Microsoft GH-500 Practice Exam Questions & Answers

5 Free Questions · Last reviewed: August 31, 2026 · Prepared & Reviewed by the ValidExamDumps Editorial Team

Exam Facts

Microsoft GH-500 Exam Details

Key details for this exam, checked against the published exam outline

75 Practice Questions (Our Bank)
100 minutes Exam Duration
USD 165 Exam Fee
Exam Code
GH-500
Full Name
GitHub Advanced Security Exam
Issuing Body
Microsoft
Question Format (Our Bank)
Multiple Choice
Delivery
Online proctored or at a Pearson VUE test centre
Practice Questions

Free GH-500 Practice Questions

Each question shows the correct answer and an explanation of why it is right

VA
ValidExamDumps Editorial Team Every question and its answer is checked by our GH-500 exam preparation team, who also write the explanation shown with each one. How we research and review these pages
Question 1 Domain 6Configure and use supply chain security

-- [Configure and Use Dependency Management]

In the pull request, how can developers avoid adding new dependencies with known vulnerabilities?

Correct Answer: C
Explanation

To detect and block vulnerable dependencies before merge, developers should use the Dependency Review GitHub Action in their pull request workflows. It scans all proposed dependency changes and flags any packages with known vulnerabilities.

This is a preventative measure during development, unlike Dependabot, which reacts after the fact.

Question 2 Domain 7Configure and use Code Security

-- [Use Code Scanning with CodeQL]

When using the advanced CodeQL code scanning setup, what is the name of the workflow file?

Correct Answer: D
Explanation

Comprehensive and Detailed Explanation:

In the advanced setup for CodeQL code scanning, GitHub generates a workflow file named codeql-analysis.yml. This file is located in the .github/workflows directory of your repository. It defines the configuration for the CodeQL analysis, including the languages to analyze, the events that trigger the analysis, and the steps to perform during the workflow.

Question 3 Domain 5Configure and use Secret Protection

-- [Configure and Use Secret Scanning]

How many alerts are created when two instances of the same secret value are in the same repository?

Correct Answer: A
Explanation

When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.

This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.

Question 4 Domain 5Configure and use Secret Protection

-- [Configure and Use Secret Scanning]

What is a prerequisite to define a custom pattern for a repository?

Correct Answer: D
Explanation

You must enable secret scanning before defining custom patterns. Secret scanning provides the foundational capability for detecting exposed credentials, and custom patterns build upon that by allowing organizations to specify their own regex-based patterns for secrets unique to their environment.

Without enabling secret scanning, GitHub will not process or apply custom patterns.

Question 5 Domain 7Configure and use Code Security

-- [Use Code Scanning with CodeQL]

The autobuild step in the CodeQL workflow has failed. What should you do?

Correct Answer: C
Explanation

If autobuild fails (which attempts to automatically detect how to build your project), you should disable it in your workflow and replace it with explicit build commands, using steps like run: make or run: ./gradlew build.

This ensures CodeQL can still extract and analyze the code correctly.

Get Full Access

75 questions covering all exam domains, starting from $20

Study Guide

What the Microsoft GH-500 Exam Covers

Exam domains verified against: Official Microsoft GH-500 exam guide, last checked August 2026.

Domain 1: Describe GitHub Security suites, features, and ecosystem 15% - 20%

Understand GitHub Security suites and architecture, including how Code Security, Secret Protection, and Supply Chain Security fit together. Learn to navigate the Security Overview and recognize how feature availability differs between public and enterprise repositories.

Domain 2: Apply secure SDLC and security strategies 15% - 20%

Explain the differences between prevention-first and gate-based security approaches using GitHub's tools. Design end-to-end secure workflows and use security campaigns to reduce organizational risk.

Domain 3: Detect, manage, and respond to security alerts 15% - 20%

Identify how vulnerabilities and secrets are detected across the platform. Manage alerts through policies and workflows, and understand the implications of dismissing alerts versus remediating them.

