GH-500
GitHub Advanced Security Exam
GH-500 Exam Guide: GitHub Advanced Security Preparation and Study Roadmap
GH-500 validates practical ability to use GitHub Advanced Security to protect code, secrets, and dependencies across the software development lifecycle. It is intended for candidates who already understand GitHub, CI/CD, and secure-development concepts and can configure features, investigate alerts, and support remediation. This guide helps you decide whether your current hands-on experience is sufficient, which exam domains deserve the most study time, and how to build a focused preparation plan before scheduling.
Is GH-500 the right exam for your background?
GH-500 is best suited to an intermediate candidate who has worked with GitHub Advanced Security rather than studied security concepts only in theory. Before booking, compare your experience with the official profile and identify whether your gap is product operation, security decision-making, or administration.
Microsoft describes the audience as candidates who use GitHub Advanced Security to secure code, secrets, and dependencies throughout the software development lifecycle. The profile also includes familiarity with GitHub fundamentals, CI/CD, and secure-development concepts. Candidates are expected to configure security features, triage and remediate alerts, and apply prevention-first practices through policies, workflows, and automation.
The certification is associated with Administrator, Developer, DevOps Engineer, Solution Architect, and Student roles. Those labels describe the intended audience, not a list of mandatory job titles or prerequisites. A developer may need to strengthen enterprise governance, while an administrator may need more practice interpreting code, secret, and dependency findings.
Use a simple readiness test before starting a full study cycle. Can you explain why a finding matters, identify the relevant GHAS capability, choose an appropriate policy or workflow response, and describe how remediation should be verified? If you can name features but cannot make those decisions, prioritize practical labs and official skill objectives over memorization.
A candidate with little GitHub experience should first build that foundation. GH-500 is not framed as a general introduction to source control or application security. The official course is intermediate, and the exam profile assumes familiarity with the surrounding development workflow. That makes foundational study a sensible prerequisite rather than an optional extra.
What skills and domains are measured?
The exam covers six connected domains, so preparation should follow the security lifecycle rather than treat GHAS features as isolated product names. The largest listed ranges are 15–20%, while Code Security and administration are each listed at 10–15%; use the domain labels whenever you allocate study time.
Domain 1: Describe GitHub Security Suites, Features, and Ecosystem (15–20%). Study the structure and navigation of the GitHub Security suites, the distinction between Code Security, Secret Protection, and Supply Chain Security, feature availability in different repository or enterprise contexts, and the purpose of Security Overview. The study guide also connects this domain with secure SDLC strategies and the interplay among the protection areas.
Domain 2: Configure and Use Secret Protection (formerly secret scanning) (15–20%). Prepare to reason about protecting secrets, responding to detected exposure, and connecting prevention with operational remediation. Pay attention to the terminology change: the current domain name is Secret Protection, while secret scanning is identified as the former name.
Domain 3: Configure and Use Supply Chain Security (formerly Dependabot/Dependency Review) (15–20%). Organize your notes around dependency risk, review of changes, and the controls and workflows used to prevent vulnerable or unsuitable dependencies from reaching later stages. Again, retain both the current and former terminology so older course or reference material does not confuse your revision.
Domain 4: Configure and Use Code Security (formerly Code Scanning with CodeQL) (10–15%). Focus on how code-security capabilities fit into development workflows and how findings move from detection to prioritization and remediation. CodeQL is the former label identified in the published domain description; do not assume that knowing the name alone demonstrates operational understanding.
Domain 5: Security Operations: Best Practices, Prioritization, and Remediation (15–20%). This domain requires cross-feature judgment. Study how teams decide which alerts need attention, how they apply prevention-first practices, and how policies, workflows, and automation support consistent remediation rather than one-off manual actions.
Domain 6: GitHub Security Suites Administration (10–15%). Review the administrative perspective: organizing security capabilities, applying controls at the appropriate scope, and maintaining visibility across the environment. Candidates who mainly work inside one repository should deliberately study the broader administration viewpoint.
The ranges are exam blueprint allocations, not a promise of an exact question distribution. The study guide says the bullets under the skills measured illustrate assessment and that related topics may also be covered. Treat the published domains as a map of capabilities, not as a list that makes adjacent knowledge irrelevant.
