What's changed: New GH-500 Chapter 6 (large-scale rollout & defaults = enterprise→org→repo hierarchy and inheritance, GHEC vs GHES differences, enabling each feature, default security configurations [recommended/custom]; governance & automation = policy/ruleset enforcement, enforcement boundaries/bypass/exceptions [approval-gated + recorded], roles [admin/security manager/developer] and alert permissions, default/approved custom CodeQL workflows, APIs/automation to govern hundreds–thousands of repos)
6.1Rolling Out at Scale and Default Configurations
Understand enabling GitHub Security suites at enterprise/organization/repository levels, feature differences between GitHub Enterprise Cloud and Server, enabling Code Security/Secret Protection/Supply Chain, and default configurations and inheritance behavior.
Enabling features one repo at a time can’t keep up in a large org. Admins roll out features in bulk across the enterprise, organization, and repository hierarchy and keep a consistent state via default configurations and inheritance. GH-500’s final domain tests this large-scale enablement, defaults, and inheritance.
6.1.1Enabling at enterprise, org, and repo levels
GHAS features (Code Security, Secret Protection, Supply Chain) are managed in a hierarchy: set policy at the enterprise level flowing to member orgs, bulk-enable at the organization level, and fine-tune at the repository level. Policy set higher cascades (is inherited) downward, and lower levels operate within the upper constraints. Means exist to enable at once across many new/existing repos, quickly widening org-wide coverage.
6.1.2Enterprise Cloud vs Enterprise Server
Availability differs by deployment. GitHub Enterprise Cloud (GHEC) is GitHub-hosted, gets new features earlier, and has lower operational overhead. GitHub Enterprise Server (GHES) is the self-hosted version you run on-prem, keeping data in-house, but feature delivery follows releases, so some cloud-only features (latest previews, etc.) may lag or be unavailable. When designing, verify "which feature is available where."
6.1.3Default configurations and inheritance
A default security configuration templatizes "which features to enable with which settings." Applied to an org, it applies settings uniformly to targeted new/existing repos, and via inheritance automatically affects repos created later. You can use GitHub’s recommended configuration or an org custom configuration, reducing per-repo manual work and ensuring coverage and consistency.
Common: (1) Enable GHAS across the enterprise → org → repo hierarchy; upper policy cascades (inherited) downward; bulk-enable across many repos. (2) Know GHEC (cloud, features earlier) vs GHES (self-hosted, follows releases; some cloud-only features lag/unavailable). (3) Default security configurations (GitHub recommended / custom) apply uniformly + inherit = coverage and consistency.
Watch out: (1) GHEC and GHES differ—"available in cloud" doesn’t imply "available on Server." (2) Default configurations inherit to new repos, but verify the scope of application to existing repos. (3) Enterprise constraints can’t be loosened below (mind cascade direction). (4) Relying on per-repo enablement leaves coverage gaps at scale—raise the baseline via org/enterprise defaults.
6.1.4Section summary
- Enable across enterprise → org → repo; upper policy cascades (inherited); bulk-enable across many repos
- Know GHEC (cloud, features earlier) vs GHES (self-hosted, follows releases)
- Default security configurations (recommended/custom) apply uniformly + inherit = coverage and consistency
- Upper constraints can’t be loosened below; per-repo-only leaves coverage gaps
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to apply "which features with which settings" as a template uniformly to many new/existing repos and inherit to future repos. What do you use?
Q2. Which correctly relates GitHub Enterprise Cloud and Enterprise Server?
Q3. What is the most appropriate way to quickly widen GHAS coverage in a large org?
Q4. Which is correct about the GHAS enablement hierarchy?
Q5. Which is correct about inheritance of default security configurations?
Q6. Which deployment would an org choose to keep data on-premises while operating GitHub?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.