GH-500 exam domains
The GH-500 exam is weighted across 6 domains. Pick any domain below to drill it — or read the full breakdown in the FAQ.
| Exam domain | Exam weight | Practice |
|---|---|---|
| Describe GitHub Security suites, features, and ecosystem | 18% | Practice this topic |
| Configure and use Secret Protection | 18% | Practice this topic |
| Configure and use supply chain security | 18% | Practice this topic |
| Configure and use Code Security | 14% | Practice this topic |
| Security operations: best practices, prioritization, and remediation | 18% | Practice this topic |
| GitHub Security suites administration | 14% | Practice this topic |
Sample GH-500 questions
A sample of the GH-500 questions on this hub. Each links through to the full question, the correct answer, and an explanation of why every other option is wrong.
- Your security team wants to automatically dismiss Dependabot alerts for a category of vulnerabilities that leadership has formally accepted as low-ris…View question
- A security manager at a fintech company is closing out a large backlog of Code Scanning alerts across 40 repositories. Several hundred alerts share th…View question
- A security lead at a large organization wants to launch a security campaign to drive down the most impactful code scanning alerts across dozens of rep…View question
- A security manager at a large organization launches a security campaign targeting 340 high-severity SQL injection alerts spread across 60 repositories…View question
- A security engineer maintains a repository where two separate CodeQL analysis workflows run against the same branch: one performs a fast, targeted sca…View question
- A security lead at a fintech company wants CodeQL code scanning to block pull requests only when a newly introduced alert has a 'critical' or 'high' s…View question
- You are configuring the default CodeQL workflow for a repository that receives frequent pull requests to the `main` branch. The security team wants al…View question
- A developer at Contoso commits a Python file that both (1) contains an active AWS access key hardcoded in a variable and (2) constructs a SQL query by…View question
- A security engineer is triaging CodeQL code scanning alerts in a repository. One alert flags a SQL injection risk, but after review the engineer confi…View question
- A security engineer fixed a CodeQL SQL-injection alert three months ago; the alert moved to 'Fixed' after the default branch was rescanned. This week…View question
Key GH-500 terms
Start with these terms, then explore the full glossary. Each links to a plain-English definition written for the GH-500 exam.
GH-500 frequently asked questions
What is the GH-500 certification?+
GH-500 is the GitHub Advanced Security certification in GitHub’s program, distinct from GitHub Foundations (fundamentals), GH-100 (Enterprise Administrator), GH-200 (GitHub Actions), and the GitHub Copilot certification.
It targets security-minded engineers and administrators who protect the software supply chain, so success rewards practical knowledge of Push Protection, custom secret patterns, dependency graphs and SBOMs, CodeQL, and security campaigns.
What topics are on the GH-500 exam?+
The GH-500 exam is organised into six weighted domains. GitHub publishes each as a range (15–20%, 15–20%, 15–20%, 10–15%, 15–20%, 10–15%); the single percentages below are our editorial study weights within those ranges. Note the July 2026 rename: secret scanning is now Secret Protection, Dependabot/Dependency Review roll up under supply chain security, and code scanning with CodeQL is now Code Security.
Describe GitHub Security suites, features, and ecosystem (18%)
Covers the structure and navigation of the GitHub Security suites, contrasting Code Security, Secret Protection, and Supply Chain Security, feature availability for public vs. enterprise repositories, the Security Overview, secure-SDLC and prevention-first vs. gate-based strategies, security campaigns, and access, governance, and delegated bypass.
Configure and use Secret Protection (18%)
Formerly secret scanning. Covers enabling Secret Protection at repository and organization levels, Push Protection to prevent secrets at the source, validity checks and prioritized alerting, the alert lifecycle and remediation, and controlling access with role-based and delegated bypass policies plus custom secret patterns.
Configure and use supply chain security (18%)
Formerly Dependabot and Dependency Review. Covers the dependency graph and SBOM export, prioritizing and remediating supply-chain alerts (EPSS scoring, campaigns, pull requests, auto-dismiss), pre-merge Dependency Review with license/compliance validation, advanced update rules, and policies, permissions, and integrations.
Configure and use Code Security (14%)
Formerly code scanning with CodeQL. Covers native and third-party scanning options, SARIF ingestion, enabling code security via GitHub Actions or external CI, scan workflows and frequency, triaging and remediating results (dataflow insights, autofix, severity/category management), and troubleshooting scan failures.
