GH-500 practice test
Microsoft GitHub Advanced Security
100 practice questions, spread across the exam's topics the same way Microsoft weights them, each with a full explanation and a link to the official documentation that proves the answer. Written by a Microsoft Certified Trainer who does this work for a living.
No card needed to start, and none to keep going: buying is not open yet.
What is inside
Every area the exam tests
Our questions are spread the same way Microsoft weights the exam, so your practice matches the real thing.
The security suites and ecosystem
15 to 20%How Code Security, Secret Protection and Supply Chain Security divide the problem, what differs between public repositories and enterprise environments, the security overview, prevention-first against gate-based strategies, security campaigns, and who is responsible for an alert.
18 questionsSecret Protection
15 to 20%Enabling it at repository and organisation level, push protection stopping a secret at the source, validity checks and prioritised alerting, the alert lifecycle and what remediation actually means for a leaked credential, delegated bypass, alert recipients and custom patterns.
18 questionsSupply chain security
15 to 20%The dependency graph and where its data comes from, SBOM export and formats, alerts and security updates, EPSS scoring and prioritisation, dependency review before merge, licence checks, grouped and auto-dismissed updates, and the permissions and webhooks around them.
18 questionsCode Security
10 to 15%Default and advanced setup, CodeQL against third-party analysis, SARIF ingestion, workflow templates, matrix builds and scan frequency, reading dataflow results, autofix, alert lifecycle and severity, and troubleshooting scans that fail or take too long.
14 questionsSecurity operations
15 to 20%CVE, CWE and security advisories, remediation workflows end to end, severity rulesets and enforcement, campaign-based and bulk remediation, automated dismissal and documenting it, customising CodeQL query suites to an organisation's risk, alert ownership across roles, and shifting prevention earlier.
18 questionsAdministration
10 to 15%Enabling the suites at enterprise, organisation and repository level, what differs between Enterprise Cloud and Enterprise Server, default configurations and how they are inherited, policies and rulesets, bypass permissions and exceptions, the security manager role, and the APIs for configuring all of it at scale.
14 questionsMicrosoft last updated this exam on July 2026. Our questions match that version.
How you will use it
Practise the way that suits you
- Learn as you go. Answer, read why straight away, then move on. No clock, no pressure.
- Or sit it timed. A clock, no answers until the end, and two minutes a question, so you learn to pace yourself.
- Score by topic. See which area let you down instead of one number out of a hundred.
- Go back over it. Read every question again afterwards, right and wrong, with the full explanation.
Is it for you
Who takes GH-500
Security engineers responsible for a GitHub estate
It is the certification for the tooling that sits directly on the code, rather than around it.
Platform and DevOps engineers who own the pipelines
Scanning, push protection and dependency review are pipeline decisions before they are security ones.
Anybody triaging alerts they did not configure
A third of the exam is prioritisation, dismissal and remediation rather than setup.
Also worth doing
Other exams in the same area
See the questions before you pay
10 GH-500 questions with full explanations, so you can judge the quality yourself.
Start 10 free questions