How should you prioritize the blueprint?
Start with the four domains listed at 15–20%: GitHub Security Suites, Secret Protection, Supply Chain Security, and Security Operations. Then cover Code Security and GitHub Security Suites Administration at 10–15%, while checking that the lower range does not become an excuse to neglect either domain.
A practical allocation method is to create one study page for each domain and record three things: the feature or concept, the decision a practitioner must make, and the evidence that the decision worked. For example, a page on alert remediation should distinguish identifying a finding from prioritizing it, selecting an action, and confirming closure. This turns passive reading into exam-relevant reasoning.
Do not compare bare percentages. Domain 1: Describe GitHub Security Suites, Features, and Ecosystem (15–20%) is not interchangeable with Domain 4: Configure and Use Code Security (10–15%), even though both involve understanding security capabilities. Domain 5: Security Operations: Best Practices, Prioritization, and Remediation (15–20%) tests a broader operational lens than a single feature area.
Give extra attention to overlap. A supply-chain alert may require operational prioritization; a secret finding may require both a technical response and an organizational policy; code security may be configured through a workflow but reviewed through broader security operations. Build comparison tables that explain where each capability begins, what it detects or protects, and how the response is managed.
Use your own experience to adjust the order. If you administer GHAS every day but rarely investigate findings, begin with operations and remediation. If you develop code but have not configured organization-level controls, begin with the suites and administration domains. Blueprint weighting should guide time, but demonstrated weakness should determine sequence.
What does the official course contribute?
GH-500T00-A is an official intermediate GitHub Advanced Security course that can support either instructor-led training or self-paced study. Use it as a structured backbone, then test each topic by explaining a configuration choice and an alert-handling decision in your own words.
Microsoft lists the course duration as 1 day and offers it in English, Japanese, Korean, Portuguese (Brazil), and Spanish. The course audience includes learners who want to understand and implement advanced security practices with GHAS. It covers the role of GHAS in securing code, the software supply chain, and secrets before production, as well as visibility into security posture.
A one-day course should not be mistaken for a complete personal preparation schedule. Its value is organization and alignment with the product, not automatic readiness. After each course topic, write a short operational scenario: what problem is present, which capability addresses it, what scope or workflow matters, and how the team would respond to the resulting finding.
If you choose self-paced study, avoid watching or reading the material without producing an artifact. Build a domain checklist, annotate unfamiliar terms, and record questions that require confirmation from current Microsoft or GitHub documentation. If you choose instructor-led training, use the same method and ask for clarification when an example does not map cleanly to the published skills measured.
The course page is a useful starting point, but the study guide remains the reference for the exam’s current audience profile, blueprint, scoring information, language notes, and general availability guidance. Check both official pages before final revision because product terminology and assessed skills can change.
How can you study the six domains without memorizing feature names?
Study every feature through a repeatable chain: purpose, scope, configuration, signal, decision, and remediation. That chain mirrors the kind of practical understanding the candidate profile describes and helps you distinguish a useful control from a familiar product label.
For GitHub Security Suites and the ecosystem, map the relationship among Code Security, Secret Protection, and Supply Chain Security. Note what each area is intended to protect and where Security Overview provides visibility. Then examine how availability differs between public repositories and enterprise environments, because the study guide explicitly includes that distinction.
For Secret Protection, concentrate on the complete response rather than only detection. Your notes should cover how a team prevents exposure, how it handles a detected secret, how it decides urgency, and how it prevents recurrence. Do not reduce the topic to a list of alert types or assume that identifying a secret resolves the underlying risk.
For Supply Chain Security, connect dependency review with the development process. Practice describing how a dependency change is assessed, how risk affects a review decision, and how policies or automation can prevent an unsafe change from progressing. Keep the former Dependabot and Dependency Review terminology beside the current Supply Chain Security wording in your notes.
For Code Security, distinguish configuring analysis from interpreting its output. Review how code-security findings enter a workflow, how developers and security teams evaluate them, and how remediation is tracked. The exam is not served by memorizing the word CodeQL without understanding the broader Code Security capability.
For Security Operations, create prioritization exercises using only documented or clearly hypothetical conditions. Ask which finding should be addressed first, what information is missing, who should act, and what evidence would demonstrate remediation. The goal is disciplined reasoning, not guessing at undisclosed exam scenarios.
