Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
-- [Configure and Use Secret Scanning]
What is a prerequisite to define a custom pattern for a repository?
You must enable secret scanning before defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.
Without enabling secret scanning, GitHub will not process or apply custom patterns.
-- [Configure and Use Secret Scanning]
What do you need to do before you can define a custom pattern for a repository?
Comprehensive and Detailed Explanation:
Before defining a custom pattern for secret scanning in a repository, you must enable secret scanning for that repository. Secret scanning must be active to utilize custom patterns, which allow you to define specific formats (using regular expressions) for secrets unique to your organization.
Once secret scanning is enabled, you can add custom patterns to detect and prevent the exposure of sensitive information tailored to your needs.
-- [Configure and Use Dependency Management]
In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?
To detect and block vulnerable dependencies before merge, developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.
This is a preventative measure during development, unlike Dependabot, which reacts after the fact.
-- [Configure and Use Dependency Management]
What are Dependabot security updates?
Dependabot security updates are automated pull requests triggered when GitHub detects a vulnerability in a dependency listed in your manifest or lockfile. These PRs upgrade the dependency to the minimum safe version that fixes the vulnerability.
This is separate from regular updates (which keep versions current even if not vulnerable).
-- [Configure and Use Secret Scanning]
A secret scanning alert should be closed as "used in tests" when a secret is:
If a secret is intentionally used in a test environment and poses no real-world security risk, you may close the alert with the reason 'used in tests'. This helps reduce noise and clarify that the alert was reviewed and accepted as non-critical.
Just being in a test file isn't enough unless its purpose is purely for testing.
-- [Configure and Use Dependency Management]
When does Dependabot alert you of a vulnerability in your software development process?
Dependabot alerts are generated as soon as GitHub detects a known vulnerability in one of your dependencies. GitHub does this by analyzing your repository's dependency graph and matching it against vulnerabilities listed in the GitHub Advisory Database. Once a match is found, the system raises an alert automatically without waiting for a PR or manual action.
This allows organizations to proactively mitigate vulnerabilities as early as possible, based on real-time detection.
-- [Describe GitHub Advanced Security Best Practices]
Which of the following tasks can be performed by a security team as a proactive measure to help address secret scanning alerts? (Each answer presents a complete solution. Choose two.)
To proactively address secret scanning:
Webhooks can be configured to listen for secret scanning events. This allows automation, logging, or alerting in real-time when secrets are detected.
Documenting secure development practices (like using environment variables or secret managers) helps reduce the likelihood of developers committing secrets in the first place.
Dismissal based on age is not a best practice without triage. SCIM deals with user provisioning, not scanning alerts.
Exam domains verified against: Official Microsoft GH-500 exam guide, last checked October 2026.
Understand GitHub Security suites and architecture, including how Code Security, Secret Protection, and Supply Chain Security fit together. Learn to navigate the Security Overview and recognize how feature availability differs between public and enterprise repositories.
Enable and configure Secret Protection; Enable GitHub Secret Protection at the repository and organization levels; Configure Secret Protection settings and feature availability; Contrast Secret Protection behavior for public vs. private/enterprise repositories; Prevent secret exposure; Explain Push Protection and how it prevents secrets at the source; Describe validity checks and prioritized alerting for high-confidence secrets; Manage and respond to Secret Protection alerts; Describe the Secret Protection alert lifecycle (creation, status, dismissal); Respond to secret alerts and apply appropriate remediation actions; Explain implications and best practices for dismissing or ignoring alerts; Control access, policies, and customization; Explain role-based and delegated bypass policies in Secret Protection; Configure alert recipients and exclusions; Create and manage custom secret patterns
Understand and manage dependency and supply chain risks; Comprehensive dependency security (tools, vulnerability databases, SBOMs); Generate and interpret the dependency graph; SBOM usage: export options, formats, and supply chain context; Detect, prioritize, and respond to supply chain alerts; Supply chain alerts and security updates (prioritization, EPSS scoring); Remediating supply chain alerts through campaigns and pull requests; Auto-dismiss behavior and security campaign configuration; Secure dependencies during development; Dependency Review (pre-merge checks, license and compliance validation, configuration); Advanced dependency update rules (grouping, auto-dismiss, update strategies); Configure policies, permissions, and integrations; Permissions and role-based alert assignment; Workflow management for dependency and supply chain security; External notifications, webhooks, and security integrations
Understand code scanning approaches and tooling; Native and third-party code scanning options; Choosing between CodeQL and third-party analysis tools; SARIF file ingestion, management, and interoperability; Set up and configure Code Security; Enable code security using GitHub Actions or external CI systems; Configure code scanning workflows and workflow templates; Use matrix builds and define appropriate scan frequency; Analyze, triage, and remediate code scanning results; Review scan results, including dataflow analysis insights; Alert lifecycles, autofix capabilities, and remediation workflows; Dismissing alerts and managing severity and category classifications; Optimize and automate Code Security operations; Advanced configuration and customization; Troubleshooting scan failures and performance issues
Prioritize and manage security work at scale using severity rulesets and campaign-based remediation. Apply CVE and CWE knowledge to guide remediation and collaborate across teams with appropriate role assignments.
Enable and configure security features at enterprise, organization, and repository levels. Define policies, roles, and enforcement boundaries, and use APIs for large-scale governance and automation.
Common questions about the exam itself
