GITHUBGitHub Advanced Security (GH-500)
The GitHub Advanced Security certification validates your expertise in securing code and workflows with GitHub's advanced security features. Designed for security professionals and developers, this certification demonstrates your ability to identify vulnerabilities, implement security controls, and protect the software supply chain. Earning it signals that you can proactively harden GitHub environments against evolving threats.
537 practice questions · Updated 2026-07-30
6Domains
25Objectives
158Concepts
537Questions
GH-500 Curriculum
Every domain, objective, and concept the GH-500 exam measures.
- GitHub Security suite structure
- Navigation of security features
- Code Security features
- Secret Protection features
- Supply Chain Security features
- Contrasting security suites
- Public repository security features
- Enterprise security features
- Security Overview features
- Benefits of Security Overview
- Secret Protection vs. Code Security
- End-to-End Secure SDLC with GitHub Security Suites
- Prevention-First vs. Gate-Based Security Strategies
- Security Campaigns for Risk Reduction
- Vulnerability detection mechanisms
- Secret detection mechanisms
- Alert types and sources
- Alert management and triage
- Alert policies and workflows
- Ignoring and dismissing alerts
- Developer responsibilities for alerts
- Security team responsibilities for alerts
- Admin responsibilities for alerts
- Alert access management
- Roles in security alert management
- Delegated bypass
- Enforcement of security policies
- Supply chain security concepts
- Alert information across the SDLC
- Enable Secret Protection at repository level
- Enable Secret Protection at organization level
- Configure Secret Protection settings
- Understand feature availability
- Contrast behavior for public repositories
- Contrast behavior for private and enterprise repositories
- Push Protection overview
- Push Protection enforcement
- Secret types covered by Push Protection
- User experience during a blocked push
- Bypassing Push Protection
- Validity checks for secrets
- Prioritized alerting for high-confidence secrets
- Secret Protection alert lifecycle
- Alert statuses and transitions
- Responding to secret alerts
- Dismissing alerts
- Best practices for alert triage
- Ignoring alerts and false positives
- Role-based bypass policies
- Delegated bypass policies
- Alert recipients configuration
- Alert exclusions
- Custom secret pattern creation
- Custom secret pattern management
- Comprehensive dependency security overview
- Dependency graph generation
- Dependency graph interpretation
- SBOM export options
- SBOM formats and supply chain context
- Understanding supply chain alerts
- Prioritizing alerts with EPSS scoring
- Applying security updates
- Remediating alerts via campaigns
- Remediating alerts via pull requests
- Configuring auto-dismiss behavior
- Configuring security campaigns
- Dependency Review overview
- Enabling Dependency Review
- Interpreting Dependency Review results
- Configuring Dependency Review
- License and compliance validation
- Dependency Review API and automation
- Dependency update grouping
- Auto-dismissing Dependabot alerts
- Update strategies for Dependabot
- Managing Dependabot pull requests
- Role-based alert assignment
- Permissions for security features
- Dependency update workflows
- Supply chain security workflows
- External notifications configuration
- Webhook setup for security events
- Security integrations
- Native code scanning options
- Third-party code scanning tools
- CodeQL vs. third-party tools selection
- SARIF file structure and ingestion
- SARIF management and interoperability
- Enabling Code Security via GitHub Actions
- Enabling Code Security via External CI
- Configuring Code Scanning Workflows
- Using Workflow Templates
- Using Matrix Builds
- Defining Scan Frequency
- Reviewing code scanning results
- Understanding dataflow analysis insights
- Understanding alert lifecycles
- Using autofix capabilities
- Applying remediation workflows
- Dismissing alerts
- Managing severity and category classifications
- Advanced CodeQL configuration
- Customizing CodeQL analysis
- Automating Code Security workflows
- Troubleshooting scan failures
- Performance optimization for CodeQL scans
- CVE basics
- CWE basics
- GitHub Security Advisory structure
- Advisory-to-alert linkage
- End-to-end remediation workflow
- Prioritization criteria
- Remediation strategies
- Verification and follow-up
- Severity and remediation rulesets
- Campaign-based remediation strategies
- Bulk alert management
- Automated alert dismissal
- Documentation practices for alert handling
- CodeQL query suites
- Custom query suite creation
- Language-specific analysis configuration
- Risk-based detection tailoring
- Prioritization of security findings
- Remediation workflow integration
- Security roles and permissions
- Delegated exceptions
- Alert ownership
- Collaborating on alerts
- Security campaigns
- Cross-suite rulesets
- Policy enforcement mechanisms
- Governance and compliance
- Push protection
- Dependency scanning
- Pre-merge analysis
- Enterprise-level enablement
- Organization-level enablement
- Repository-level enablement
- Feature availability on GHEC
- Feature availability on GHES
- GHEC vs GHES feature comparison
- Enable Code Security (CodeQL)
- Enable Secret Protection
- Enable Supply Chain Security
- Define Default Configurations
- Understand Inheritance Behavior
- Enterprise and organization security policies
- Rulesets and enforcement boundaries
- Security roles and permissions
- CodeQL workflow configuration
- APIs and automation for security governance
- Default CodeQL workflow setup
- Custom CodeQL workflow configuration
- Approved custom workflows governance
- CodeQL workflow enablement at scale
- Security configuration APIs
- Automation methods for governance
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GH-500, so none is invented.