Domain 4: Manage access, governance, and supply chain security 15% - 20%

Control who can access and act on alerts using role-based permissions and delegated bypass. Understand supply chain security concepts and track alerts across the full software development lifecycle.

Domain 5: Configure and use Secret Protection 15% - 20%

Enable Secret Protection at repository and organization levels and configure its behavior for different repository types. Use Push Protection to prevent secrets at source and manage the alert lifecycle from detection to remediation.

Sample questions from this domain above: Q3Q4

Domain 6: Configure and use supply chain security 15% - 20%

Use dependency and vulnerability management tools to understand supply chain risk. Generate dependency graphs and SBOMs, then detect and prioritize alerts using EPSS scoring and security campaigns.

Sample question from this domain above: Q1

Domain 7: Configure and use Code Security 10% - 15%

Choose between CodeQL and third-party analysis tools for code scanning. Configure workflows using GitHub Actions, manage scan results and dataflow analysis, and handle SARIF file ingestion.

Sample questions from this domain above: Q2Q5

Domain 8: Security operations: best practices, prioritization, and remediation 15% - 20%

Prioritize and manage security work at scale using severity rulesets and campaign-based remediation. Apply CVE and CWE knowledge to guide remediation and collaborate across teams with appropriate role assignments.

Domain 9: GitHub Security suites administration 10% - 15%

Enable and configure security features at enterprise, organization, and repository levels. Define policies, roles, and enforcement boundaries, and use APIs for large-scale governance and automation.

FAQ

GH-500 Exam FAQ

Common questions about the exam itself

How hard is the GH-500 exam and what experience level should I have before taking it?
GH-500 is designed for experienced professionals with intermediate to advanced GitHub expertise and hands-on experience securing software development workflows. You need practical knowledge of Code Security, Secret Protection, and supply chain security tools, plus experience with GitHub Enterprise administration.
What is the main difference between GH-500 and the other GitHub exams like GH-900 and GH-100?
GH-900 covers GitHub Foundations for all users, GH-100 focuses on GitHub Administration, and GH-500 is specifically for advanced security configuration and operations. GH-500 goes deep into CodeQL, secret scanning, Dependabot, and large-scale policy enforcement.
How long should I spend preparing for the GH-500 exam?
Most candidates need three to six months of study and hands-on practice, especially if learning GitHub Advanced Security features for the first time. Realistic preparation includes the official training course, hands-on labs in actual GitHub Enterprise environments, and multiple practice exams.
Which exam objectives do candidates find most challenging?
Code Security with CodeQL and supply chain security with Dependabot configuration typically challenge candidates most because they require both conceptual knowledge and practical configuration skills. Spending extra time on CodeQL query customization and SBOM workflows helps significantly.
What does the GH-500 exam day involve?
The exam is delivered online proctored or at a Pearson VUE test centre and lasts 100 minutes. You answer a mix of multiple-choice and scenario-based questions that test both security concepts and real-world decision making in GitHub environments.
Can I retake the GH-500 exam and what is the rescheduling policy?
Microsoft allows up to three exam attempts within a 12-month rolling period. After three failures, you must wait 14 days before scheduling another attempt. Each retake costs the full exam fee of USD 165.
How long does the GH-500 certification stay valid once I pass?
Microsoft GitHub certifications do not have a published expiration date. however, Microsoft periodically retires or updates exams. You should stay current with GitHub Advanced Security releases to maintain practical relevance.
What job role does GH-500 certification prepare me for?
GH-500 prepares you for roles including Security Engineer, DevSecOps Engineer, GitHub Enterprise Security Administrator, and Security Architect. It validates your ability to design and operate secure development workflows at enterprise scale.
What is the passing score for the GH-500 exam?
Microsoft does not publish the exact passing score for GH-500. the score is determined using a scaled scoring method based on exam difficulty. Most candidates should aim for strong performance across all objective areas to pass.
What languages is the GH-500 exam available in?
The GH-500 study guide is available in English on Microsoft Learn. Some exams are localized into other languages and are updated approximately eight weeks after English release, but the complete language list for this exam is not yet published.