This course contains the use of artificial intelligence.

These practice exams are unofficial and independently written. They are not affiliated with, endorsed or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub, GitHub Advanced Security, GitHub Secret Protection, GitHub Code Security, CodeQL, Dependabot and the GitHub Certified: Advanced Security credential are trademarks of GitHub, Inc.; Microsoft and Microsoft Learn are trademarks of Microsoft Corporation. The names are used only to say which exam these tests help you prepare for. No question comes from a GH-500 exam.

Exam GH-500 (GitHub Advanced Security) checks whether you can secure code, secrets and dependencies across the development lifecycle with GitHub's security products. The questions are about decisions: which product a feature needs, how push protection and delegated bypass behave, how to triage and dismiss alerts responsibly, how Dependabot, dependency review and SBOMs fit together, how to set up and tune CodeQL, how to run security campaigns, and how to roll features out across an organization or enterprise. These two practice exams train exactly those decisions.

What you get

• Two full practice exams of 60 questions each (120 in total), 100 minutes each, the time Microsoft lists for GH-500
• Questions weighted to Microsoft's published GH-500 skills outline ("skills measured as of July 2026") across all six domains
• About 80% single-answer questions and 20% "choose two" or "choose three" questions
• An explanation for every answer option, plus an overall explanation that names the skill being tested, says which product the feature needs (Secret Protection, Code Security, or free), and links the GitHub Docs page it is based on
• Scenario questions where the right answer depends on knowing how GitHub's security features actually behave, not on spotting the longest option
• An audited bank: balanced answer keys, length checks, duplicate checks, blind test readers and a claim-by-claim check against GitHub Docs

Topics you will practice

• Secret Protection: secret scanning, push protection, validity checks, custom patterns, exclusions, delegated bypass and alert remediation
• Supply chain security: dependency graph, SBOM export, Dependabot alerts and security updates, EPSS, auto-triage presets, dependabot.yml and dependency review
• Code Security: CodeQL default and advanced setup, SARIF uploads, query suites, Copilot Autofix, alert triage and troubleshooting
• Security operations: CVE, CWE and GHSA, merge protection rulesets, security campaigns, delegated alert dismissal and audit evidence
• Administration: security configurations, global settings, roles, enforcement, the REST API, and GitHub Enterprise Cloud versus GitHub Enterprise Server

How to use these tests

Take one exam under timed conditions, then read the explanation for every question, including the ones you got right. The pass mark in this course is 70%, set as a study target. Microsoft reports GH-500 results on a scaled score where 700 is a pass, which is not a percentage, so a practice score is a study signal and does not predict your exam result. The exam may also contain interactive item types such as drag-and-drop or ordering, which a multiple-choice practice test does not reproduce.

This is not a lab. The course contains practice questions only, with no hands-on environment. Practise the settings yourself in a trial or test organization as well.

Features in public preview (for example AI Scan, agentic autofix and campaigns for secret scanning alerts) are never the answer a question depends on. GitHub features change often: the questions were checked against GitHub Docs on 14 November 2026, so please check Microsoft Learn and GitHub Docs for the current exam details and feature names before you sit the exam.