Teams buy GitHub's security features and then leave secrets, dependency alerts and code scanning results piling up, because nobody on the team knows how to configure, triage and govern them at scale, and the GH-500 GitHub Advanced Security exam tests exactly that skill set. This guide covers what Microsoft Learn and GitHub publish about GH-500: the six weighted skill areas after the July 2026 revision, exam format, scoring, retake and renewal rules, and the product knowledge you need behind each domain. It then sets out a lab-based preparation plan and where the certification fits for DevSecOps, application security and platform engineers. Facts were checked on Microsoft Learn and GitHub Docs on 8 November 2026. Microsoft notes that skills outlines change, so confirm on the exam page before you book.
This is an independent guide from NHI Mgmt Group, based on GitHub and Microsoft Learn public documentation as of November 2026. It is not sponsored or reviewed by GitHub or Microsoft. Exam details change, so confirm requirements against the current exam page.
Key takeaways
- One intermediate exam, no formal prerequisite. GH-500 is a 100-minute proctored exam delivered through Pearson VUE, and Microsoft lists no prerequisite certification.
- The July 2026 outline uses the new product names. Secret scanning is now Secret Protection, Dependabot and dependency review sit under Supply Chain Security, and CodeQL code scanning sits under Code Security.
- Governance carries real weight. Security operations (15 to 20%) and suite administration (10 to 15%) test rulesets, delegated bypass, roles and rollout at enterprise scale, not only feature switches.
- A score of 700 or greater passes. You can retake 24 hours after a first failed attempt; later retake waits follow Microsoft's retake policy.
- Valid for two years. GitHub is moving to Microsoft's renewal process and has said certifications expiring before that process is available will be extended by six months.
Who the certification is for
Microsoft Learn describes the audience as experienced software development and security professionals with a deep understanding of GitHub security features and hands-on experience securing development workflows. Listed roles are administrator, developer, DevOps engineer, solution architect and student. In practice it suits:
- DevSecOps and platform engineers who roll out code scanning, Secret Protection and dependency controls across organisations. See the DevSecOps Engineer Career Guide.
- Application security engineers who own alert triage, CodeQL query suites and remediation campaigns. See the Application Security Engineer Career Guide.
- GitHub enterprise and organisation administrators responsible for security configurations, roles and rulesets.
- Security leads evaluating rollout who need to understand availability across public repositories, GitHub Team and GitHub Enterprise Cloud and Server.
It is a product credential: it proves you can operate GitHub's security suites. It sits well beside broader secure development knowledge from the Secure Software Development Lifecycle (SSDLC) Guide.
Exam format and domains
What Microsoft Learn publishes
| Item | Published detail (8 November 2026) |
|---|---|
| Exam | GH-500: GitHub Advanced Security, level Intermediate |
| Duration | 100 minutes |
| Delivery | Proctored, scheduled through Pearson VUE; may include interactive components |
| Languages | English, Spanish, Portuguese (Brazil), Korean, Japanese |
| Passing score | 700 or greater |
| Price | Varies by the country or region where the exam is proctored; shown at scheduling |
| Retake | 24 hours after a first failed attempt; later waits per the Microsoft retake policy |
| Validity | Two years |
| Practice | Free practice assessment, exam sandbox and study guide on Microsoft Learn |
Microsoft recommends registering with a personal Microsoft account rather than a work or school account, because exam records tied to an organisational account are lost if you leave that organisation. Localised versions typically follow the English version by about eight weeks, and candidates who need a language not yet available can request an extra 30 minutes.
Skills measured (outline as of July 2026)
| Domain | Weight | What it tests |
|---|---|---|
| 1. Describe GitHub Security suites, features and ecosystem | 15 to 20% | Suite structure, feature availability for public repositories and enterprise, Security Overview, secure SDLC, security campaigns, alert responsibilities across roles |
| 2. Configure and use Secret Protection | 15 to 20% | Enabling at repository and organisation level, push protection, validity checks, alert lifecycle, delegated bypass, alert recipients and exclusions, custom patterns |
| 3. Configure and use supply chain security | 15 to 20% | Dependency graph, SBOM export, Dependabot alerts and security updates, EPSS prioritisation, dependency review before merge, grouping and auto-dismiss rules, webhooks |
| 4. Configure and use Code Security | 10 to 15% | CodeQL and third-party tools, SARIF ingestion, Actions and external CI setup, workflow templates, matrix builds, dataflow results, autofix, dismissal, troubleshooting |
| 5. Security operations: best practices, prioritisation and remediation | 15 to 20% | CVE, CWE and GitHub Security Advisories, severity rulesets, campaign remediation, bulk alert management, custom CodeQL query suites, delegated exceptions |
| 6. GitHub Security suites administration | 10 to 15% | Enablement at enterprise, organisation and repository level, Enterprise Cloud and Server differences, default configurations and inheritance, policies, rulesets, bypass permissions, roles, APIs for automation |
The study guide changelog describes the July 2026 revision as significant: objectives were added, removed, regrouped and reworded. Older practice material written for the "secret scanning, Dependabot, code scanning" outline will miss the governance and campaign objectives.
Prerequisites and experience
There is no formal prerequisite. Microsoft Learn expects candidates to be familiar with GitHub fundamentals, CI/CD and secure development concepts, and to use GitHub Advanced Security to secure code, secrets and dependencies. The product facts below, from GitHub Docs, are the ones the domains lean on most:
- Product packaging: GitHub Secret Protection covers secret scanning, push protection, AI-detected secrets, custom patterns, delegated bypass and delegated alert dismissal. GitHub Code Security covers code scanning with CodeQL or third-party tools, the CodeQL CLI, Copilot Autofix, dependency review and custom auto-triage rules for Dependabot. Both include security campaigns and security overview.
