What is the GitHub Advanced Security certification?

The GitHub Advanced Security certification is earned by passing Exam GH-500: GitHub Advanced Security. It validates that you can configure and use Secret Protection, supply chain security and Code Security with CodeQL, triage and remediate alerts, run security campaigns, and administer the security suites across an organization. The study guide is published on Microsoft Learn.

How much does the GitHub Advanced Security certification cost?

Microsoft's published exam pricing feed lists GitHub certification exams under a single GH family code at $99 in the United States. GH-500 does not appear under its own code, so no source can honestly quote a GH-500-specific figure beyond that family price. Confirm the fee at registration before you book.

Did the GitHub Advanced Security exam change in 2026?

Yes, and recently. The official change log states the exam changed significantly in July 2026: objectives added, removed, moved and reworded. Three of the six domains now carry renamed products in their official titles: Secret Protection (formerly secret scanning), supply chain security (formerly Dependabot and Dependency Review), and Code Security (formerly code scanning with CodeQL). Prep material that still teaches the old names predates the current outline.

How hard is the GH-500 exam?

Harder than clicking Enable on a few security features. The outline expects you to explain EPSS scoring for prioritization, delegated bypass policies, validity checks on leaked secrets, SARIF ingestion from third-party scanners, CodeQL query suite customization, and campaign-based remediation at scale. Security operations is its own 15 to 20 percent domain on top of the three product domains.

How many questions are on the GitHub Advanced Security exam?

Neither GitHub nor Microsoft publishes an official question count for GH-500. The certification page does state the time limit: you will have 100 minutes to complete the assessment, and the exam is proctored. Treat any site quoting an exact question count as unofficial.

Is the GitHub Advanced Security certification worth it?

For application security engineers, DevSecOps roles and platform teams that own GHAS rollouts, it is one of the most job-shaped security certs available: the exam content is the actual work of triaging alerts, tuning CodeQL and running remediation campaigns. It is narrower than a CISSP but far more hands-on for GitHub shops.

Is there an official GH-500 practice test?

Yes. The GitHub Advanced Security certification page on Microsoft Learn links an official practice assessment that previews the style, wording and difficulty of the live exam. Take it at least once before booking, and use generated question drills from your own notes to close the gaps it exposes domain by domain.

GH-500 practice test

GitHub Advanced Security Certification Practice Test, GHAS GH-500 Exam Questions

Upload your security notes, and the AI writes unlimited GH-500 practice questions with an answer key in seconds. Weighted to the six domains on the official outline, in the renamed product language the July 2026 rewrite made the standard.

Your study files are processed securely and deleted automatically after your practice questions are built.

Upload your GHAS notes and generate your first question set

Click to upload or drag and drop

PDF, DOCX, PPTX, TXT, JPG, JPEG, PNG, HEIC, ODP, ODT, BMP, or TIFF

up to 20MB

Please wait, your quiz is being created...

Uploading...

The GitHub Advanced Security certification is earned by passing Exam GH-500: GitHub Advanced Security. It has six domains, you get 100 minutes, and Microsoft's pricing feed lists GitHub exams under one family code at $99 US. The official change log says the exam changed significantly in July 2026, and the clearest sign is in the domain names themselves: Secret Protection (formerly secret scanning), supply chain security (formerly Dependabot and Dependency Review), and Code Security (formerly code scanning with CodeQL). GitHub renamed its whole security product line, the exam followed, and any course or question bank still teaching the old product names predates the outline you will actually be tested on. In the roughly 825-word outline, security appears 54 times, alert 25 times and secret 20 times.

Last updated July 2026

What GH-500 actually tests. Count the words.

We counted terms in the official skills-measured outline on Microsoft Learn, the same method we use across every certification page on this site. GH-500 is an alert-handling exam far more than a hacking exam.