For Administration, work from the scope outward. Compare repository, organization, and enterprise considerations in your notes where the official material supports them, and identify which policy, workflow, or visibility decision belongs at each level. Avoid inventing permissions or feature behavior that you have not confirmed in current official documentation.
Use a two-column glossary for current and former names: Secret Protection and secret scanning; Supply Chain Security and Dependabot/Dependency Review; Code Security and Code Scanning with CodeQL. This is a practical way to read older material accurately without treating historical labels as separate exam objectives.
What hands-on practice is worth doing?
Hands-on practice should reproduce decisions, not attempt to recreate confidential exam content. Use an authorized GitHub environment and work through safe, disposable examples that let you configure a control, observe a security signal, decide on a response, and document what changed.
Create a small repository or approved practice project with a clear security objective. Begin by identifying which protection area applies: code, secrets, or dependencies. Then write down the expected outcome before enabling a feature or workflow. This forces you to connect a setting with a risk instead of clicking through configuration screens without a purpose.
For an alert exercise, use a harmless and authorized test condition rather than real credentials or sensitive material. Practice reading the finding, recording its context, selecting an appropriate remediation path, and verifying that the response is complete. Never place live secrets into a practice repository, and do not use leaked material as study content.
For dependency work, review a controlled change and explain the decision a maintainer should make. Record why the change is acceptable, requires investigation, or should be blocked under the scenario’s stated policy. This develops the supply-chain judgment that a list of package names cannot provide.
For code-security work, follow the lifecycle from configuration through result review. Ask what the signal means, who owns the fix, how it enters the development workflow, and how closure is confirmed. If your environment does not support a feature or setting, record that limitation rather than assuming the behavior.
For administration practice, sketch an environment with more than one repository and decide where a control or visibility requirement belongs. Keep the exercise conceptual if you lack an authorized enterprise environment. The point is to practice scope and governance reasoning without claiming that an unverified setting exists.
Use the exam sandbox for interface familiarity. Microsoft says the sandbox demonstrates the look and feel of the exam and allows interaction with different question types in the same user interface. It is not a source of live questions, and it should supplement—not replace—domain study.
Which study mistakes waste the most time?
The most expensive mistake is treating GH-500 as a vocabulary test. Product names matter, but the published candidate profile emphasizes configuration, alert triage, remediation, policies, workflows, and automation. Make every definition serve a practical decision.
Do not study only the domain that matches your current job. A developer who ignores administration may struggle with governance questions, while an administrator who skips code and dependency behavior may lack the context needed to prioritize findings. Use the blueprint to ensure every domain receives deliberate coverage.
Do not rely on a single course completion as evidence of readiness. The official course is listed as 1 day, whereas the exam measures six domains and includes cross-domain operational judgment. After training, use the study guide to audit omissions and the practice assessment to identify remaining gaps.
Do not treat practice-assessment performance as a substitute for understanding. Microsoft says the practice assessment provides an overview of question style, wording, and difficulty and helps identify areas for further preparation. Review why an answer is correct, what assumption led you astray, and which official objective addresses the gap.
Do not assume every feature in a third-party article is current or generally available. The study guide notes that most questions cover general availability features, though preview features may appear when they are commonly used. Confirm current terminology and availability in official Microsoft or GitHub material before committing it to your notes.
Do not memorize alleged question banks, dumps, or leaked content. Such material is not a reliable way to build the configuration and remediation judgment described by the official objectives, and using unauthorized exam content undermines the integrity of the assessment. Use official preparation resources and legitimate practice instead.
Do not ignore wording changes. Secret Protection, Supply Chain Security, and Code Security are the current domain labels identified alongside their former names. If your notes use only older terminology, you may waste revision time wondering whether a renamed capability is a new objective.
Do not schedule from an organizational account without checking the account guidance. Microsoft strongly recommends registering with a personal MSA account because exam records associated with an organizational work or school account can be lost and unrecoverable if the candidate leaves that organization.
What is the GH-500 delivery format and scheduling information?
GH-500 is a proctored assessment with 100 minutes to complete it, and Microsoft notes that interactive components may be included. Schedule through Pearson VUE using the official certification page, and verify the available language, price, and appointment details for your country or region before committing.
