Skip to content
Cheat sheets
Associate · GH-500Prep available

GitHub Certified: GitHub Advanced Security (GH-500) practice exam and study path

A free, timed 50-question GH-500 practice exam in 100 minutes, scored by domain, with every option explained after you submit. Also 150 practice questions you can check one at a time, a page for every task in the exam guide, and a study path. No sign-up.

Start the free practice examGet the exam packPractise question by question →
GitHub Advanced Security exam pack:

$6.99for 12 months

For developers, security engineers and administrators who secure code, secrets and dependencies on GitHub: Secret Protection and push protection, Dependabot and dependency review, CodeQL code scanning, triage and remediation at scale, and rolling the security products out across an enterprise.

The exam

Exam code
GH-500
Questions
Not yet published
Time
100 minutes
Passing score
700 of 1,000 (scaled)
Exam fee
$99 (USD)
Question types
multiple choice, multiple response

Exam GH-500 is a proctored exam of 100 minutes, offered in English, Spanish, Portuguese (Brazil), Korean and Japanese; it may include interactive components, and 700 passes. Microsoft doesn't publish the number of questions (most of its exams have 40 to 60). The fee is set by the country or region (USD 99 in the United States). GitHub certifications are valid for two years. Our forms use 50 questions split 9 / 9 / 9 / 7 / 9 / 7, close to the scaled midpoints of the guide's ranges.

From GitHub's certification page and exam guide, checked Oct 25, 2026.

Domains and weights

  • Domain 1: Describe GitHub Security suites, features, and ecosystem

    19%

  • Domain 2: Configure and use Secret Protection (formerly secret scanning)

    19%

  • Domain 3: Configure and use supply chain security (formerly Dependabot/Dependency Review)

    18%

  • Domain 4: Configure and use Code Security (formerly Code Scanning with CodeQL)

    13%

  • Domain 5: Security operations: best practices, prioritization, and remediation

    18%

  • Domain 6: GitHub Security suites administration

    13%

On our roadmap this comes after GitHub Copilot. See every certification.

Practice

150 original practice questions, every option explained with the GitHub documentation page that proves it. Free, no sign-up; progress stays on this device.

Your results on this device →

More practice exams

The lessons, the sample questions on every task page and the first full practice exam are free and stay free. A pack adds the further timed GH-500 practice exams.

GitHub Advanced Security exam pack

$6.99for 12 months

  • Every paid GH-500 practice exam, timed, with every option explained
  • The next version of this exam included when it changes within your 12 months
  • 12 months of access. One payment, nothing renews by itself.
  • 14-day refund, no conditions
  • 14-day refund, no conditions: ask within 14 days of buying and you get the whole payment back.
  • No pass guarantee. These are practice exams written by us from the exam guide and the GitHub documentation; a score here does not predict your result on the real exam.

Study path

One module per exam domain. Lessons that already exist on BytePatterns are linked; the rest are being written.

  1. Module 1: Describe GitHub Security suites, features, and ecosystem

    1. 1GitHub Secret Protection and GitHub Code Security: what each contains and what public repositories get freeTask 1.1

      Lesson coming

    2. 2The Security and quality tab and security overviewTask 1.1

      Lesson coming

    3. 3A secure SDLC on GitHub: prevention at the source, gates before merge, campaigns for the backlogTask 1.2

      Lesson coming

    4. 4Which feature finds what, and what dismissing an alert really meansTask 1.3

      Lesson coming

    5. 5Alert access, delegated bypass and dismissal, and the supply chain pictureTask 1.4

      Lesson coming

  2. Module 2: Configure and use Secret Protection (formerly secret scanning)

    1. 6Enabling Secret Protection and its optional detectionsTask 2.1

      Lesson coming

    2. 7Secret leakage risks and keeping credentials out of codeTask 2.2

      Partly covered by: ConfigMaps, Secrets & Env

    3. 8Push protection, bypass reasons and validity checksTask 2.2

      Lesson coming

    4. 9The secret scanning alert lifecycle and remediating a leaked credentialTask 2.3

