GH-500 Cheat Sheet 2026: Task-by-Task Reference
Not organized by exam domain — organized by what you're actually trying to do: turn a feature on, investigate an alert, or govern it at scale.
Exam Snapshot
Built from Microsoft's GH-500 study guide (skills measured as of July 2026, fetched 2026-09-07) and GitHub's own security documentation — not a generic template with a cert code swapped in.
1. Turning Security Features On
| Task | Settings path | Exam-relevant detail |
|---|---|---|
| Enable Secret Protection on a repo | Repo Settings → Code security and analysis → Secret Protection | Free on public repos; requires a GHAS license to run on private/internal repos |
| Enable push protection | Repo or Org Settings → Code security and analysis → Push protection | Blocks a secret at commit time, before it ever reaches history — different from scanning, which only detects after the fact |
| Turn on Code Security (CodeQL) scanning | Repo Settings → Code security and analysis → Set up Code Security → Default or Advanced | Default setup auto-generates a workflow; Advanced setup lets you edit the CodeQL workflow YAML directly |
| Enable Dependabot alerts + security updates | Repo Settings → Code security and analysis → Dependabot | Alerts notify only; security updates additionally opens a PR to bump the vulnerable dependency |
| Roll out a security feature org-wide | Org Settings → Code security and analysis → set as default for new repositories | Controls what new repos inherit; existing repos need a bulk enablement or security configuration push |
2. Investigating and Triaging an Alert
| Task | Settings path | Exam-relevant detail |
|---|---|---|
| Triage a secret scanning alert | Repo → Security tab → Secret scanning alerts | Validity checks flag which detected secrets are still active — prioritize those first |
| Triage a Dependabot / supply chain alert | Repo → Security tab → Dependabot alerts | EPSS score ranks exploit probability — a high-EPSS, low-severity alert can outrank a low-EPSS critical one for urgency |
| Triage a code scanning (CodeQL) alert | Repo → Security tab → Code scanning alerts | Includes data-flow path info; autofix can suggest a remediation but a human still approves the fix |
| Dismiss an alert correctly | Alert page → Dismiss dropdown → select a reason | A dismissal without a documented reason weakens audit trail and compliance reporting — the reason itself is testable |
| View org-wide risk in one place | Org → Security → Overview | Aggregates alert counts and enabled-feature coverage across every repo in the organization |
Common Mistake: Dismissing Without a Reason
The triage table above treats dismissal as a single click, but the exam treats it as a governance decision. Every dismissal on a Secret Protection, Code Security, or Dependabot alert asks for a reason — false positive, won't fix, used in tests, and so on. Picking a reason that doesn't match reality (dismissing a real risk as "false positive" to clear a backlog) breaks the audit trail a security team relies on later, and it's exactly the kind of judgment call GH-500's operations domain is built to test — not whether you know the dismiss button exists.
3. Governing Security at Scale
| Task | Settings path | Exam-relevant detail |
|---|---|---|
| Export a software bill of materials | Repo → Insights → Dependency graph → Export SBOM | Supports standard SBOM formats for supply-chain compliance reporting |
| Run pre-merge dependency checks | Configure Dependency Review as a required status check | Blocks a PR that introduces a dependency violating a license or vulnerability policy — before merge, not after |
| Bulk-remediate related alerts | Security → Campaigns → create a campaign | Groups related alerts (e.g. one CVE across many repos) into one remediation effort instead of fixing PRs one at a time |
| Delegate who can bypass a security rule | Org Settings → Rulesets → bypass list | Bypass should be scoped to specific roles or apps, not left open — a common exam trap |
| Assign a security manager without granting admin | Org Settings → Security managers | Grants alert-management permissions across repos without full administrative access |
| Set a custom secret pattern | Org Settings → Code security and analysis → Custom patterns | Use for internal-only token formats that GitHub’s built-in patterns don’t recognize |
| Approve a default CodeQL configuration for the org | Org Settings → Code security and analysis → Code Security default setup | Sets the query suite (e.g. security-extended) new repos inherit automatically |
Decoding a Scenario Without a Feature Name in It
GH-500 scenarios rarely name a feature directly — they describe a situation. Match the phrasing pattern to the concept it's testing.
| If the scenario says... | Think... |
|---|---|
| "...a token was committed but never reached the remote" | Push protection (blocked before push) — not secret scanning (which only catches what already reached history) |
| "...which dependency should be fixed first" | EPSS score / campaign prioritization, not raw CVSS severity alone |
| "...available for free on a public repo but requires a license elsewhere" | Distinguishing basic scanning/Dependabot alerts (free, public) from GHAS-licensed Secret Protection/Code Security (private/internal) |
| "...a scanner produces results in a standard interoperable format" | SARIF — used to ingest third-party code scanning results alongside CodeQL |
| "...someone needs to override a security rule occasionally" | Delegated bypass policy, scoped narrowly — not disabling the rule org-wide |
| "...new repos should inherit the same security setup automatically" | Default configuration inheritance (enterprise → organization → repository) |
| "...a compliance team needs a full dependency inventory" | SBOM export from the dependency graph |
| "...alert volume is too high to fix one PR at a time" | Security campaigns for bulk, cross-repo remediation |
Terms You'll See On Screen
The task tables above assume you already know these. If a term looks unfamiliar mid-exam, this is the definition you need, not a feature name.
| Term | Definition |
|---|---|
| SARIF | Static Analysis Results Interchange Format — the standard file format GHAS uses to ingest results from third-party scanners alongside CodeQL |
| EPSS | Exploit Prediction Scoring System — a probability score estimating how likely a vulnerability is to be exploited in the wild, used to prioritize supply-chain alerts |
| CVE | Common Vulnerabilities and Exposures — a unique public identifier for a specific known vulnerability |
| CWE | Common Weakness Enumeration — a category of vulnerability type (e.g. SQL injection), broader than a single CVE |
| SBOM | Software Bill of Materials — an exportable inventory of every dependency in a project, generated from the dependency graph |
| Push protection | A Secret Protection capability that blocks a commit containing a detected secret before it ever reaches the remote repository |
| Security campaign | A bulk remediation workflow that groups related alerts (e.g. one CVE across many repositories) instead of fixing them one PR at a time |
GH-500 Quick Answers
How is this different from the GH-500 study guide?
The study guide explains the six domains narratively and busts common misconceptions. This page skips explanation and lists tasks directly, with the exact settings path and the one detail the exam usually tests about it.
What's the difference between push protection and secret scanning?
Push protection blocks a secret at commit time, before it reaches the remote. Secret scanning only detects secrets already sitting in repository history.
Can I print this GH-500 cheat sheet?
Yes — every table is plain HTML, so a browser print or "print to PDF" renders cleanly.
MSCertQuiz sells practice-exam access for GH-500 and other Microsoft and GitHub certifications; this cheat sheet is written by the same team that builds those questions.
Where to Go Next
The domain breakdown and myths behind this quick reference.
12 scenario questions, sorted Easy to Hard.
GitHub Foundations quick reference — the fundamentals GH-500 builds on.
Full exam details and the complete practice bank.
Reference bookmarked. Now stress-test it.
Start with free GH-500 questions covering every task above.
Start Free GH-500 Practice