- Availability: both products are purchased for GitHub Team or GitHub Enterprise Cloud for private and internal repositories. Code scanning and secret scanning are on by default for public repositories, and the dependency graph and Dependabot alerts are included in all plans.
- Push protection: applies to command line pushes, commits in the web UI, file uploads and REST API requests. Push protection for users is on by default on GitHub.com; push protection for repositories is enabled by an administrator, organisation owner, security manager or enterprise owner. Each bypass creates an alert and an audit log entry, and delegated bypass restricts who can bypass.
- Code scanning default setup: GitHub recommends starting with default setup, which needs GitHub Actions, covers CodeQL-supported languages and runs on push, pull request and a weekly schedule. Advanced setup uses a workflow file for custom builds and queries.
- Security configurations: collections of enablement settings applied to repositories across an organisation, which can be enforced so repository administrators cannot override them.
Our recommendation at NHI Mgmt Group: have at least three months of hands-on time administering these features in a real organisation, or a dedicated test organisation, before booking.
Preparation plan
- Read the current study guide. Download the GH-500 study guide and mark every objective you have not done hands-on. Pay particular attention to the July 2026 objectives on campaigns, rulesets and delegated roles.
- Set up a test organisation. Use public repositories, where code scanning and secret scanning are available, or a trial of the paid products. Create several repositories in different languages.
- Secret Protection lab: enable push protection, test a bypass with each reason, configure delegated bypass, write a custom pattern and dry-run it, and work alerts through to closure. Pair this with the Developer Secret Scanning Triage guide.
- Supply chain lab: review the dependency graph, export an SBOM, turn on Dependabot alerts and security updates, add a dependency review check to a branch ruleset, and write grouping and auto-triage rules. The SBOM Guide and EPSS Guide give the background.
- Code Security lab: enable default setup, then switch one repository to advanced setup with a matrix build and the security-extended query suite, upload a SARIF file from another tool, and practise dismissing alerts with reasons. See the CodeQL Guide and SARIF.
- Administration lab: create a custom security configuration, apply and enforce it, assign the security manager role, and use the REST API to report on enablement across repositories.
- Run a security campaign: select a set of alerts, assign owners and track progress in security overview.
- Take the practice assessment and try the exam sandbox. Book when you consistently score well and can explain why each wrong option is wrong.
Cost, renewal and continuing education
- Exam fee: Microsoft Learn states that the price varies by the country or region where the exam is proctored. The exact figure is shown during Pearson VUE scheduling. Microsoft also links an Exam Replay offer on its deals page.
- Validity: GitHub certifications are valid for two years.
- Renewal: GitHub is moving to Microsoft's recertification process, which will let holders maintain certifications without retaking the full exam. As of November 2026 the exam page gives no date for this. Certifications that expire before the new process is available are extended by six months.
- Expired certifications: the exam page directs holders to contact [email protected], which provides one exam voucher for a first renewal attempt.
- Staying current: GitHub renames and repackages security features regularly. Follow the GitHub changelog and the study guide changelog, and track your expiry date with the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
| Role | How GH-500 helps | Next step |
|---|---|---|
| Developer moving into security | Proves you can operate secret, dependency and code scanning controls in the tool you already use | Application Security Engineer Career Guide |
| DevSecOps or platform engineer | Covers rollout at scale: security configurations, rulesets, APIs | GitHub and GitHub Actions Security Guide |
| Application security engineer | Validates CodeQL, SARIF and triage workflow knowledge | Vulnerability Prioritisation Guide |
| Security architect | Shows understanding of prevention-first versus gate-based strategy on GitHub | Software Supply Chain Security Guide |
The Secret Protection domain is non-human identity work. Every secret it finds is a credential for a service account, API, cloud workload or automation, and the right response is revocation and rotation at the source, then removal from history. Candidates who understand that chain, and the shift from long-lived secrets to federated workload identity, bring more to the role than the exam alone tests. See the Git Secret Scanning Guide and the GitHub Actions OIDC Federation Hardening Guide.
Practitioner checklist
- Study from the July 2026 GH-500 outline and its new product names, not older material.
- Register with a personal Microsoft account so your record follows you between employers.
- Build a test organisation and do every lab: Secret Protection, supply chain, Code Security and administration.
- Practise delegated bypass, delegated alert dismissal and role assignment, not only enablement.
- Run at least one security campaign end to end and report on it in security overview.
- Take the free practice assessment and the exam sandbox before booking.
- Check the local exam price at scheduling and look for current offers on the Microsoft deals page.
- Record your two-year expiry date and watch for the Microsoft renewal process announcement.
- Treat every secret alert as a credential to revoke and rotate, then remove from history.
Standards and references
- Microsoft Learn: GitHub Advanced Security certification
- Microsoft Learn: Study guide for Exam GH-500
- GitHub Docs: About GitHub Certifications
- GitHub Docs: About GitHub Advanced Security
- GitHub Docs: About push protection
- GitHub Docs: Configuring default setup for code scanning
- GitHub Docs: About enabling security features at scale
Related NHI Mgmt Group resources: GitHub and GitHub Actions Security Guide · CodeQL Guide · Git Secret Scanning Guide · DevSecOps Engineer Career Guide