Direct answer
GH-500 (GitHub Advanced Security) is a Microsoft-hosted, GitHub-maintained certification: 100 minutes, a 700/1000 passing score, scheduled through Pearson VUE. It tests whether you can configure and operate GitHub's three security suites — Secret Protection, Supply Chain Security, and Code Security — across six weighted domains, not whether you can recite feature names. Passing means knowing what each suite catches, what it misses, and who's allowed to override it.
GH-500's full name is GitHub Advanced Security, and it's a meaningfully different animal from GitHub's Foundations-level exams. Where GH-900 asks you to recognize what a pull request or a branch protection rule is, GH-500 assumes you already know GitHub and instead tests whether you can run its security tooling in production — deciding which alerts to act on, which suite owns a given risk, and how an organization enforces security policy across hundreds of repositories at once.
MSCertQuiz sells 500 GH-500 practice questions (40 free) built from the same skills outline this guide is based on; this study guide is written by the same team that maintains that question bank.
Who GH-500 Is Actually Built For
Microsoft's stated audience profile for GH-500 assumes you have experience using GitHub Advanced Security (GHAS) to secure code, secrets, and dependencies across the software development lifecycle — and that you're already comfortable with GitHub fundamentals and CI/CD. That framing matters for how you study: this isn't an exam you can pass by memorizing a glossary. It rewards people who have actually clicked through a repository's Security tab and made a judgment call about an alert.
The exam organizes that judgment around three security suites that show up constantly across all six domains: Secret Protection (credential leak detection, formerly "secret scanning"), Supply Chain Security (dependency risk, formerly the Dependabot/Dependency Review feature set), and Code Security(static analysis, formerly "Code Scanning with CodeQL"). A large share of exam questions aren't really about one suite in isolation — they're about which suite owns a given scenario, or how two suites interact.
How the Six Domains Actually Break Down
Four of the six domains carry equal top weight (15–20% each): the ecosystem-overview domain, Secret Protection, Supply Chain Security, and the operations/prioritization domain. The remaining two — Code Security and administration — sit slightly lower at 10–15% each. In practice that means roughly three-quarters of the exam is split almost evenly across "what the suites are," "stopping leaked secrets," "managing dependency risk," and "operating alerts at scale," with static-analysis configuration and org-wide administration filling the rest.
The Secret Protection domain goes deeper than "does it detect a leaked API key." It expects you to separate push protection(blocks a secret before it's ever committed) from scanning that only flags a secret already in history, and to know how validity checks let GitHub prioritize alerts for secrets it can confirm are still active over ones that look like a match but may be expired or fake.
The Supply Chain Security domain leans hard on prioritization mechanics that don't show up in GitHub's beginner-level content at all: EPSS scoring (a probability estimate of a vulnerability actually being exploited, used to rank which dependency alert to fix first) and security campaigns that bundle related alerts into a single bulk-remediation effort instead of a developer fixing them one PR at a time. SBOM export — generating a software bill of materials from the dependency graph — also lives here.
Code Security is the smallest domain but arguably the most technical: choosing between CodeQL and third-party SARIF-producing scanners, deciding on matrix builds and scan frequency, and knowing what autofix can and can't do with a flagged data-flow issue. The administration domain, meanwhile, is entirely about scale — default configuration inheritance from enterprise down to a single repository, delegated bypass permissions, and the difference between what a security manager role can do versus a repository admin.
See it in question form
Try 40 Free GH-500 Practice Questions
Scenario questions across all six domains, difficulty-tiered. No credit card required.
Start Free Practice →Myths That Trip Up GH-500 Candidates
"It registers and runs the same way as GH-900."
It doesn't. GH-900 (GitHub Foundations) is scheduled directly through GitHub via PSI, outside Microsoft's own certification system. GH-500 sits inside Microsoft Learn's credential catalog and is scheduled through Pearson VUE — same booking flow as an Azure or Microsoft 365 exam, complete with the standard annual renewal-by-free-assessment policy instead of GitHub's 2-year renewal cycle.
"Advanced Security means it's all free once you enable it."
Basic secret scanning and Dependabot alerts are genuinely free on public repositories. But Secret Protection and Code Security as GHAS-licensed capabilities — the versions that work on private and internal repositories — require a paid license at the organization or enterprise level. The exam tests this public-vs-private distinction directly, more than once.
"Dismissing an alert just means it's no longer a problem."
The operations domain specifically tests the implications of ignoring or dismissing alerts — including that a dismissal without a documented reason undermines audit and compliance reporting. Several exam scenarios hinge on choosing the correct dismissal reason, not just the act of dismissing.
"You need real CodeQL query-authoring skill to pass."
Code Security questions test your ability to choose, configure, and tailor scanning — including picking a query suite appropriate to a codebase's risk profile — not your ability to write custom CodeQL from scratch. If you've never opened the CodeQL query language docs, that's fine for this exam.
