Exam GH-500: GitHub Advanced Security — Information & Free Practice

The authority publishes percentage ranges for each content area. The practice percentages below use the midpoint of each range, normalized to 100%; they are not exact percentages published by the authority. Practice question counts may differ slightly because of rounding.

• Describe GitHub Security suites, features, and ecosystem — Official range: 15–20% (Practice allocation: 18.42%)

  • Understand GitHub Security suites and architecture
  • Apply secure SDLC and security strategies
  • Detect, manage, and respond to security alerts
  • Manage access, governance, and supply chain security
• Configure and use Secret Protection (formerly secret scanning) — Official range: 15–20% (Practice allocation: 18.42%)

  • Enable and configure Secret Protection
  • Prevent secret exposure
  • Manage and respond to Secret Protection alerts
  • Control access, policies, and customization
• Configure and use supply chain security (formerly Dependabot/Dependency Review) — Official range: 15–20% (Practice allocation: 18.42%)

  • Understand and manage dependency and supply chain risks
  • Detect, prioritize, and respond to supply chain alerts
  • Secure dependencies during development
  • Configure policies, permissions, and integrations
• Configure and use Code Security (formerly Code Scanning with CodeQL) — Official range: 10–15% (Practice allocation: 13.16%)

  • Understand code scanning approaches and tooling
  • Set up and configure Code Security
  • Analyze, triage, and remediate code scanning results
  • Optimize and automate Code Security operations
• Security operations: best practices, prioritization, and remediation — Official range: 15–20% (Practice allocation: 18.42%)

  • Understand vulnerability context and remediation frameworks
  • Prioritize and manage security work at scale
  • Customize and optimize security detection
  • Collaborate across roles and enforce governance
  • Shift left and strengthen preventive security
• GitHub Security suites administration — Official range: 10–15% (Practice allocation: 13.16%)

  • Roll out and manage security features at scale
  • Configure security features and defaults
  • Define governance, access, and Code Security workflows
  • Manage CodeQL and security automation