      Lesson coming

    5. 10Bypass lists, exemptions, exclusions and custom patternsTask 2.4

      Lesson coming

  3. Module 3: Configure and use supply chain security (formerly Dependabot/Dependency Review)

    1. 11The dependency graph, the GitHub Advisory Database and SBOM exportTask 3.1

      Lesson coming

    2. 12Dependabot alerts, security updates, EPSS and auto-triage rulesTask 3.2

      Lesson coming

    3. 13Dependency review, license checks and dependabot.yml update rulesTask 3.3

      Lesson coming

    4. 14Permissions, enforcement, notifications and webhooks for DependabotTask 3.4

      Lesson coming

  4. Module 4: Configure and use Code Security (formerly Code Scanning with CodeQL)

    1. 15CodeQL, AI Scan, third-party tools and SARIFTask 4.1

      Lesson coming

    2. 16Default and advanced setup, external CI, matrix builds and scan frequencyTask 4.2

      Lesson coming

    3. 17Triaging code scanning alerts, Copilot Autofix and agentic autofixTask 4.3

      Lesson coming

    4. 18Tuning analysis and troubleshooting failed or slow scansTask 4.4

      Lesson coming

  5. Module 5: Security operations: best practices, prioritization, and remediation

    1. 19CVE, CWE, security advisories and private vulnerability reportingTask 5.1

      Lesson coming

    2. 20Severity rules, rulesets, campaigns and bulk alert workTask 5.2

      Lesson coming

    3. 21Query suites, packs and threat models fitted to organizational riskTask 5.3

      Lesson coming

    4. 22Roles, delegated exceptions, alert ownership and cross-suite governanceTask 5.4

      Lesson coming

    5. 23Shifting left with push protection, dependency review and pull request analysisTask 5.5

      Lesson coming

  6. Module 6: GitHub Security suites administration

    1. 24Enabling the security products at scale on GitHub Enterprise Cloud and GitHub Enterprise ServerTask 6.1

      Lesson coming

    2. 25Security configurations, defaults, enforcement and global settingsTask 6.2

      Lesson coming

    3. 26Enterprise policies, rulesets, bypass permissions and roles for alertsTask 6.3

      Lesson coming

    4. 27CodeQL workflows at scale, and APIs, webhooks and the audit log for automationTask 6.4

      Lesson coming

Every task in the exam guide

The exam guide splits each domain into task statements. Each one has a page with a short summary, the lessons that teach it and open sample questions.

Domain 1: Describe GitHub Security suites, features, and ecosystem

Domain 2: Configure and use Secret Protection (formerly secret scanning)

Domain 3: Configure and use supply chain security (formerly Dependabot/Dependency Review)

Domain 4: Configure and use Code Security (formerly Code Scanning with CodeQL)

Domain 5: Security operations: best practices, prioritization, and remediation

Domain 6: GitHub Security suites administration

How these questions are made

  • Written by us from the exam guide's task statements and the GitHub documentation — never from real exam content.
  • Every option carries its own explanation and a link to the GitHub page that proves it.
  • A question enters a timed exam only after an independent check; until then it is a practice question.
  • Results are a plain percentage, per domain too — not an imitation of GitHub's scaled score.

Questions about the GH-500 practice exam

Is the GH-500 practice exam free?
Yes. The full practice exam (50 questions, 100 minutes) is free with no sign-up, and so are the 150 practice questions, the task pages and the study path. Your attempts are saved in this browser, on this device.
How many questions does it have, and is it timed?
50 questions in 100 minutes: the real GH-500 pace, scaled to this form. When the time runs out, the exam is submitted as it stands.
Are the answers explained?
After you submit, not during: like the real exam, the timed exam gives no feedback until the end. Then you get your score overall and per exam domain, and every question with each option explained and a link to the GitHub documentation page behind it. In practice mode an answer is explained as soon as you check it.
What does the GitHub Advanced Security exam pack add?
3 more timed practice exams (Practice exam 1: 50 questions, 100 minutes; Practice exam 2: 50 questions, 100 minutes; Practice exam 3: 50 questions, 100 minutes), each scored and explained the same way, and the next version of this exam if it changes within your 12 months. 12 months of access. One payment, nothing renews by itself. Everything above stays free. See the pack.
Can I get a refund?
Yes, with no conditions: ask within 14 days of buying and you get the whole payment back. The details are in the terms.
Is this an official GitHub practice exam?
No. BytePatterns is not affiliated with, endorsed or sponsored by GitHub. Every question is written by us from the public exam guide and the GitHub documentation, never from real exam content, and a score here does not predict your result on the real exam. GitHub lists its own preparation resources on its certification page.