You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
GITHUBGitHub Advanced Security (GH-500)
The GitHub Advanced Security certification validates your expertise in securing code and workflows with GitHub's advanced security features. Designed for security professionals and developers, this certification demonstrates your ability to identify vulnerabilities, implement security controls, and protect the software supply chain. Earning it signals that you can proactively harden GitHub environments against evolving threats.
Exam formatMultiple choice and multiple response
DeliveryMicrosoft
Free questions537
Content last reviewed 30 July 2026 · Up to date
The certification
What GH-500 proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
25objectives
158concepts
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The GitHub Advanced Security certification is a professional credential that validates your ability to apply GitHub's advanced security capabilities to protect code, workflows, and development pipelines. It covers vulnerability identification, workflow security, and security implementation, equipping you to detect and remediate risks across the software development lifecycle.
Earning this certification demonstrates that you can leverage tools like code scanning, secret scanning, and dependency review to safeguard repositories and supply chains. It is ideal for security engineers, DevOps professionals, and developers who want to formalize their expertise in GitHub security and stand out in a competitive job market.
Who it’s for
This certification is for security professionals, DevOps engineers, and developers who are responsible for securing GitHub repositories and workflows. It is also valuable for those who want to deepen their understanding of GitHub's security features and implement them effectively in their organizations. Candidates should have hands-on experience with GitHub and a solid grasp of security concepts, including vulnerability management, secure coding practices, and supply chain security. The exam is designed for practitioners who work daily with GitHub security tools and want to validate their skills.
Recommended experience
Hands-on experience with GitHub and familiarity with security concepts such as vulnerability management, secure coding, and supply chain security. Experience using GitHub Advanced Security features like code scanning, secret scanning, and dependency review; Understanding of common vulnerabilities and how to remediate them; Familiarity with GitHub Actions and workflow security; Knowledge of software supply chain security best practices
The syllabus
What you’ll learn
Every domain and objective GitHub measures, with the weight they carry on the exam.
The official GitHub exam outline · checked 30 July 2026 · See the source
Describe GitHub Security suites, features, and ecosystem
- Understand GitHub Security suites and architecture
- Apply secure SDLC and security strategies
- Detect, manage, and respond to security alerts
- Manage access, governance, and supply chain security
Configure and use Secret Protection (formerly secret scanning)
- Enable and configure Secret Protection
- Prevent secret exposure
- Manage and respond to Secret Protection alerts
- Control access, policies, and customization
Configure and use supply chain security (formerly Dependabot/Dependency Review)
- Understand and manage dependency and supply chain risks
- Detect, prioritize, and respond to supply chain alerts
- Secure dependencies during development
- Configure policies, permissions, and integrations
Configure and use Code Security (formerly Code Scanning with CodeQL)
- Understand code scanning approaches and tooling
- Set up and configure Code Security
- Analyze, triage, and remediate code scanning results
- Optimize and automate Code Security operations
Security operations: best practices, prioritization, and remediation
- Understand vulnerability context and remediation frameworks
- Prioritize and manage security work at scale
- Customize and optimize security detection
- Collaborate across roles and enforce governance
- Shift left and strengthen preventive security
GitHub Security suites administration
- Roll out and manage security features at scale
- Configure security features and defaults
- Define governance, access, and Code Security workflows
- Manage CodeQL and security automation
On the day
The exam itself
Everything GitHub publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
Exam codeGH-500
CertificationGitHub Advanced Security (GH-500)
Exam formatMultiple choice and multiple response
DeliveryMicrosoft
LanguagesEnglish
After you pass
Where this credential goes next
The path GitHub lays out, how the credential is kept, and where to book.
Step-by-step path to GitHub Advanced Security (GH-500)
Credential earnedGitHub Advanced Security (GH-500) Certification Renewal and maintenance
GitHub certifications expire annually and require renewal. Renewal is completed by passing a free online assessment on Microsoft Learn. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. GitHub maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by GitHub
Exam registration
Register for the exam through Microsoft, GitHub’s authorized testing partner.
Schedule your examVisit the official GitHub certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the GitHub Advanced Security certification relate to the GitHub Foundations certification?
GitHub Foundations is an entry-level certification covering foundational GitHub concepts, while GitHub Advanced Security focuses specifically on security features. They are separate certifications, and earning Foundations is not a prerequisite for Advanced Security.
Is there a hands-on or lab component in the GH-500 exam?
The official documentation does not specify a hands-on lab component. The exam is delivered online proctored and typically consists of multiple-choice questions.
What job roles does the GitHub Advanced Security certification map to?
This certification is relevant for security engineers, DevSecOps professionals, and developers who are responsible for securing GitHub repositories and workflows.
Can I recertify by passing a different GitHub certification exam?
GitHub certifications expire annually and require renewal. The renewal process involves passing a free online assessment on Microsoft Learn, not taking another certification exam.
Are there any regional restrictions for taking the GH-500 exam?
The exam is available online proctored, which allows candidates from many regions to take it. Specific availability may vary by country, and candidates should check the registration page for their region.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 537 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept GitHub measures — each one written out.
6domains
25objectives
158concepts
117free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official GitHub exam outline · checked 30 July 2026 · See the source
1Describe GitHub Security suites, features, and ecosystem111 questions
2Configure and use Secret Protection (formerly secret scanning)78 questions
3Configure and use supply chain security (formerly Dependabot/Dependency Review)93 questions
Understand and manage dependency and supply chain risks5 concepts · 3 pagesOpen →Detect, prioritize, and respond to supply chain alerts7 concepts · 6 pagesOpen →Secure dependencies during development10 concepts · 6 pagesOpen →Configure policies, permissions, and integrations7 concepts · 5 pagesOpen →
4Configure and use Code Security (formerly Code Scanning with CodeQL)82 questions
5Security operations: best practices, prioritization, and remediation107 questions
Understand vulnerability context and remediation frameworks8 concepts · 6 pagesOpen →Prioritize and manage security work at scale5 concepts · 4 pagesOpen →Customize and optimize security detection6 concepts · 5 pagesOpen →Collaborate across roles and enforce governance8 concepts · 6 pagesOpen →Shift left and strengthen preventive security3 concepts · 3 pagesOpen →
6GitHub Security suites administration66 questions
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Understand GitHub Security suites and architecture7 pagesOpen →
Free in front of it
35 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
537 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
537questions
117pages
25objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Describe GitHub Security suites, features, and ecosystem111 questions
2Configure and use Secret Protection (formerly secret scanning)78 questions
3Configure and use supply chain security (formerly Dependabot/Dependency Review)93 questions
4Configure and use Code Security (formerly Code Scanning with CodeQL)82 questions
5Security operations: best practices, prioritization, and remediation107 questions
6GitHub Security suites administration66 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
158concepts
537free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from GitHub
Where the exam is defined, scheduled and scored.
3official links
158concepts mapped
The source
GitHub’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official GitHub outline already has questions here
We build from the official skills outline, not from a summary of it — 25 objectives, 158 concepts written under them, and free questions against every one. When GitHub changes the outline, this page changes with it.
25objectives on the outline→158concepts written→537free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.