GH-500 Exam Guide: Plan Your GitHub Advanced Security Preparation
GH-500 validates practical knowledge of GitHub Advanced Security, including securing code, secrets, and dependencies across the software development lifecycle. It is aimed at candidates who can configure security features, investigate alerts, and use policies, workflows, and automation to reduce risk. This guide helps you decide whether your current experience is sufficient, which domains deserve the most study time, and how to turn the official skills outline into a focused preparation plan.
Is GH-500 the right exam for you?
GH-500 is best suited to candidates who already work with GitHub Advanced Security rather than readers beginning with GitHub from scratch. Microsoft describes the audience as people who secure code, secrets, and dependencies across the software development lifecycle and who understand GitHub fundamentals, CI/CD, and secure-development concepts.
The associated certification is classified by Microsoft as intermediate level. The listed role relevance includes Administrator, Developer, DevOps Engineer, Solution Architect, and Student, but the audience profile is more useful than the job-title list: you should be able to connect a security finding with its configuration, workflow, ownership, and remediation path.
Use your recent work as a readiness test. Can you explain how a security control fits into pull requests and deployment workflows? Can you distinguish a secret exposure from a vulnerable dependency or a code flaw? Can you decide what to do with an alert instead of merely identifying it? If several answers are no, build hands-on familiarity before booking the assessment.
The certification page says candidates can configure security features, triage and remediate alerts, and apply prevention-first practices through policies, workflows, and automation. Those verbs indicate the level of preparation required: memorizing product labels is less useful than understanding why a control is enabled, how it produces a result, and what action follows.
What skills does the exam measure?
The exam is organized into six domains. Three domains carry 15–20% each, two carry 10–15% each, and one additional domain carries 15–20%. Study each domain by its official name so that your revision notes retain both the subject and its weight.
Domain 1: Describe GitHub Security Suites, Features, and Ecosystem accounts for 15–20% of the assessed content. This area establishes the vocabulary and architecture used by the rest of the exam. Prepare to distinguish the major security capabilities and understand how they fit into a broader secure-development approach.
Domain 2: Configure and Use Secret Protection, formerly secret scanning, accounts for 15–20% of the assessed content. Focus on the practical lifecycle of identifying exposed credentials, understanding the resulting alert, and applying an appropriate response or prevention measure.
Domain 3: Configure and Use Supply Chain Security, formerly Dependabot and Dependency Review, accounts for 15–20% of the assessed content. Your preparation should cover dependency risk as a development workflow concern, including how findings are surfaced and how teams prioritize and remediate them.
Domain 4: Configure and Use Code Security, formerly Code Scanning with CodeQL, accounts for 10–15% of the assessed content. Study how code-security analysis supports development, how findings are interpreted, and how a team moves from detection to a defensible remediation decision.
Domain 5: Security Operations: Best Practices, Prioritization, and Remediation accounts for 15–20% of the assessed content. This domain requires cross-feature judgment. Practice ranking findings, selecting an owner, deciding what should block or interrupt a workflow, and documenting an appropriate response.
Domain 6: GitHub Security Suites Administration accounts for 10–15% of the assessed content. Prepare for organization- or enterprise-level thinking: configuration scope, policy decisions, visibility, governance, and the relationship between centralized administration and repository-level work.
The percentages are ranges, not promises about the exact number of questions in each domain. Microsoft’s study guide also warns that the bullets under the measured skills illustrate assessment coverage and that related topics may appear. Use the domain list as a boundary for study, not as a prediction of individual questions.
How should you prioritize the blueprint?
Start with the three 15–20% domains that match your weakest practical experience, then connect them through Security Operations: Best Practices, Prioritization, and Remediation, which also represents 15–20% of the assessed content. Do not treat the 10–15% domains as optional; administration and Code Security can expose gaps that affect several other areas.
A useful allocation method is to create a six-row study table. Put the official domain name in the first column, your current confidence in the second, the configuration or workflow you can demonstrate in the third, and unresolved questions in the fourth. The final column should contain a verification task, such as tracing an alert from creation to closure.
Give extra attention to domains where you know terminology but cannot explain decisions. For example, recognizing the names of Secret Protection, Supply Chain Security, and Code Security is not the same as knowing when each capability applies, how its result reaches developers, or what remediation should occur.