Term in the official outline	Count	What it tells you
security	54	In a ~825-word outline: one mention every 15 words. The suites, the campaigns, the roles
alert	25	Lifecycle, triage, dismissal implications, recipients, bulk management. Alert handling is the job
secret	20	Push Protection, validity checks, custom patterns, delegated bypass
scan	12	Code scanning workflows, scan frequency, troubleshooting scan failures
dependency	10	Dependency graph, Dependency Review pre-merge checks, update rules and grouping
CodeQL	8	Choosing it over third-party tools, query suite customization, language-specific analysis
campaign	5	Security campaigns: bulk, deadline-driven remediation. Barely existed in older prep
SBOM	2	Export options, formats, and where a software bill of materials fits the supply chain story

The July 2026 outline is specific in ways older material never was. It names EPSS scoring for prioritization, validity checks on leaked secrets, delegated bypass policies, auto-dismiss behavior, SARIF file ingestion, dataflow analysis insights, autofix capabilities, and campaign-based remediation. If your course never mentions EPSS or Push Protection, it is teaching you the previous exam. Build questions from the current study guide instead: generate practice questions from your own security notes and weight them to the six real domains.

US fee (GH family code): $99
Exam time: 100 min
"security" in the outline: 54 times
Practice questions: Unlimited

GH-500 skills measured, straight from the official study guide

Six domains. Three are the renamed product suites, one is the ecosystem picture, and two are the parts most candidates underestimate: security operations at scale, and administering the suites across an organization.

Domain	What is actually in it	Weight
Describe GitHub Security suites, features and ecosystem	Suite structure and navigation, contrasting Code Security vs Secret Protection vs Supply Chain Security, feature availability for public vs enterprise repositories, the Security Overview, prevention-first vs gate-based strategies, and who owns which alert across developer, security and admin roles.	15 to 20%
Configure and use Secret Protection (formerly secret scanning)	Enabling at repository and organization level, Push Protection stopping secrets at the source, validity checks and prioritized alerting for high-confidence leaks, the alert lifecycle, role-based and delegated bypass policies, alert recipients, exclusions, and custom secret patterns.	15 to 20%
Configure and use supply chain security (formerly Dependabot/Dependency Review)	The dependency graph, SBOM export options and formats, alert prioritization with EPSS scoring, remediation through campaigns and pull requests, auto-dismiss behavior, Dependency Review pre-merge and license checks, grouped update rules, and webhooks plus external notifications.	15 to 20%
Configure and use Code Security (formerly code scanning with CodeQL)	Choosing between CodeQL and third-party tools, SARIF ingestion, enabling via Actions or external CI, workflow templates, matrix builds and scan frequency, dataflow analysis insights, alert lifecycles, autofix, severity classification, and troubleshooting scan failures.	10 to 15%
Security operations: best practices, prioritization and remediation	CVE, CWE and GitHub Security Advisory concepts, end-to-end remediation workflows, severity and remediation rulesets, campaign-based strategies and bulk alert management, customizing CodeQL query suites to a risk profile, and cross-suite rulesets and enforcement.	15 to 20%
GitHub Security suites administration	Rolling the suites out across an organization: licensing, enablement strategy, policies and governance, and keeping detection tuned as repositories, teams and risk profiles change.	10 to 15%

Add it up: operations plus administration is 25 to 35 percent of the paper. Turning features on is the easy half. Explaining who may bypass Push Protection, when auto-dismiss fires, and how a campaign closes 400 alerts without burning out the developers is the half that decides the pass.

GH-500 has an official Microsoft practice assessment worth taking at least once. Neither GitHub nor Microsoft publishes a question count or a pass rate on the study guide. The certification page states the time limit: 100 minutes, proctored.

The rename trap: how to spot outdated GH-500 prep in 10 seconds

GitHub split Advanced Security into standalone products and renamed the features. The July 2026 exam rewrite bakes the new names into the domain titles themselves. Scan any course, book or question bank for the left column; if that is the language it speaks, it predates the current outline.

Old prep says	The current outline says	What else is new there
Secret scanning	Secret Protection	Validity checks, delegated bypass policies, custom patterns
Dependabot alerts and Dependency Review	Supply chain security	EPSS scoring, SBOM exports, campaign remediation, auto-dismiss
Code scanning with CodeQL	Code Security	Autofix, dataflow insights, SARIF interoperability
Fix alerts one by one	Security campaigns	Bulk, deadline-driven remediation across teams, named five times
Severity equals CVSS	Prioritization with EPSS	Exploit likelihood, not just theoretical severity, drives triage order

This is the same pattern we found on the GitHub Actions certification practice exam after its January 2026 rewrite: the outline gets more specific, and stale banks quietly test the wrong product. Questions generated from the current study guide sidestep the whole problem.

