code Security with the older feature names in brackets, while the documentation still calls the features secret scanning, code scanning, Dependabot, and dependency review, so learn both. The learning paths still describe GitHub Advanced Security as an add-on to GitHub Enterprise; it is now sold as two products, GitHub Secret Protection and GitHub Code Security, for accounts on GitHub Team and GitHub Enterprise. The documentation has also moved ahead of the July 2026 skills list: agentic autofix (assigning code scanning alerts to Copilot) and AI Scan became generally available in October 2026, after the outline. Learn the outline's features, such as Copilot Autofix and CodeQL, first and treat newer features as background.
• Try the GitHub exam sandbox beforehand so the interface holds no surprises: GitHub Exam Sandbox