Avoid assigning study time solely by percentage. A domain that appears smaller may still be a dependency for your understanding of a larger domain. Administration affects how features are enabled and governed, while security operations requires you to interpret results from multiple protection areas.
The official study guide is the controlling reference for the current measured skills. Microsoft labels the skills as measured as of July 2026, so check the study guide again when you schedule if your preparation extends across a blueprint update.
What should you learn before feature-by-feature practice?
Build a shared foundation before opening separate notes for secrets, dependencies, and code. Start with GitHub fundamentals, CI/CD concepts, and secure-development principles, then map each GHAS capability to the point in the software development lifecycle where it prevents, detects, prioritizes, or remediates risk.
First, review the difference between a security objective and a product feature. The objective may be preventing a credential from reaching a repository, while the feature provides detection, alerting, workflow integration, or administrative control. This distinction helps with scenario questions that ask for the best operational response rather than a product definition.
Next, sketch a simple lifecycle for a repository: development, pull request, merge, build, release, and ongoing maintenance. For each stage, write what security signal could appear, who should receive it, and what action would close the risk. Keep the exercise conceptual and use official documentation or a permitted lab for implementation details.
Then create a comparison sheet for the three named protection areas. Record the type of risk each addresses, the kind of signal it creates, the likely development owner, and the point at which prevention is preferable to remediation. Do not fill gaps with assumptions; verify unclear behavior in the Microsoft Learn material or the product documentation linked from the official study resources.
Finally, add the administrative perspective. A developer may need to fix a finding in one repository, while an administrator may need to establish consistent policies or visibility across an organization. GH-500 expects you to understand both perspectives, so write separate notes for repository action and centralized governance.
How do you study Secret Protection effectively?
Study Secret Protection as an end-to-end response process, not as a list of alert screens. Your notes should answer four questions: how exposure is identified, how the alert is interpreted, what immediate response is appropriate, and which prevention or policy decision reduces the chance of recurrence.
Begin by describing the risk in plain language: a credential or other sensitive value has been exposed where it should not be. Then trace the operational consequences. A useful exercise is to write a response sequence that separates containment, investigation, credential handling, remediation, and prevention. Keep provider-specific response steps tied to the official documentation you are using.
Practice distinguishing detection from resolution. Closing or dismissing an alert does not by itself prove that the underlying secret is safe. In your study notes, identify what evidence would support a remediation decision and what information a security team would need before treating the exposure as contained.
Connect Secret Protection to development workflow. Ask where a developer would encounter the signal, how a pull request or automation process might respond, and which policy or education measure could prevent repeated exposure. This reinforces the prevention-first emphasis in the certification description.
A common mistake is treating every finding as a generic code defect. Secret exposure has different urgency and ownership considerations from a dependency vulnerability or a static-analysis finding. Build a three-column comparison and explain the first action you would take for each type without claiming that one universal response fits every organization.
How do you prepare for Supply Chain Security?
Treat Supply Chain Security as the management of dependency risk throughout development. Preparation should connect dependency identification, review, alert interpretation, upgrade decisions, and workflow impact instead of focusing only on the name of a scanning tool or feature.
Use a sample dependency-change scenario for practice. Write down what information you would need before accepting or rejecting the change, how a vulnerability signal might affect the decision, and when a developer should update, replace, isolate, or formally accept the risk. The goal is disciplined reasoning, not memorization of an unverified command or interface detail.
Study the relationship between routine dependency maintenance and security remediation. A team may need to handle a new vulnerability differently from an outdated but non-vulnerable package. Your notes should distinguish the signal, the available remediation path, the business or technical constraint, and the person responsible for deciding the next step.
Include pull-request thinking. Ask how dependency review can influence a proposed change before it becomes part of the default branch, and how automation can support consistent review. Then connect that decision to security operations: not every alert has identical severity, exploitability, exposure, or remediation cost.
Do not confuse supply-chain protection with code analysis. A vulnerable library and an insecure code pattern may both create risk, but the evidence and remediation route differ. If your explanation uses the same process for both, revisit the domain boundaries and verify the product behavior in current Microsoft Learn resources.
How do you study Code Security and CodeQL?