Microsoft lists English, Spanish, Portuguese (Brazil), Korean, and Japanese as exam languages. The study guide says that localized versions may be updated approximately eight weeks after the English version, although the schedule can vary. Use the Schedule Exam section of the official exam-details page to confirm which languages are currently available.
If the exam is not available in your preferred language, the study guide says you can request an additional 30 minutes to complete it. Treat this as an accommodation or scheduling matter to arrange through the official process, not as an assumption that extra time will be added automatically.
The certification page states that the price is based on the country or region in which the exam is proctored. Because no universal price applies, check the current booking screen rather than relying on a training-site figure or an older candidate report.
Explore the exam sandbox before scheduling if you are unfamiliar with Microsoft’s interface. It can reduce uncertainty about question types and navigation, but it does not reveal the live assessment. Read the official policies and accommodation information when you book, especially if you need assistive technology or extra time.
The exam is provided by Microsoft, while the exam and associated certification are maintained by GitHub. That distinction explains why Microsoft Learn hosts scheduling and preparation information while the certification is centered on GitHub Advanced Security. Use the official certification page as the operational source for booking decisions.
How should you build a practical study roadmap?
A four-stage roadmap works well: establish the baseline, learn by domain, integrate operational decisions, and verify readiness. Keep the stages flexible; the correct pace depends on your existing GHAS exposure, available practice environment, and performance on legitimate assessment activities.
Stage one is a baseline review. Read the audience profile and all six skills headings in the official study guide. Mark each domain as strong, familiar, or weak, then write one sentence explaining what you can actually do in that area. “I know the feature name” is not evidence of operational competence; “I can explain the response path” is more useful.
Stage two is structured learning. Use GH-500T00-A or the corresponding official self-paced material as your spine. Study Domain 1 first if the product boundaries are unclear, then move through Secret Protection, Supply Chain Security, and Code Security. Add Security Operations after the individual capabilities so you can reason across them, and finish the first pass with Administration.
Stage three is applied practice. For each domain, produce one configuration note, one decision note, and one verification note. A configuration note states what the control is meant to achieve. A decision note explains how a finding or change should be handled. A verification note records how you would know the action worked. Keep examples safe and authorized.
Stage four is integration. Take a practice assessment, inspect the report, and return to the official objectives behind every weak answer. Then perform a mixed review in which you must choose among Code Security, Secret Protection, Supply Chain Security, and operational responses. This prevents you from succeeding only when the feature category is announced in advance.
The final review should be selective. Revisit renamed capabilities, scope and availability distinctions, administration, prioritization, and any topic for which you relied on an unsupported assumption. Read the current study guide again because it identifies the assessed skills as of July 2026 and notes that related topics may also be covered.
Schedule only after your evidence supports the decision. Useful evidence includes consistent explanations of the six domains, completed authorized practice, a reviewed practice-assessment report, and confidence with the exam interface. A target score on a practice activity is not a guarantee of the real result, so use it as one readiness signal among several.
A compact weekly sequence
In the first study block, map the blueprint and test your baseline. In the next blocks, cover the product ecosystem, Secret Protection, and Supply Chain Security. Follow with Code Security, then Security Operations and Administration. Reserve the last block for mixed scenarios, the practice assessment, and correction of specific gaps rather than another passive reread.
What to record after each session
Keep a decision log with the domain, the risk being addressed, the relevant capability, the scope or workflow consideration, the response to a finding, and the evidence of remediation. This format exposes gaps quickly: if you can describe detection but not ownership or verification, your study is incomplete in a way that flashcards may conceal.
How can you use the practice assessment and score information?
The official practice assessment is most useful as a diagnostic checkpoint. Use it after an initial domain pass, not as your only preparation resource, and convert each weak result into a specific study action tied to the published skills measured.
Microsoft describes practice assessments as a way to understand the likely style, wording, and difficulty of questions, assess readiness, locate preparation needs, and fill knowledge gaps. Review the report carefully. Separate an error caused by unfamiliar terminology from one caused by misunderstanding configuration scope or choosing an incomplete remediation response.
The official GH-500 study guide states that a score of 700 or greater is required to pass. That is the exam’s stated passing requirement, not a recommended practice-assessment threshold and not a promise that a particular practice result predicts the final outcome. Keep those two measurements separate in your notes.
