GH-500 doesn’t test whether you recognize feature names — it tests judgment under scenarios that mix Secret Protection, Supply Chain Security, Code Security, and organization-level governance. The questions below are sorted by what actually makes a GH-500 question hard: simple feature recall (Easy), configuration reasoning against a stated requirement (Medium), or a cross-suite governance tradeoff with no single obviously-right feature name (Hard).
Click any question to reveal the answer, the full reasoning, and why each wrong option is wrong — not just which letter is correct.
Want the domain-by-domain breakdown first? See the GH-500 study guide, or jump straight to the GH-500 cheat sheet for exact settings paths.
Scenarios below are built around the domains in Microsoft's official GH-500 study guide (skills measured as of July 2026) and GitHub's security documentation, fetched 2026-09-07.
What Separates Easy, Medium, and Hard Here
This isn’t an official GitHub classification — it’s how MSCertQuiz tiers GH-500 practice content based on what candidates report struggling with.
| Tier | What it tests | Example skill |
|---|---|---|
| Easy | Feature recognition | Match a described capability to the correct GHAS feature name |
| Medium | Configuration reasoning | Choose the correct setting or workflow to satisfy a stated requirement |
| Hard | Cross-suite governance | Weigh a tradeoff spanning multiple suites, roles, or org-wide policy — no single obviously-right feature name |
Easy — Feature Recognition
Questions 1–4 · matching a described capability to the correct GHAS suite
1Secret Protection basicsA developer accidentally commits a database password to a private repository owned by an organization with a GHAS license.Which GitHub Advanced Security capability is designed to detect this after the commit lands?Tap to see the four answer choices and the correct answer →
Secret Protection (the current name for secret scanning) automatically scans repository content, including commit history, for known credential patterns. On a private repository this requires a GHAS license, which the scenario states the org has.
B: Dependency Review checks third-party package risk before merge — it has nothing to do with credentials in source code.
C: Code Security analyzes source code logic for vulnerabilities via CodeQL — it does not pattern-match for leaked secrets.
D: Branch protection rules control merge requirements — they don’t scan committed content for secrets.
Key concept: Secret scanning detects a secret already in history. Push protection (a related but distinct capability) blocks it before it’s ever committed.
2Feature availabilityA maintainer of a public open-source repository wants Dependabot alerts enabled. The organization does not have a GitHub Advanced Security license.Can Dependabot alerts be enabled on this repository?Tap to see the four answer choices and the correct answer →
Basic Dependabot alerts and secret scanning are free features on public repositories. A GHAS license is only required to run equivalent protection (Secret Protection, Code Security) on private or internal repositories.
A: This reverses the actual rule — GHAS licensing gates private/internal repos, not public ones.
C: Code Security and Dependabot alerts are independent features; enabling one has no bearing on the other’s availability.
D: Contributor count has no effect on feature licensing.
Key concept: Public repo = basic scanning and Dependabot alerts free. Private/internal repo = GHAS license required for Secret Protection and Code Security.
3Suite identificationA security team wants a single feature that analyzes application source code for vulnerabilities such as SQL injection using static analysis.Which GHAS suite provides this capability?Tap to see the four answer choices and the correct answer →
Code Security (formerly Code Scanning with CodeQL) performs static analysis of source code to find vulnerabilities like SQL injection, cross-site scripting, and other coding-logic flaws.
A: Secret Protection detects leaked credentials, not code logic vulnerabilities.
B: Supply Chain Security addresses third-party dependency risk, not first-party source code.
D: GitHub Actions is a CI/CD automation platform; it can run a code scanning workflow but is not itself the analysis engine.
Key concept: Three suites, three different targets: Secret Protection = leaked credentials. Supply Chain Security = third-party dependency risk. Code Security = your own source code.
4SBOM basicsA compliance team asks engineering for a complete inventory of every third-party package used in an application, in a standard exportable format.What should engineering generate?Tap to see the four answer choices and the correct answer →
An SBOM, exportable from a repository’s dependency graph, is the standard artifact for documenting every dependency in a project for compliance and supply-chain reporting.
