GH-500 Practice Test

Sample GH-500 Practice Questions

10 real questions from the free GH-500bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A security manager at a large enterprise needs to identify the ten repositories with the highest count of unresolved critical code-scanning alerts, across an organization of 900 repositories, so remediation effort can be prioritized this sprint. Which approach best satisfies this need using GitHub Security suites?

   • A. Use the organization Security overview repository-level view, sorted and filtered by alert severity and count
   • B. Manually open each repository's Security tab and record alert counts in a spreadsheet
   • C. Export the dependency graph for each repository and cross-reference it against a CVE database
   • D. Ask each repository maintainer to self-report their alert counts in a survey
   Show answer

   Correct answer: A

   The Security overview repository-level view is purpose-built for this: it aggregates alert data across the organization and can be filtered and sorted by severity, letting a security manager quickly surface the highest-risk repositories at scale. Manually checking 900 repositories or relying on self-reported surveys does not scale and is error-prone. The dependency graph only covers dependency data, not code-scanning alerts.

2. 2. A private repository within a GitHub Enterprise Cloud organization has not purchased Code Security. A contributor pushes a commit that introduces a SQL injection vulnerability. What happens?

   • A. The push is automatically blocked because SQL injection is detected by GitHub regardless of licensing
   • B. A Dependabot alert is raised because the vulnerability originates from a dependency
   • C. No code-scanning alert is generated, because CodeQL analysis on private repositories requires a Code Security license
   • D. A secret scanning alert is raised, since SQL injection risk is treated as a leaked-credential pattern
   Show answer

   Correct answer: C

   Code scanning with CodeQL on private repositories is part of the licensed Code Security product; without that license, no static-analysis alert will be generated for the introduced vulnerability. Pushes are not blocked purely because a vulnerability pattern exists (push protection targets secrets, not general code flaws). A SQL injection bug in first-party code is not a Dependabot (dependency) alert, and it has nothing to do with secret scanning, which looks for credential-shaped strings.

3. 3. Within a single repository, where would a developer go to see all currently open secret scanning, code scanning, and Dependabot alerts for that repository in one place?

   • A. The repository's Insights tab
   • B. The repository's Security tab
   • C. The repository's Settings tab
   • D. The repository's Pull requests tab
   Show answer

   Correct answer: B

   The repository-level Security tab consolidates secret scanning, code scanning, and Dependabot alerts for that specific repository into one navigable location. Insights reports on activity metrics, Settings configures repository options (including which security features are enabled, but not the alerts themselves), and Pull requests only surfaces alerts inline on the diff of a specific PR.

4. 4. Which of the following best describes a "prevention-first" security posture?

   • A. Stopping risky changes as early as possible in the developer workflow, ideally before they are even committed
   • B. Relying exclusively on a single annual audit to catch issues
   • C. Reviewing security after a production incident has already occurred
   • D. Requiring a change advisory board meeting before each deployment
   Show answer

   Correct answer: A

   Prevention-first means intercepting risk as early as possible, ideally before a change is even committed, which is the philosophy behind controls like push protection. A single annual audit, post-incident-only review, and a change advisory board gate are all later-stage or reactive approaches, not prevention-first ones.

5. 5. What is the primary purpose of a security campaign in GitHub?

   • A. To schedule automated dependency version bumps on a fixed cadence
   • B. To group and collaboratively remediate a related set of security alerts at scale
   • C. To generate a compliance certificate for auditors
   • D. To automatically merge pull requests that pass their required checks
   Show answer

   Correct answer: B

   A security campaign groups a related set of alerts and coordinates developers to remediate them collaboratively, reducing security debt at scale. It does not schedule dependency bumps on its own, generate compliance certificates, or auto-merge pull requests, each of which is a different, unrelated capability.