Turning the Domain Weights Into a Study Plan
Microsoft points candidates at two self-paced Microsoft Learn training paths (GitHub Advanced Security Part 1 and Part 2) plus GitHub's own documentation for each suite. None of that documentation is written as exam prep, though — it explains features, not which features get tested hardest. The table below allocates a 30-hour study budget proportionally to each domain's exam weight; adjust the total up or down but keep the ratios if your available time is different.
| Domain | Weight | Suggested hours | What "ready" looks like |
|---|---|---|---|
| Describe GitHub Security suites, features, and ecosystem | 15–20% | ~5.5 hrs | Can explain what Code Security, Secret Protection, and Supply Chain Security each cover without mixing them up |
| Configure and use Secret Protection | 15–20% | ~5.5 hrs | Can state what push protection blocks vs. what secret scanning only detects after the fact |
| Configure and use supply chain security | 15–20% | ~5.5 hrs | Can explain EPSS-based prioritization and what a Dependency Review pre-merge check actually blocks |
| Configure and use Code Security | 10–15% | ~4 hrs | Can describe a CodeQL scan setup choice without needing to write a CodeQL query yourself |
| Security operations: best practices, prioritization, remediation | 15–20% | ~5.5 hrs | Can explain why a security campaign scales remediation better than fixing alerts one at a time |
| GitHub Security suites administration | 10–15% | ~4 hrs | Can describe default configuration inheritance from enterprise → organization → repository |
If you're already running GHAS day-to-day — triaging real alerts, configuring org-level policy — you can likely compress this to 15-20 hours focused on the administration and supply-chain domains, since those are the areas that trip up people without governance-level access. If your GitHub experience stops at using pull requests and Actions, budget closer to the full 30 hours and start with the ecosystem-overview domain so the suite names and their boundaries are solid before the detail-heavy domains.
For hands-on drilling, MSCertQuiz's 500-question bank mirrors the table above in proportion — you'll see roughly twice as many Secret Protection and Supply Chain questions as Code Security questions, matching the real exam's weighting rather than an even split across domains.
A Few Logistics Worth Knowing Before You Book
Microsoft's role tags for GH-500 are Administrator, Developer, DevOps Engineer, and Solution Architect, filed under the DevOps subject area — a useful signal if you're deciding whether this exam fits your role at all before investing study time. The exam is offered in English, Spanish, Portuguese (Brazil), Korean, and Japanese; if it's not offered in your preferred language, Microsoft grants an extra 30 minutes on request.
If you don't pass on the first attempt, Microsoft's retake policy allows a second attempt 24 hours later, with variable waiting periods for further retakes after that. There's no enforced prerequisite exam to sit before GH-500 — you can register directly — but skipping GH-900 (GitHub Foundations) first means starting this guide's domain sections with no baseline vocabulary for pull requests, Actions, or repository permissions, which the GH-500 exam assumes rather than re-teaches.
Ready to Practice GH-500?
500 scenario questions across all six domains, weighted to match the real exam.
Start Free Practice →Related Resources
Task-by-task GitHub settings paths for every suite, plus a question-pattern table.
12 scenario questions sorted Easy to Hard, with full rationale.
GitHub Foundations — the fundamentals exam GH-500 assumes you already know.
Microsoft's identity security exam — a common pairing for security-focused GitHub admins.
Frequently Asked Questions
Is GH-500 a Microsoft exam or a GitHub exam?
Both, in a specific way: Microsoft's own certification page states the exam is provided by Microsoft but the exam and certification are maintained by GitHub. Unlike GH-900, GH-500 lives inside Microsoft Learn's credential catalog and is scheduled through Pearson VUE rather than GitHub's own PSI-based registration.
How many questions are on the GH-500 exam?
Microsoft's official GH-500 exam page does not publish an exact question count — only the 100-minute duration and the 700/1000 passing score are stated. Third-party exam trackers estimate somewhere around 60-65 questions, but treat that as an estimate, not a confirmed figure.
Does GH-500 expire after 2 years like other GitHub certifications?
No. GH-500 follows Microsoft's standard associate/expert renewal policy: it expires annually and renews through a free online assessment on Microsoft Learn. That's a different renewal model than GitHub's own Foundations-level certifications, which run on a 2-year cycle.
Do I need to write CodeQL queries to pass GH-500?
No. The exam tests your ability to set up, choose, and tailor Code Security scanning — including customizing which query suite runs — not your ability to author CodeQL from scratch.
Is GitHub Advanced Security free to use?
Partially. Basic secret scanning and Dependabot alerts are free on public repositories. Secret Protection and Code Security as licensed GHAS features are required for the same protections on private and internal repositories.
What prerequisites do I need before attempting GH-500?
None are enforced, but the stated audience profile assumes hands-on GHAS experience and familiarity with GitHub fundamentals and CI/CD — it isn't written for someone new to GitHub.
Who is GH-500 designed for?
Microsoft's role tags for this exam are Administrator, Developer, DevOps Engineer, and Solution Architect — in practice, security engineers and platform engineers who own CI pipelines and repository governance.
Sources: Microsoft Learn — GH-500 study guide (skills measured as of July 2026, fetched 2026-09-07) and Microsoft Learn — GitHub Advanced Security certification overview (fetched 2026-09-07). Figures not published on either page (e.g. exact exam question count) are described as unofficial estimates, not repeated as fact.