A: CODEOWNERS assigns review ownership by file path — unrelated to dependency inventories.
C: A CodeQL report covers static-analysis findings in first-party code, not third-party package inventory.
D: Branch protection logs relate to merge policy enforcement, not dependency inventories.
Key concept: Dependency graph → SBOM export. This is the Supply Chain Security domain’s most compliance-facing feature.
Medium — Configuration Reasoning
Questions 5–8 · choosing the right setting, priority call, or workflow for a stated requirement
5PrioritizationA repository has two open Dependabot alerts: one is CVSS-rated Critical but has a low EPSS score (rarely exploited in practice); the other is CVSS-rated Medium but has a high EPSS score (frequently exploited in the wild).Following GHAS prioritization guidance, which should the team address first?Tap to see the four answer choices and the correct answer →
EPSS (Exploit Prediction Scoring System) estimates the real-world probability of exploitation. GHAS guidance uses EPSS alongside severity to prioritize — a lower-severity vulnerability that is actively and easily exploited can represent a higher practical risk than a severe one that’s rarely targeted.
A: Treating CVSS severity as the sole priority signal ignores exploitability data the exam explicitly tests EPSS for.
C: Campaigns are a remediation-scaling tool, not a substitute for prioritizing which alert to fix first.
D: Ticket order ignores risk entirely and is not a GHAS-recommended prioritization method.
Key concept: CVSS = how bad it could be. EPSS = how likely it is to actually be exploited. Prioritize using both, not CVSS alone.
6Push protection scopeAn organization has enabled push protection for Secret Protection at the organization level. A developer’s commit contains what looks like an API key but is actually a documented example key from a README template.What is the most likely outcome?Tap to see the four answer choices and the correct answer →
Push protection intercepts a push containing a detected secret pattern and requires the developer to either remove it or explicitly acknowledge/bypass the block (subject to org policy) before the push completes — it doesn’t silently allow or silently reject.
A: Push protection is specifically designed to interrupt the push, not let it through silently.
C: Push protection has no effect on repository visibility settings.
D: Bypass availability is a configurable, delegated policy — not something restricted solely to organization owners in every case.
Key concept: Push protection = interactive block at commit time, with a defined (and configurable) bypass path — not a silent allow or an unconditional hard stop.
7Code Security setupA team wants CodeQL scanning to run automatically whenever a pull request targets main, using a scan configuration they can edit directly rather than one GitHub auto-generates.Which setup option should they choose?Tap to see the four answer choices and the correct answer →
Advanced setup for Code Security generates an editable CodeQL workflow YAML file that the team can customize — trigger conditions, query suite, matrix builds. Default setup auto-configures scanning without exposing an editable workflow.
A: Default setup intentionally hides the workflow file for simplicity — it doesn’t give the direct-edit control the scenario asks for.
C: Dependency Review is a Supply Chain Security feature, unrelated to CodeQL configuration.
D: Secret Protection is a different suite entirely and has no CodeQL workflow to edit.
Key concept: Default setup = fast, opinionated, hidden workflow. Advanced setup = editable YAML, full control over triggers, queries, and matrix builds.
8Alert dismissalA developer dismisses a Code Security alert flagging a potential SQL injection, selecting "used in tests" as the reason, even though the flagged code runs in production.What is the primary risk this creates?Tap to see the four answer choices and the correct answer →
Dismissal reasons feed into audit trails and compliance reporting. Selecting an inaccurate reason like "used in tests" for a production vulnerability creates a false record that the risk was properly evaluated and is safe — while the actual vulnerability remains unaddressed.
A: Dismissing an alert changes its status, not the underlying code — the vulnerability itself is untouched.
C: GitHub does not automatically flag repos as non-compliant based on a single dismissal reason.
D: Dismissing one alert does not disable future CodeQL scans on the repository.
Key concept: A dismissal reason is a compliance record, not just a UI action — the operations domain tests judgment about accurate reasons, not just the mechanics of dismissing.
