GitHub Advanced SecurityStudy guide
The intermediate security certification for protecting code, secrets, and dependencies with GHAS (GH-500).
About GitHub Advanced Security (GH-500)
GitHub Advanced Security (GH-500) is a Associate-level certification from GitHub. This page organizes the exam scope into a 6-chapter, 12-section study guide and lets you check your understanding with exam-style practice questions. A good flow is to read the chapters below in order, then test yourself via "Practice questions."
Exam domains (approximate weighting)
- Security suites, features, and ecosystem~18%
- Secret Protection~18%
- Supply chain security~17%
- Code Security (CodeQL)~14%
- Security operations (prioritization and remediation)~18%
- Security suites administration~15%
Weights are approximate guidance for the live exam. Each domain is covered in detail in the chapters and sections below.
Official exam information: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-500
1Security Suites, Features, and Ecosystem
- 1.1GitHub Security Suites and Architecture
Understand the structure and navigation of GitHub Security suites; the differences among Code Security, Secret Protection, and Supply Chain Security; feature availability for public repos vs enterprise; and the features and benefits of the Security Overview.
- 1.2Secure SDLC and Alert Strategy/Governance
Understand end-to-end secure SDLC with GitHub Security suites, prevention-first vs gate-based strategies, the role of security campaigns, detecting/managing/responding to alerts, and roles (developer/security/admin), delegated bypass, and enforcement.
2Configure and Use Secret Protection
- 2.1Enabling Secret Protection and Preventing Exposure
Understand enabling/configuring Secret Protection at repo/org levels, behavior differences for public vs private/enterprise, Push Protection that prevents exposure at the source, and validity checks with prioritized alerting for high-confidence secrets.
- 2.2Managing Secret Protection Alerts, Policies, and Custom Patterns
Understand the Secret Protection alert lifecycle (creation, status, dismissal) and appropriate remediation, role-based/delegated bypass policies, configuring alert recipients and exclusions, and creating/managing custom secret patterns.
3Configure and Use Supply Chain Security
- 3.1Managing Dependency Risk — Dependency Graph, SBOM, and Dependabot
Understand generating/interpreting the dependency graph, SBOM usage/formats/export, Dependabot vulnerability alerts and security updates, EPSS-based prioritization, and remediation via campaigns and pull requests.
- 3.2Dependency Review, Update Rules, Policies, and Integrations
Understand pre-merge Dependency Review (license/compliance validation, configuration), advanced dependency update rules (grouping, auto-dismiss, update strategies), permissions and role-based alert assignment, workflow management, and external notifications/webhooks/security integrations.
4Configure and Use Code Security
- 4.1Code Security Approaches and Setup
Understand native (CodeQL) vs third-party code scanning, choosing between CodeQL and third-party analysis, SARIF ingestion and interoperability, and enabling via GitHub Actions or external CI with workflow templates, matrix builds, and scan frequency.
- 4.2Analyzing, Triaging, and Optimizing Results
Understand reviewing scan results (including dataflow insights), the alert lifecycle and autofix/remediation workflows, dismissing alerts and managing severity/category, and advanced configuration plus troubleshooting scan failures/performance.
5Security Operations: Best Practices, Prioritization, and Remediation
- 5.1Vulnerability Context and Prioritization
Understand CVE, CWE, and GitHub Security Advisory concepts; end-to-end remediation across alerts and advisories; defining/prioritizing/enforcing severity and remediation rulesets; campaign-based bulk management; and automated dismissal with documentation.
- 5.2Customizing Detection, Governance, and Shifting Left
Understand customizing CodeQL query suites and language-specific analysis, tailoring to org risk profiles, security roles/delegated exceptions/alert ownership, cross-team collaboration, cross-suite rulesets/policies/enforcement, and strengthening prevention (shift left) via push protection, dependency scanning, and pre-merge analysis.
6GitHub Security Suites Administration
- 6.1Rolling Out at Scale and Default Configurations
Understand enabling GitHub Security suites at enterprise/organization/repository levels, feature differences between GitHub Enterprise Cloud and Server, enabling Code Security/Secret Protection/Supply Chain, and default configurations and inheritance behavior.
- 6.2Governance, Access, CodeQL Workflows, and Automation
Understand defining enterprise/org security policies and rulesets, configuring enforcement boundaries/bypass permissions/exceptions, the admin/security-manager/developer roles, permissions to manage/dismiss alerts, enabling default/approved custom CodeQL workflows, and APIs/automation for large-scale security configuration and governance.