How to build GH-500 practice questions that match the real blueprint

The July 2026 rewrite dates every older bank. Build from current material and drill the operations half that clicking Enable never teaches.

1 Upload current material: The GH-500 study guide, GitHub's security docs, or your own notes. If your material never says Secret Protection or EPSS, it predates the current outline.
2 Drill the alert lifecycle: Alert appears 25 times in the outline. Creation, triage, dismissal implications, recipients, delegated bypass: generate scenario questions until each step is automatic.
3 Learn operations at scale: Campaigns, EPSS-driven prioritization, cross-suite rulesets and CodeQL query suite tuning. This is the 25 to 35 percent that separates users from certified engineers.
4 Finish with the official mock: GH-500 has an official Microsoft practice assessment. Use generated questions to close gaps domain by domain, then confirm readiness on the official mock before booking.

GitHub Advanced Security certification questions, answered

What is the GitHub Advanced Security certification?: It is earned by passing Exam GH-500: GitHub Advanced Security. The exam validates that you can configure and use Secret Protection, supply chain security and Code Security with CodeQL, triage and remediate alerts, run security campaigns, and administer the suites across an organization. The study guide is published on Microsoft Learn.
How much does the GitHub Advanced Security certification cost?: Microsoft's published exam pricing feed lists GitHub certification exams under a single GH family code at $99 in the United States. GH-500 does not appear under its own code, so no source can honestly quote a GH-500-specific figure beyond that family price. Confirm the fee at registration before you book.
Did the GitHub Advanced Security exam change in 2026?: Yes, and recently. The official change log states the exam changed significantly in July 2026: objectives added, removed, moved and reworded. Three of the six domains now carry renamed products in their titles: Secret Protection, supply chain security, and Code Security. The outline also added EPSS scoring, security campaigns, delegated bypass and autofix. Prep written before mid-2026 is teaching the previous exam.
How hard is the GH-500 exam?: Harder than clicking Enable on a few features. The outline expects you to explain EPSS scoring, delegated bypass policies, validity checks on leaked secrets, SARIF ingestion from third-party scanners, CodeQL query suite customization, and campaign-based remediation at scale. Security operations is its own 15 to 20 percent domain on top of the three product domains, and administration adds 10 to 15 percent more.
How many questions are on the GitHub Advanced Security exam?: Neither GitHub nor Microsoft publishes an official question count for GH-500. The certification page does state the time limit: you will have 100 minutes to complete the assessment, and the exam is proctored. Treat any site quoting an exact question count as unofficial.
Is there an official GH-500 practice test?: Yes. The certification page on Microsoft Learn links an official practice assessment that previews the style, wording and difficulty of the live exam. Take it at least once before booking. Generated drills from your own notes are the complement: they let you hammer one weak domain at a time, which a fixed-length mock cannot do.
Is the GitHub Advanced Security certification worth it?: For application security engineers, DevSecOps roles and platform teams that own a GHAS rollout, it is one of the most job-shaped security certs available: the exam is the actual work of triaging alerts, tuning CodeQL and running campaigns. Managing the wider GitHub estate too? The GitHub Administration certification practice test (GH-100) covers the admin exam, where security is also the biggest scored domain.

PDFQuiz is not affiliated with, endorsed by, or sponsored by GitHub or Microsoft. GitHub and GitHub Advanced Security are trademarks of GitHub, Inc. This generator builds practice questions from material you upload and is a study aid, not a substitute for official learning paths. GitHub ships security changes continuously: always confirm the current skills-measured document before you book.

Related study tools

GH-500 leans on skills from the rest of the GitHub track: the GitHub Actions certification practice exam covers the workflows that run your scans, the GitHub Administration certification practice test covers enterprise rollout and governance, and the GitHub Foundations practice test covers the fundamentals underneath. Any study guide works with the certification exam generator.

Build your first GH-500 practice set

Upload your GitHub Advanced Security notes and generate exam-style questions with an answer key in under a minute, weighted toward the operations and administration domains that decide the pass.

Start Creating Practice Questions

Z tej samej rodziny narzędzi