Prepare for Code Security by learning how code analysis fits into the development workflow and how a finding becomes an engineering decision. The official domain name is Code Security, formerly Code Scanning with CodeQL, so retain both names when comparing older study material with the current blueprint.
Start with the analysis lifecycle: code is examined, a potential weakness is reported, the result is reviewed, and a remediation or exception decision follows. For every stage, note what a developer, security analyst, or administrator needs to know. This prevents a narrow focus on query terminology while neglecting triage and workflow integration.
Practice interpreting a finding without assuming that every result is equally actionable. Ask whether the result is relevant to the project, how it affects the reachable code or workflow, and what evidence supports remediation. Use only official examples or a controlled environment for technical details, because product behavior and supported configurations can change.
Connect Code Security to prevention-first development. A finding discovered during a proposed change can be easier to address than one found after release, but the correct response still depends on context and policy. Write a short decision tree for review, prioritization, remediation, and documented exception handling.
A frequent pitfall is studying CodeQL as an isolated query language topic. GH-500 is broader: the measured domain sits alongside security operations and administration. You need enough conceptual understanding to select and manage code-security practices, interpret their outputs, and explain how they support secure delivery.
How should you approach security operations questions?
Security Operations: Best Practices, Prioritization, and Remediation is where separate feature knowledge must become operational judgment. Practice choosing an order of action, assigning responsibility, and explaining why a finding should be fixed, investigated, deferred, or handled through an approved exception.
Create mixed scenarios rather than studying one alert type at a time. For each scenario, identify the risk category, affected asset, confidence of the signal, potential impact, available remediation, and policy constraint. Then write the next action and the evidence you would seek. This framework is a preparation technique, not an official scoring rule.
Study prioritization as a process, not as a single severity label. A finding’s treatment can depend on exposure, exploitability, affected component, business importance, and whether a safe fix exists. Keep these factors separate in your notes so you do not assume that the most visible alert is automatically the first task.
Review how workflows and automation can make response repeatable. Ask what should be automated, what requires human review, and how a team would prevent an automated action from hiding an unresolved risk. The certification page specifically includes policies, workflows, and automation in its description of candidate capability.
Do not memorize a rigid remediation order. Real organizations use different ownership models and policies, and the official material does not establish one universal sequence for every incident. Demonstrate that you can reason from the facts in a scenario and choose an action consistent with secure-development practice.
What administration knowledge should you build?
Administration preparation should move beyond clicking through a repository setting. Study how security capabilities are governed, how visibility is established, how policies affect teams, and how administrators balance centralized consistency with repository-specific needs.
Draw two views of the same control. In the first, describe what a repository contributor experiences when a security result appears. In the second, describe what an organization or enterprise administrator must configure, monitor, or communicate to make that control effective across teams.
Use the official domain label, GitHub Security Suites Administration, as a prompt to investigate scope and governance. Note which decisions belong to administrators, which belong to developers, and where responsibilities overlap. Avoid inventing a universal permission model; confirm current behavior in the official learning resources.
Include adoption and maintenance in your notes. A security control that is enabled but not reviewed, routed, or acted upon does not create a complete operational process. Practice explaining how administrators can support visibility and consistent response while allowing development teams to remediate findings in context.
One common mistake is learning feature configuration without learning its effect on workflow. For every administrative topic, write the developer consequence: what signal changes, what process is introduced, or what decision becomes mandatory. This makes the administration domain relevant to the rest of the exam.
Which official learning resources should you use?
Use the current GH-500 study guide as your syllabus, the certification page for assessment and scheduling information, and the GH-500T00-A course for structured learning. Add the official practice assessment and exam sandbox after you understand the domains; using them too early can measure unfamiliarity with wording rather than readiness.
The Microsoft Learn course GH-500T00-A is listed as an intermediate GitHub Advanced Security course. Microsoft provides it for instructor-led training or self-paced study, and the listed course languages are English, Japanese, Korean, Portuguese (Brazil), and Spanish. Choose the format that matches your schedule and need for guided explanation.
Read the study guide line by line and convert each skill statement into a demonstrable task or explanation. The guide says its bullets illustrate assessment coverage and that related topics may also be covered. That means a checklist should organize your study, not encourage you to ignore concepts that are not phrased as separate bullet points.
