Application-security certification covering GitHub Secret Protection, supply chain security, Code Security with CodeQL, security operations, and enterprise administration.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleDescribe GitHub Security suites, features, and ecosystemmedium
A platform team is mapping out which GitHub Advanced Security capabilities belong to which licensable product so they can budget seats correctly. They need to place CodeQL-based code scanning and the alerts it raises under the correct product line. Which product does code scanning with CodeQL belong to?
- ACode Security, because code scanning with CodeQL performs static analysis to find vulnerabilities in the codebase.check_circle Correct
- BSecret Protection, because CodeQL inspects source files for sensitive strings before they are committed.
- CSupply Chain Security, because CodeQL evaluates the security of third-party dependencies pulled into the build.
- DSecurity Overview, because code scanning alerts are surfaced there for the whole organisation.
Place code scanning with CodeQL under the Code Security product within GitHub Advanced Security. GitHub Advanced Security is divided into product lines by the type of risk each addresses. Code scanning with CodeQL is static analysis of first-party source for vulnerabilities, which is the defining function of Code Security, distinct from credential detection (Secret Protection) and dependency risk (Supply Chain Security).
Why A is correct: Code scanning with CodeQL is the static application security testing capability, and GitHub packages it under the Code Security product. It analyses code paths for vulnerabilities such as injection flaws, which is exactly the Code Security remit.
Why B is wrong: This is tempting because both features analyse source code, but Secret Protection covers secret scanning and push protection for credentials, not static analysis of code logic. CodeQL does not look for committed credentials, so it is not part of Secret Protection.
Why C is wrong: Supply Chain Security covers the dependency graph, Dependabot, and Dependency Review, which assess third-party components. CodeQL analyses first-party source code rather than declared dependencies, so this product placement is wrong.
Why D is wrong: Security Overview is a reporting and navigation surface that aggregates alerts from multiple features; it is not a licensable product that owns code scanning. Seeing CodeQL alerts in Security Overview does not make code scanning part of it.
lock_openFree sampleConfigure and use Secret Protectionmedium
An open-source maintainer hosts a popular public repository on GitHub.com and has never purchased any paid security product for it. They want to confirm whether secret scanning will detect leaked tokens such as a published cloud provider key in that public repository at no extra cost. What is the correct position for a public repository under GitHub.com?
- ASecret scanning runs on the public repository only after the maintainer buys a "GitHub Advanced Security" or "Secret Protection" licence and assigns a seat.
- BSecret scanning is available free of charge for the public repository, so it can detect supported leaked credentials without any paid product.check_circle Correct
- CSecret scanning only ever runs on public repositories that belong to a paid organisation account, not on personal public repositories.
- DSecret scanning is unavailable for public repositories because exposed secrets there are treated as already public and beyond remediation.
Recognise that secret scanning is free for public repositories on GitHub.com whereas private and internal repositories need a paid Secret Protection licence. GitHub funds "secret scanning" for public repositories so that leaked credentials in open-source code are caught without cost, including partner notification for many provider tokens. The paid "Secret Protection" entitlement is what extends the same detection to private and internal repositories, which is why no purchase is required for the public case.
Why A is wrong: This is tempting because private and internal repositories do require a paid "Secret Protection" licence, but public repositories on GitHub.com receive secret scanning free of charge, so no purchase or seat assignment is needed.
Why B is correct: GitHub provides "secret scanning" for public repositories at no cost as part of the platform, so the maintainer can detect supported partner and provider secrets without buying "Secret Protection". This matches the free public-repository entitlement.
Why C is wrong: Account type is not the gate here. Free public-repository secret scanning applies regardless of whether the repository is owned by a personal account or an organisation, so restricting it to paid organisations is incorrect.
Why D is wrong: Public exposure makes detection more urgent, not pointless, and GitHub still scans and alerts on it. The premise that public secrets are beyond remediation is wrong, so this option misstates the behaviour.
lock_openFree sampleConfigure and use Code Securitymedium
A monorepo is analysed by two scanners: CodeQL for application code and a separate infrastructure-as-code scanner. Both upload SARIF for the same commit, but the second upload appears to overwrite the first so only one tool's alerts remain visible. What SARIF upload practice keeps both sets of results as distinct, co-existing code scanning alerts?
- AGive each tool's upload a distinct category value so code scanning tracks the two analyses separately for that commit and ref.check_circle Correct
- BUpload both SARIF files in a single combined run so code scanning merges the two tools into one result set.
- CSchedule the two scanners on different days so their uploads never target the same commit and cannot collide.
- DSet a unique runAutomationDetails id on each tool's check run so the Security tab keeps them on separate pages.
Use a distinct SARIF category per tool so multiple analyses for the same commit and ref are tracked and displayed separately. Code scanning treats an analysis as the tuple of tool, ref, and category. When two tools share the same effective category, a fresh upload from one is interpreted as updating the same analysis and supersedes the other. Supplying a unique category for each scanner lets code scanning keep the analyses independent so both tools' alerts remain on the same commit.
Why A is correct: Code scanning identifies an analysis by the combination of tool, ref, and the category supplied at upload. Assigning each scanner a unique category means a new upload only refreshes the matching analysis, so both tools' alerts persist side by side instead of one overwriting the other.
Why B is wrong: Combining unrelated tools into one upload does not preserve their separation and is not how code scanning distinguishes analyses. It is tempting as a way to keep everything together, but without distinct categories one analysis still replaces the other.
Why C is wrong: Staggering schedules avoids same-commit uploads but defeats the goal of having both tools' current results on the latest commit. It is a workaround that sacrifices coverage rather than the supported way to keep concurrent analyses distinct.
Why D is wrong: While SARIF does carry automation details, code scanning keys analyses on the upload category rather than on a hand-set check run page, and the example wrongly ties this to check runs. Relying on a check run id instead of a category does not stop one analysis replacing another.
More free GH-500 practice questions with worked answersFrequently asked questions
- How many questions are on the GH-500 exam?
- The GitHub Advanced Security (GH-500) exam has Approximately 75 questions and runs for 90 minutes. The format is multiple choice and multiple response, online proctored.
- What score do I need to pass GH-500?
- The pass mark is 700 / 1000. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the GH-500 exam cost?
- The exam costs 99 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- Is there a GH-500 practice exam?
- Yes. Examworthy's exam mode runs a timed GH-500 practice exam (mock) paced to match the real exam, scored per domain so you can see exactly where you stand against the blueprint. Timed mocks are free with an account.
- How does Examworthy help me prepare for GH-500?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with GitHub?
- No. Examworthy is not affiliated with or endorsed by GitHub. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by GitHub. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. GH-500 and related marks belong to their respective owners.