Security operations: best practices, prioritization, and remediation (18%)
Covers CVE/CWE and GitHub Security Advisory concepts, end-to-end remediation workflows, prioritizing and enforcing severity and remediation rulesets, campaign-based and bulk alert management, customizing CodeQL query suites, cross-role collaboration and governance, and shift-left preventive security.
GitHub Security suites administration (14%)
Covers rolling out security features at enterprise, organization, and repository levels, feature differences across GitHub Enterprise Cloud and Server, default configurations and inheritance, governance and rulesets, enforcement boundaries and bypass permissions, role definitions, and APIs and automation for large-scale configuration.
Is the GH-500 hard?+
GH-500 is challenging because it spans three distinct security products (Secret Protection, supply chain security, Code Security) plus operations and administration, and it uses the current July 2026 feature names and packaging that many older study materials get wrong.
The weighting rewards hands-on experience triaging and remediating real alerts and configuring GHAS at scale. The difficulty is precise, current product knowledge, not obscure trivia.
How many questions are on the GH-500 exam and how long is it?+
GH-500 is a proctored multiple-choice exam of roughly 75 questions in 100 minutes, covering GitHub Advanced Security across the SDLC.
Our full-length practice mock uses a 60-question, 90-minute session so you can rehearse pacing across all six domains before test day.
What score do you need to pass the GH-500?+
GH-500 is scored on a scale of 100 to 1000, and you need 700 to pass. Because it is scaled, questions are not all worth the same and there is no penalty for guessing, so answer everything. Our practice mock uses a 70% threshold as a study checkpoint; aim comfortably beyond it before test day.
How much does the GH-500 exam cost?+
The GH-500 exam fee is set by GitHub and varies by region — check the GitHub certification site for current pricing. Everything on this hub is free.
Who should take the GH-500?+
GH-500 is aimed at engineers and administrators who secure code, secrets, and dependencies with GitHub Advanced Security — application-security engineers, DevSecOps engineers, and security-minded platform teams.
GitHub recommends familiarity with GitHub fundamentals, CI/CD, and secure-development concepts before attempting it.
What jobs and salaries can the GH-500 lead to?+
GH-500 maps to roles such as application-security engineer, DevSecOps engineer, security engineer, and platform engineer.
How much any certification affects pay depends heavily on geography, seniority, and experience, so treat any single salary figure with caution. GH-500 is best viewed as proof that you can operate GitHub Advanced Security to protect the software supply chain.
How long does it take to study for the GH-500?+
Candidates with security or DevSecOps experience often need three to five weeks, spent enabling and triaging Secret Protection, supply chain security, and Code Security in a real GitHub organization.
Review every explanation, including for questions you answered correctly, because GH-500 distractors are built from plausible but incorrect security configurations and from outdated feature names. Use the per-domain results here to find your weakest area, then finish with full-length timed mocks.
How should you prepare for the GH-500?+
Study the six domains above, then drill scenario questions domain by domain while configuring GHAS features in a GitHub organization — Push Protection, Dependency Review, CodeQL, and security campaigns. Every MockAPI question reveals a full explanation and tells you why each wrong answer is wrong.
When you can enable and triage all three security products comfortably, move to full-length timed mocks. Use the glossary to keep current concepts like Secret Protection, Push Protection, EPSS, SBOM, CodeQL, and security campaigns straight, and aim to score consistently above the checkpoint before you book.
Can you take the GH-500 exam online?+
Yes. GitHub certification exams are delivered through Pearson VUE, which offers both an online-proctored option (take it remotely) and in-person test centers. For the online option you need a private, quiet room, a clear workspace, a webcam and microphone, a stable connection, and government-issued photo ID, with a proctor monitoring you and a room scan before you start.
If you do not pass, GitHub lets you retake the exam after a waiting period — check the current policy before rebooking.
What certification should you take after the GH-500?+
After GH-500, related GitHub certifications include GH-100 (Enterprise Administrator), GH-200 (GitHub Actions), and the GitHub Copilot certification, depending on your focus.
For many, the real next step is owning application security for a large organization. Pairing GH-500 with hands-on GHAS operation is what turns the certificate into a career.