Microsoft GH-500 Practice Exam Questions & Answers
Microsoft GH-500 Exam Details
Key details for this exam, checked against the published exam outline
- Exam Code
- GH-500
- Full Name
- GitHub Advanced Security Exam
- Issuing Body
- Microsoft
- Question Format (Our Bank)
- Multiple Choice
- Delivery
- Online proctored or at a Pearson VUE test centre
- Full Question Set
- 76 questions Get All Questions
Free GH-500 Practice Questions
Each question shows the correct answer and an explanation of why it is right
Question 1 Domain 2 Configure and use Secret Protection (formerly secret scanning)
-- [Configure and Use Secret Scanning]
Where can you find a deleted line of code that contained a secret value?
Secrets committed and then deleted are still accessible in the repository's Git history. To locate them, navigate to the Commits tab. GitHub's secret scanning can detect secrets in both current and historical commits, which is why remediation should also include revoking the secret, not just removing it from the latest code.
Question 2 Domain 2 Configure and use Secret Protection (formerly secret scanning)
-- [Configure and Use Secret Scanning]
Which patterns are secret scanning validity checks available to?
Validity checks --- where GitHub verifies if a secret is still active --- are available for partner patterns only. These are secrets issued by GitHub's trusted partners (like AWS, Slack, etc.) and have APIs for GitHub to validate token activity status.
Custom patterns and high entropy patterns do not support automated validity checks.
Question 3 Domain 4 Configure and use Code Security (formerly Code Scanning with CodeQL)
-- [Configure GitHub Advanced Security Tools in GitHub Enterprise]
What step is required to run a SARIF-compatible (Static Analysis Results Interchange Format) tool on GitHub Actions?
When using a SARIF-compatible tool within GitHub Actions, it's necessary to explicitly add a step in your workflow to upload the analysis results. This is typically done using the upload-sarif action, which takes the SARIF file generated by your tool and uploads it to GitHub for processing and display in the Security tab. Without this step, the results won't be available in GitHub's code scanning interface.
Get the complete GH-500 question set
$20$40
Question 4 Domain 2 Configure and use Secret Protection (formerly secret scanning)
-- [Configure and Use Secret Scanning]
Which details do you have to provide to create a custom pattern for secret scanning? (Each answer presents part of the solution. Choose two.)
When defining a custom pattern for secret scanning, two key fields are required:
Name of the pattern: A unique label to identify the pattern
Secret format: A regular expression that defines what the secret looks like (e.g., token format)
You can optionally specify additional match requirements (like required context keywords), but they're not mandatory. Listing repositories is also not part of the required fields during pattern creation.
Question 5 Domain 2 Configure and use Secret Protection (formerly secret scanning)
-- [Configure and Use Secret Scanning]
What is the first step you should take to fix an alert in secret scanning?
The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.
Simply deleting the secret from the code does not remove the risk if it hasn't been revoked --- especially since it may already be exposed in commit history.
Question 6 Domain 4 Configure and use Code Security (formerly Code Scanning with CodeQL)
-- [Use Code Scanning with CodeQL]
When using CodeQL, how does extraction for compiled languages work?
For compiled languages, CodeQL performs extraction by monitoring the normal build process. This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.
This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.
Question 7 Domain 2 Configure and use Secret Protection (formerly secret scanning)
-- [Configure and Use Dependency Management]
Which key is required in the update settings of the Dependabot configuration file?
In a dependabot.yml configuration file, package-ecosystem is a required key. It defines the package manager being used in that update configuration (e.g., npm, pip, maven, etc.).
Without this key, Dependabot cannot determine how to analyze or update dependencies. Other keys like rebase-strategy or commit-message are optional and used for customizing behavior.
What the Microsoft GH-500 Exam Covers
Exam domains verified against the Official Microsoft GH-500 exam guide, last checked October 2026.
Domain 1 Describe GitHub Security suites, features, and ecosystem
15% - 20%Understand GitHub Security suites and architecture, including how Code Security, Secret Protection, and Supply Chain Security fit together. Learn to navigate the Security Overview and recognize how feature availability differs between public and enterprise repositories.
Domain 2 Configure and use Secret Protection (formerly secret scanning)
15% - 20%Enable and configure Secret Protection; Enable GitHub Secret Protection at the repository and organization levels; Configure Secret Protection settings and feature availability; Contrast Secret Protection behavior for public vs. private/enterprise repositories; Prevent secret exposure; Explain Push Protection and how it prevents secrets at the source; Describe validity checks and prioritized alerting for high-confidence secrets; Manage and respond to Secret Protection alerts; Describe the Secret Protection alert lifecycle (creation, status, dismissal); Respond to secret alerts and apply appropriate remediation actions; Explain implications and best practices for dismissing or ignoring alerts; Control access, policies, and customization; Explain role-based and delegated bypass policies in Secret Protection; Configure alert recipients and exclusions; Create and manage custom secret patterns
Domain 3 Configure and use supply chain security (formerly Dependabot/Dependency Review)
15% - 20%Understand and manage dependency and supply chain risks; Comprehensive dependency security (tools, vulnerability databases, SBOMs); Generate and interpret the dependency graph; SBOM usage: export options, formats, and supply chain context; Detect, prioritize, and respond to supply chain alerts; Supply chain alerts and security updates (prioritization, EPSS scoring); Remediating supply chain alerts through campaigns and pull requests; Auto-dismiss behavior and security campaign configuration; Secure dependencies during development; Dependency Review (pre-merge checks, license and compliance validation, configuration); Advanced dependency update rules (grouping, auto-dismiss, update strategies); Configure policies, permissions, and integrations; Permissions and role-based alert assignment; Workflow management for dependency and supply chain security; External notifications, webhooks, and security integrations
Domain 4 Configure and use Code Security (formerly Code Scanning with CodeQL)
10% - 15%Understand code scanning approaches and tooling; Native and third-party code scanning options; Choosing between CodeQL and third-party analysis tools; SARIF file ingestion, management, and interoperability; Set up and configure Code Security; Enable code security using GitHub Actions or external CI systems; Configure code scanning workflows and workflow templates; Use matrix builds and define appropriate scan frequency; Analyze, triage, and remediate code scanning results; Review scan results, including dataflow analysis insights; Alert lifecycles, autofix capabilities, and remediation workflows; Dismissing alerts and managing severity and category classifications; Optimize and automate Code Security operations; Advanced configuration and customization; Troubleshooting scan failures and performance issues
Domain 5 Security operations: best practices, prioritization, and remediation
15% - 20%Prioritize and manage security work at scale using severity rulesets and campaign-based remediation. Apply CVE and CWE knowledge to guide remediation and collaborate across teams with appropriate role assignments.
Domain 6 GitHub Security suites administration
10% - 15%Enable and configure security features at enterprise, organization, and repository levels. Define policies, roles, and enforcement boundaries, and use APIs for large-scale governance and automation.
GH-500 Exam FAQ
Common questions about the exam itself
How hard is the GH-500 exam and what experience level should I have before taking it?
What is the main difference between GH-500 and the other GitHub exams like GH-900 and GH-100?
How long should I spend preparing for the GH-500 exam?
Which exam objectives do candidates find most challenging?
What does the GH-500 exam day involve?
Can I retake the GH-500 exam and what is the rescheduling policy?
How long does the GH-500 certification stay valid once I pass?
What job role does GH-500 certification prepare me for?
What is the passing score for the GH-500 exam?
What languages is the GH-500 exam available in?
Other Microsoft Exams
Free practice questions for more Microsoft certification exams