GH-500 · GitHub Advanced Security

GH-500 Cheat Sheet 2026: Task-by-Task Reference

Not organized by exam domain — organized by what you're actually trying to do: turn a feature on, investigate an alert, or govern it at scale.

Exam Snapshot

Duration: 100 minutes
Passing score: 700 / 1000
Scheduling: Pearson VUE
Renewal: Annual, free reassessment
Skills measured: As of July 2026
Maintained by: GitHub (delivered via Microsoft Learn)

Built from Microsoft's GH-500 study guide (skills measured as of July 2026, fetched 2026-09-07) and GitHub's own security documentation — not a generic template with a cert code swapped in.

1. Turning Security Features On

TaskSettings pathExam-relevant detail
Enable Secret Protection on a repoRepo Settings → Code security and analysis → Secret ProtectionFree on public repos; requires a GHAS license to run on private/internal repos
Enable push protectionRepo or Org Settings → Code security and analysis → Push protectionBlocks a secret at commit time, before it ever reaches history — different from scanning, which only detects after the fact
Turn on Code Security (CodeQL) scanningRepo Settings → Code security and analysis → Set up Code Security → Default or AdvancedDefault setup auto-generates a workflow; Advanced setup lets you edit the CodeQL workflow YAML directly
Enable Dependabot alerts + security updatesRepo Settings → Code security and analysis → DependabotAlerts notify only; security updates additionally opens a PR to bump the vulnerable dependency
Roll out a security feature org-wideOrg Settings → Code security and analysis → set as default for new repositoriesControls what new repos inherit; existing repos need a bulk enablement or security configuration push

2. Investigating and Triaging an Alert

TaskSettings pathExam-relevant detail
Triage a secret scanning alertRepo → Security tab → Secret scanning alertsValidity checks flag which detected secrets are still active — prioritize those first
Triage a Dependabot / supply chain alertRepo → Security tab → Dependabot alertsEPSS score ranks exploit probability — a high-EPSS, low-severity alert can outrank a low-EPSS critical one for urgency
Triage a code scanning (CodeQL) alertRepo → Security tab → Code scanning alertsIncludes data-flow path info; autofix can suggest a remediation but a human still approves the fix
Dismiss an alert correctlyAlert page → Dismiss dropdown → select a reasonA dismissal without a documented reason weakens audit trail and compliance reporting — the reason itself is testable
View org-wide risk in one placeOrg → Security → OverviewAggregates alert counts and enabled-feature coverage across every repo in the organization

Common Mistake: Dismissing Without a Reason

The triage table above treats dismissal as a single click, but the exam treats it as a governance decision. Every dismissal on a Secret Protection, Code Security, or Dependabot alert asks for a reason — false positive, won't fix, used in tests, and so on. Picking a reason that doesn't match reality (dismissing a real risk as "false positive" to clear a backlog) breaks the audit trail a security team relies on later, and it's exactly the kind of judgment call GH-500's operations domain is built to test — not whether you know the dismiss button exists.

3. Governing Security at Scale

TaskSettings pathExam-relevant detail
Export a software bill of materialsRepo → Insights → Dependency graph → Export SBOMSupports standard SBOM formats for supply-chain compliance reporting
Run pre-merge dependency checksConfigure Dependency Review as a required status checkBlocks a PR that introduces a dependency violating a license or vulnerability policy — before merge, not after
Bulk-remediate related alertsSecurity → Campaigns → create a campaignGroups related alerts (e.g. one CVE across many repos) into one remediation effort instead of fixing PRs one at a time
Delegate who can bypass a security ruleOrg Settings → Rulesets → bypass listBypass should be scoped to specific roles or apps, not left open — a common exam trap
Assign a security manager without granting adminOrg Settings → Security managersGrants alert-management permissions across repos without full administrative access
Set a custom secret patternOrg Settings → Code security and analysis → Custom patternsUse for internal-only token formats that GitHub’s built-in patterns don’t recognize
Approve a default CodeQL configuration for the orgOrg Settings → Code security and analysis → Code Security default setupSets the query suite (e.g. security-extended) new repos inherit automatically

Decoding a Scenario Without a Feature Name in It

GH-500 scenarios rarely name a feature directly — they describe a situation. Match the phrasing pattern to the concept it's testing.

If the scenario says...Think...
"...a token was committed but never reached the remote"Push protection (blocked before push) — not secret scanning (which only catches what already reached history)
"...which dependency should be fixed first"EPSS score / campaign prioritization, not raw CVSS severity alone
"...available for free on a public repo but requires a license elsewhere"Distinguishing basic scanning/Dependabot alerts (free, public) from GHAS-licensed Secret Protection/Code Security (private/internal)
"...a scanner produces results in a standard interoperable format"SARIF — used to ingest third-party code scanning results alongside CodeQL
"...someone needs to override a security rule occasionally"Delegated bypass policy, scoped narrowly — not disabling the rule org-wide
"...new repos should inherit the same security setup automatically"Default configuration inheritance (enterprise → organization → repository)
"...a compliance team needs a full dependency inventory"SBOM export from the dependency graph
"...alert volume is too high to fix one PR at a time"Security campaigns for bulk, cross-repo remediation

Terms You'll See On Screen

The task tables above assume you already know these. If a term looks unfamiliar mid-exam, this is the definition you need, not a feature name.

TermDefinition
SARIFStatic Analysis Results Interchange Format — the standard file format GHAS uses to ingest results from third-party scanners alongside CodeQL
EPSSExploit Prediction Scoring System — a probability score estimating how likely a vulnerability is to be exploited in the wild, used to prioritize supply-chain alerts
CVECommon Vulnerabilities and Exposures — a unique public identifier for a specific known vulnerability
CWECommon Weakness Enumeration — a category of vulnerability type (e.g. SQL injection), broader than a single CVE
SBOMSoftware Bill of Materials — an exportable inventory of every dependency in a project, generated from the dependency graph
Push protectionA Secret Protection capability that blocks a commit containing a detected secret before it ever reaches the remote repository
Security campaignA bulk remediation workflow that groups related alerts (e.g. one CVE across many repositories) instead of fixing them one PR at a time

GH-500 Quick Answers

How is this different from the GH-500 study guide?

The study guide explains the six domains narratively and busts common misconceptions. This page skips explanation and lists tasks directly, with the exact settings path and the one detail the exam usually tests about it.

What's the difference between push protection and secret scanning?

Push protection blocks a secret at commit time, before it reaches the remote. Secret scanning only detects secrets already sitting in repository history.

Can I print this GH-500 cheat sheet?

Yes — every table is plain HTML, so a browser print or "print to PDF" renders cleanly.

MSCertQuiz sells practice-exam access for GH-500 and other Microsoft and GitHub certifications; this cheat sheet is written by the same team that builds those questions.

Where to Go Next

Reference bookmarked. Now stress-test it.

Start with free GH-500 questions covering every task above.

Start Free GH-500 Practice