Use the official practice assessment to assess question style, wording, and difficulty, and to identify gaps. Review every missed or guessed response by returning to the relevant domain and writing the reason for the correct decision. A practice score should guide further study; it should not be treated as a guarantee of the live result.
The exam sandbox lets you interact with the exam interface and question types. Complete it before the assessment so that navigation and interactive components are not new on the day. The certification page notes that GH-500 may include interactive components.
Avoid dumps, leaked questions, and answer memorization. They do not establish that you can configure GHAS, triage a finding, or remediate a risk, and relying on unauthorized material can leave you unprepared for changed or scenario-based content. Use the official study guide and legitimate practice resources instead.
A practical four-stage study roadmap
A staged plan works better than reading every topic once. Begin with the blueprint, move to feature relationships, then practice operational decisions and finally test your readiness. Adjust the pace to your experience; the stages are a sequencing recommendation, not an official Microsoft timetable.
Stage one: baseline and scope. Read the audience profile and six domain names. Rate each domain as strong, familiar, or weak, and write one question you cannot yet answer for every weak area. Confirm that you understand GitHub fundamentals, CI/CD, and secure-development concepts before relying on GHAS-specific study.
Stage two: build the feature map. Study GitHub Security Suites, Secret Protection, Supply Chain Security, Code Security, and Security Suites Administration. For each, record the problem addressed, where the capability fits in the lifecycle, the type of signal produced, the likely owner, and the prevention or remediation decision that follows.
Stage three: run operational drills. Create mixed, authorized lab exercises or thought experiments that require you to interpret findings, prioritize work, explain a remediation, and identify an administrative or workflow consequence. After each exercise, compare your reasoning with the official study material and correct unsupported assumptions.
Stage four: verify readiness. Take the official practice assessment, review the report, and return to weak domains. Use the sandbox to become familiar with the interface. Schedule only after you can explain the main capabilities in your own words and can reason through a finding without depending on recalled answer patterns.
Keep a change log for your preparation. Record the date you checked the study guide, the domains reviewed, the practice gaps found, and the questions that remain unresolved. This is particularly useful because Microsoft identifies the measured skills as current as of July 2026 and notes that exam content can include related topics.
A compact weekly review cycle
At the start of a study session, choose one domain and one cross-domain scenario. Spend the first part recalling the concepts without notes, the middle part verifying them in official material, and the final part explaining the operational decision in writing. End by listing one item to revisit rather than rereading everything.
Rotate the three major protection areas so that your knowledge does not become siloed. Follow a Secret Protection session with a supply-chain or code-security scenario, then ask how Security Operations would prioritize the resulting findings. Finish the cycle with an administration question about policy, visibility, or ownership.
In the final review, focus on distinctions that are easy to blur: secret exposure versus dependency risk, code analysis versus supply-chain analysis, repository action versus centralized administration, and detection versus remediation. These comparisons are more useful than a glossary that contains no decision context.
What are the exam delivery and scheduling details?
Microsoft states that GH-500 is a proctored assessment with 100 minutes to complete it, and it may include interactive components. Check the live certification page before booking for the current scheduling process, available languages, price in your region, and any accommodation requirements.
The certification page lists English, Spanish, Portuguese (Brazil), Korean, and Japanese as available exam languages and directs candidates to schedule through Pearson Vue. Language availability and localized content can change, so verify the Schedule Exam information rather than relying only on a saved study note.
The study guide explains that localized exams may be updated approximately eight weeks after the English version, although Microsoft says this schedule is not guaranteed in every case. If GH-500 is not available in your preferred language, the study guide says you can request an additional 30 minutes to complete the exam. Treat this as an accommodation or language-support decision to resolve before scheduling.
Microsoft recommends registering with a personal Microsoft account. Using an organizational work or school account can create a serious record-keeping problem if you later leave that organization, because the certification page says exam records can be lost and unrecoverable. Confirm which account is connected to your Microsoft Learn profile before you register.
The price is based on the country or region where the exam is proctored. Because no single global price is supported by the supplied research, check the official scheduling flow for the amount that applies to you. Do not use third-party listings as a substitute for the official booking information.
If you fail a certification exam, Microsoft says the first retake is available 24 hours after the first attempt; later retake intervals vary. A retake policy is not a reason to schedule before you are ready. Use any unsuccessful attempt as a prompt to review the score report, blueprint domains, and unresolved practical gaps.
