GH-500: GitHub Advanced Security

An intermediate certification for developers, security engineers, and DevSecOps practitioners who configure and use GitHub Advanced Security (GHAS) features to protect code, detect vulnerabilities, and maintain compliance. Validates expertise in secret scanning, Dependabot, dependency review, and CodeQL code scanning.

Exam: 100 min · 700/1000 to pass · Intermediate level · Pearson VUE (proctored) · Valid 2 years

This is a configuration and application exam

Think like a security-aware developer or DevSecOps engineer. Questions test your ability to configure GHAS features, interpret their results, and apply corrective measures — not just define what they are.

✨Generated by NotebookLM

🔍 Click to Enlarge

---

Study Progress

GitHub Advanced Security Study Progress

0/80%

Domain 1: Describe GHAS Features and Functionality (15%)

• What GHAS includes and licensing requirements
• Secret scanning, Dependabot, code scanning overview
• GHEC vs GHES GHAS availability

Domain 2: Configure and Use Secret Scanning (15%)

• Enabling secret scanning at repo, org, and enterprise level
• Push protection — block secrets before commit
• Custom patterns, partner patterns, and validity checks
• Managing and remediating secret scanning alerts

Domain 3: Configure and Use Dependabot and Dependency Review (35%)

• Dependency graph — what it tracks and how
• Dependabot alerts vs Dependabot security updates
• Dependabot version updates and dependabot.yml
• Dependency review action in pull requests
• Remediating vulnerabilities and CVSS severity levels

Domain 4: Configure and Use Code Scanning with CodeQL (25%)

• Default vs advanced CodeQL setup
• Built-in queries, custom queries, and query suites
• Interpreting code scanning alerts and severity levels
• SARIF format and third-party tool integration
• Code scanning in pull requests and branch protection

Domain 5: GHAS Best Practices and Corrective Measures (10%)

• Rollout strategies and organizational adoption
• Security overview, metrics, and reporting
• SBOM export and compliance

Reviewed exam guide & traps

Reviewed cheatsheet

Ready for exam

💾 Progress is saved in your browser's local storage. Clearing your browser data will reset your progress.

---

Official Resources

• GH-500 Exam Page
• GH-500 Study Guide
• Exam Sandbox Demo
• GitHub Advanced Security Documentation

External Resources

• GitHub Advanced Security Learning Path — Microsoft Learn
• CodeQL Documentation
• Dependabot Documentation
• Secret Scanning Documentation

---

Start Study Notes → · Cheatsheet →