2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

GitHub GH-500 Advanced Security Exam Practice Questions, practice question pack
GITHUB · GH-500

GitHub GH-500 Advanced Security Exam Practice Questions

99% pass rateUpdated 1 Nov 2026127 questions2 PDFs by email

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Your PDF is prepared and emailed to you after checkout, usually within a few hours.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 127 questions in this pack

Question 1

What is a prerequisite to define a custom pattern for a repository?

  1. Change the repository visibility to Internal.
  2. Enable secret scanning.
  3. Close other secret scanning alerts.
  4. Specify additional match criteria.
Show answer and explanation

Correct answer: B. Enable secret scanning.

Secret scanning must be enabled on a repository before you can define custom patterns for it. This is a fundamental prerequisite because custom patterns are part of the secret scanning feature set and cannot exist without the parent feature being active.

Why the other options are wrong

  • A. Repository visibility does not need to be changed to Internal to define custom patterns.
  • C. Closing other secret scanning alerts is not a prerequisite for defining custom patterns.
  • D. While match criteria are specified when creating a pattern, they are not a prerequisite but rather a component of the pattern definition itself.

Question 2

Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:

  1. private repositories.
  2. all new repositories within your organization.
  3. public repositories.
  4. user-owned private repositories.
Show answer and explanation

Correct answer: C. public repositories.

When security and analysis features are not configured at any level, secret scanning is enabled by default on public repositories only. GitHub prioritizes scanning public repositories because they are accessible to everyone and pose the greatest risk if secrets are exposed.

Why the other options are wrong

  • A. Private repositories do not have secret scanning enabled by default; this typically requires explicit enablement.
  • B. Secret scanning is not automatically enabled on all new repositories without configuration; it must be explicitly set at the organization level.
  • D. User-owned private repositories do not have secret scanning enabled by default without explicit configuration.

Question 3

Which patterns are secret scanning validity checks available to?

  1. high entropy strings
  2. custom patterns
  3. push protection patterns
  4. partner patterns
Show answer and explanation

Correct answer: D. partner patterns

Secret scanning validity checks are available to partner patterns. Partner patterns are provided by GitHub's security partners and include built-in validity checks that verify whether detected secrets are actually valid and active, reducing false positives.

Why the other options are wrong

  • A. High entropy strings are a pattern type but do not have validity checks available.
  • B. Custom patterns do not have validity checks; they are user-defined and lack the validation infrastructure of partner patterns.
  • C. Push protection patterns do not have dedicated validity checks as a primary feature.

See all 32 free questions Get the full pack, US$39

How much of the GitHub GH-500 Advanced Security bank is free?

127 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 3225% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 5644% of the bankHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 127100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the GitHub GH-500 Advanced Security pack

  • 127 questions mapped to the GH-500 exam objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Delivered by email shortly after checkout
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A GH-500 attempt costs US$99. This pack is US$39, paid once.

What makes the GH-500 hard

GH-500 was rebuilt in July 2026 around GitHub's renamed security suites. The blueprint now says Secret Protection, not secret scanning; Supply Chain Security, not Dependabot; Code Security, not code scanning with CodeQL. Six domains replace the old five, with a new administration domain on rolling the suites out at enterprise, organisation and repository level, and Microsoft's change log marks the exam as significantly changed.

The weighting is flat, so nothing can be skipped. Secret Protection, supply chain and security operations are 15 to 20% each: push protection, validity checks and custom patterns; the dependency graph, SBOM export and EPSS-scored prioritisation; and CVE, CWE and GitHub Security Advisory concepts with campaign-based remediation.

Code Security expects SARIF ingestion, CodeQL versus third-party tools, matrix scans and autofix. The administration domain adds default configurations and inheritance, enforcement boundaries, security manager roles, and the GHEC versus GHES feature differences.

About the exam

GH-500 (GitHub Advanced Security) is delivered by Microsoft and maintained by GitHub. It covers the GitHub Security suites and secure SDLC, Secret Protection, supply chain security, Code Security with CodeQL, security operations and remediation, and administering the security suites at scale. It is an intermediate-level exam with no prerequisites, and skills are measured as of July 2026.

Questions before you buy

How quickly do I receive it?

Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products