How should you manage time and question decisions?
Use the official 100-minute assessment limit as a pacing constraint, not as a reason to rush every item. Read the scenario for its scope, affected asset, requested outcome, and operational constraint before comparing answers. Interactive components deserve deliberate attention because the certification page says they may be included.
A practical method is to classify each item before solving it: feature selection, configuration or administration, alert interpretation, prioritization, or remediation. This narrows the relevant domain and reduces the temptation to choose an answer merely because it contains a familiar product term.
When two answers appear plausible, prefer the one that addresses the stated security objective and fits the scope of the scenario. Check whether the answer prevents the problem, detects it, routes it, or remediates it. Those are different outcomes, and a technically valid action may still be the wrong response to the question asked.
Do not let one difficult item consume your preparation mindset or your assessment time. Mark the uncertainty if the interface permits it, continue with the remaining work, and return with the scenario’s facts in mind. The sandbox is the appropriate place to learn the interface and navigation behavior beforehand.
Avoid reconstructing supposed live questions from memory or from unauthorized collections. The official practice assessment is designed to show style, wording, and difficulty, while the study guide defines the skills. Prepare to apply concepts to new situations rather than recognize copied text.
What mistakes commonly weaken preparation?
The most damaging mistakes are usually planning errors: studying labels without workflows, ignoring administration, treating all alerts alike, and failing to check the current study guide. Correct these by turning every topic into a decision, a configuration explanation, or an alert-response sequence that you can defend.
Mistake one is relying on a single product feature as the whole security strategy. GHAS spans code, secrets, dependencies, operations, and administration. Build a lifecycle map so that you can explain how capabilities complement one another rather than presenting them as interchangeable scanners.
Mistake two is treating the domain percentages as exact question quotas. Each blueprint percentage is a range, and the study guide says related topics may be covered. Use the weights to prioritize, but study the complete skill outline and preserve the official domain names in your notes.
Mistake three is confusing an alert with a completed remediation. Detection begins an investigation. Your response may require validation, ownership, containment, a fix, verification, and prevention. The exact sequence depends on the scenario, so practice explaining the reason for each step rather than memorizing a universal order.
Mistake four is overlooking current-versus-preview context. Microsoft says most questions cover generally available features, while preview features may appear if they are commonly used. Check the current study guide and official product material before spending disproportionate time on preview behavior.
Mistake five is leaving logistics until the last moment. Confirm your account, language, scheduling route, accommodation request, and familiarity with the sandbox before the appointment. These are practical recommendations based on the official delivery information; they are not additional exam requirements.
What should you do next?
Your next action should be a readiness audit, not another unfocused search for study material. Open the official GH-500 study guide, copy its six domain names into a checklist, and mark the areas where you can explain both the security purpose and the operational response.
If the audit shows weak fundamentals, begin with GitHub fundamentals, CI/CD, and secure-development concepts before concentrating on GHAS configuration. If your fundamentals are solid but your feature knowledge is uneven, work through the domains in blueprint order and use a controlled exercise to connect each capability to the software lifecycle.
If you already administer or develop with GHAS, start with a mixed-alert drill. Compare a secret finding, a dependency finding, and a code-security finding, then write how ownership, urgency, remediation, and prevention differ. Follow that with an administration review so that repository experience does not hide governance gaps.
Before scheduling, use the official practice assessment to identify remaining gaps and complete the exam sandbox. Verify the live certification page for language, scheduling, price, account, and accommodation information. Schedule when your preparation evidence shows consistent reasoning across the domains, not merely when you have finished reading them.
Conclusion
GH-500 preparation should demonstrate that you can operate GitHub Advanced Security as part of a secure development process. Use the official blueprint to set priorities, the study guide and GH-500T00-A course to structure learning, and the practice assessment and sandbox to verify readiness. The strongest final review connects features with ownership, workflow, prioritization, remediation, and administration. Check Microsoft Learn again before booking so that delivery and measured-skill details reflect the current official information.
Related exams
- GH-100 exam — GitHub Administration
- GH-200 exam — GitHub Actions Exam
- GH-300 exam — GitHub Copilot Exam
- GH-900 exam — GitHub Foundations