Hard — Cross-Suite Governance
Questions 9–12 · tradeoffs spanning multiple suites, roles, or organization-wide policy
9Cross-suite interplayAn enterprise wants every new repository across dozens of organizations to inherit the same Secret Protection, Code Security, and Supply Chain Security configuration automatically, without each organization admin configuring it manually.Which GH-500 administration concept addresses this requirement?Tap to see the four answer choices and the correct answer →
GH-500’s administration domain covers default configuration inheritance: security settings defined at the enterprise level cascade down to organizations and then to newly created repositories, avoiding manual per-repo or per-org configuration.
A: CODEOWNERS controls code review assignment, not security-suite configuration inheritance.
C: Manual replication is exactly what inheritance is designed to eliminate — it does not scale across dozens of orgs.
D: A single custom secret pattern is a narrow Secret Protection feature, not an enterprise-wide configuration mechanism.
Key concept: Inheritance flows one direction: enterprise defaults → organization defaults → new repository defaults. Existing repos need explicit rollout, not automatic retroactive inheritance.
10Delegated bypass governanceA security team enforces a ruleset requiring all secret-scanning alerts to be resolved before merge, but an automated deployment bot legitimately needs to bypass this check for a specific, narrow release pipeline without weakening the rule for human contributors.What is the correct governance approach?Tap to see the four answer choices and the correct answer →
Delegated bypass policies let specific identities (including automation/bot accounts) or apps bypass a rule in narrowly scoped circumstances, while the ruleset remains enforced for everyone else. This is the governance pattern GH-500’s administration domain tests for balancing automation needs against security enforcement.
A: Disabling org-wide defeats the purpose of the rule for every human contributor, not just the bot.
C: Granting broad ownership to bypass one rule is a massive over-grant of privilege for a narrow operational need.
D: Removing the feature eliminates the protection entirely instead of scoping an exception.
Key concept: Bypass should always be scoped to the smallest identity and rule combination that solves the actual need — broad bypass grants are the wrong answer whenever a scenario describes "one legitimate exception."
11Remediation at scaleA newly disclosed CVE affects a dependency used across 200 repositories in an organization. Fixing it repository-by-repository via individual Dependabot PRs would take weeks of manual triage.What GHAS capability is designed specifically for this situation?Tap to see the four answer choices and the correct answer →
Security campaigns exist precisely for this scenario: bundling alerts tied to the same root cause (like one CVE across many repos) into a single coordinated remediation effort, rather than triaging each PR individually.
A: This is the slow, unscaled approach the scenario explicitly says is impractical.
C: Disabling alerts hides the risk rather than remediating it — the opposite of the intended response.
D: Raising the threshold suppresses visibility into real risk rather than addressing it.
Key concept: Whenever a scenario says "the same issue across many repos" or "too many alerts to fix one at a time," the answer is a security campaign, not individual PR triage.
12Role-based accessAn organization wants a person to be able to view and manage security alerts across every repository in the organization, but without giving them the ability to change repository settings, delete repositories, or manage billing.Which role should be assigned?Tap to see the four answer choices and the correct answer →
The security manager role is designed exactly for this: it grants alert-management permissions across repositories in an organization without granting full administrative control over settings, deletion, or billing.
A: Organization owner grants full control, including billing and repository deletion — far broader than what’s needed.
B: Assigning repo admin individually on every repository is both excessive (grants settings control) and doesn’t scale as new repos are created.
D: A base member has no elevated alert-management access at all.
Key concept: Security manager = alert visibility and management, org-wide, without full admin rights. This is the answer whenever a scenario says "manage alerts but nothing else."
How to use this: if you missed more than 1 of the 4 Easy questions, revisit the suite-boundary section of the study guide before touching Medium or Hard. Missing 2+ of the Hard questions is normal on a first pass — that tier is deliberately calibrated to where GH-500 candidates report the most surprise on exam day.
Go Beyond 12 Questions
MSCertQuiz has 500 GH-500 questions weighted to match the real exam’s six domains, with the same reveal-as-you-go format and full rationale for every wrong answer.