When reviewing an incorrect answer, use a four-question correction method: Which domain was tested? What risk or objective was involved? What tempting alternative did I choose? What official explanation or documentation resolves the distinction? Write the correction as a rule with an exception where appropriate, rather than copying an answer letter.
If your results show a weak domain, return to hands-on or scenario-based study for that area. If results are broadly weak, stop taking more assessments and rebuild the fundamentals. Repeatedly answering questions without repairing the underlying model can create familiarity with the assessment format without improving GHAS judgment.
Avoid interpreting any unofficial question source as a score predictor. No practice product can guarantee the live assessment result, and memorization cannot replace the skills Microsoft describes. Use authorized resources, the official study guide, the course, and the exam sandbox as the core of your preparation.
What should you do before booking and on exam day?
Before booking, confirm the current exam page, language, price for your region, account choice, accommodations, and appointment arrangements. Before starting the assessment, rely on the official delivery instructions and policies; this guide does not infer test-day procedures that Microsoft has not supplied here.
Connect your certification profile to Microsoft Learn if you need to schedule or manage certification records. Microsoft says the profile connection supports scheduling and renewal and allows candidates to share and print certificates. Register with a personal MSA account as recommended on the certification page, especially if your employment or school affiliation may change.
Check language needs early. The listed languages are English, Spanish, Portuguese (Brazil), Korean, and Japanese, and the study guide explains the additional-time request when the preferred language is unavailable. Do not wait until the appointment is imminent to investigate an accommodation or language-related request.
Use the sandbox before the appointment so interactive components and question navigation are not completely unfamiliar. Because Microsoft says interactive components may be part of the assessment, include interface practice in your final checklist while keeping your technical review focused on the six domains.
For the final technical review, use your decision log rather than trying to reread everything. Confirm that you can distinguish the three protection areas, connect findings to operations, explain administrative scope, and describe prevention-first practices using policies, workflows, and automation.
If you fail, Microsoft states that a retake is available 24 hours after the first attempt; later retake intervals vary. Treat a retake as a new diagnostic cycle: review the score report, identify domains needing work, and correct the specific reasoning gap before booking again. Do not assume that immediate repetition without changed preparation will produce a different result.
Microsoft’s study guide also notes that Microsoft associate, expert, and specialty certifications expire annually and can be renewed by passing a free online assessment on Microsoft Learn. Check the current certification resources for renewal details after earning the credential, rather than treating the initial exam as the end of certification maintenance.
What are the next actions for a serious candidate?
Your next action is to compare the official audience profile with your own work, then turn the six-domain blueprint into a gap list. Do not schedule merely because the exam title matches your role; schedule when your preparation evidence shows that you can make and explain GHAS security decisions.
Open the official study guide and record the six domains with their labels and ranges. Mark the protection area or operation you know least well. Read the official course outline, choose instructor-led or self-paced study based on your schedule, and arrange an authorized environment for safe practice.
Create a domain notebook using the sequence purpose, scope, configuration, signal, decision, and remediation. Keep current and former terminology together. Use the official practice assessment after your first pass, review its report, and return to the exact skills measured rather than collecting more disconnected resources.
Finally, inspect the official certification page for the current delivery, language, scheduling, accommodation, and account information. Explore the sandbox, confirm the regional booking details, and make the appointment only when the operational and administrative parts of your preparation are as strong as the feature-specific parts.
GH-500 preparation is most efficient when it produces evidence of judgment: a reasoned configuration, a prioritized response, and a verifiable remediation path. That approach supports the exam’s stated focus while also giving you a more useful way to decide what to study next.
Conclusion
GH-500 rewards preparation that connects GitHub Advanced Security capabilities with real security operations. Start from the official six-domain blueprint, strengthen the areas your experience does not cover, practice safe configuration and remediation decisions, and use the practice assessment and sandbox as diagnostics. Confirm current scheduling and language details on Microsoft Learn before booking, and keep unsupported assumptions out of your study notes.
Related exams
- GH-100 exam — GitHub Administration
- GH-200 exam — GitHub Actions Exam
- GH-300 exam — GitHub Copilot Exam
- GH-900 exam — GitHub Foundations