GitHub GH-500 exam guide covering code scanning, secret detection, policy, and security.
This GitHub Advanced Security guide helps GH-500 candidates focus on what the exam tests, where close answers usually split, and which review page to use next.
Use the study plan to group permissions, workflow, and security choices, the cheat sheet for workflow recall, the sample questions for explanation-heavy practice, the FAQ for scope checks, the resources page for GitHub exam references, and the glossary when feature names blur together.
| Item | Guide value |
|---|---|
| Vendor | GitHub |
| Exam or credential | GitHub Advanced Security |
| Code or shorthand | GH-500 |
| Study level | GitHub security |
| IT Mastery page | GH-500 exam page |
| Guide shape | Start-here page, study plan, cheat sheet, sample questions, FAQ, resources, and glossary. |
| Lane | What to master | Common weak answer |
|---|---|---|
| Code scanning | Understand alerts, SARIF, CodeQL, custom queries, severity, and triage. | Treating every finding as equally urgent without reachability or context. |
| Secret scanning | Detect exposed tokens, push protection, alert routing, and remediation. | Removing a secret from history without revoking and rotating it. |
| Dependency security | Use Dependabot alerts, updates, dependency review, SBOM concepts, and vulnerability triage. | Updating blindly without compatibility or exploitability review. |
| Policy and permissions | Apply organization settings, repository rules, branch protection, security roles, and audit logs. | Leaving security controls at repository defaults for regulated work. |
| Workflow security | Secure Actions permissions, third-party actions, OIDC, environment protection, and PR trust boundaries. | Letting workflows become a privileged backdoor. |
Advanced Security questions ask what to detect, how to prevent it, who owns remediation, and how to prove risk was reduced.
Use the current GitHub exam page for live exam details, including name, status, pricing, duration, delivery method, languages, retirement or beta changes, and domain weights where applicable.