Examworthyexamworthy.comGitHub Advanced Security (GH-500) cheat sheet
GitHub
Free to share. Examworthy is not affiliated with or endorsed by GitHub; GH-500 and related marks belong to their respective owners.
At a glance
Format: Multiple choice and multiple response, online proctored
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
GH-500 is a configure-the-right-control exam: nearly every question is a scenario where the answer is the documented GitHub Advanced Security feature, enabled at the correct repository, organisation, or enterprise scope, that prevents the problem early rather than remediating it late.
Spot the trap
Tempting wrong answers, and why they failCommon misconception
That Advanced Security scanning always needs a paid licence. On public repositories code scanning and secret scanning run free, same as Dependabot.
Describe GitHub Security suites, features, and ecosystem
Common misconception
That secret scanning on a public repository needs a paid licence. It runs free automatically for public repos; a paid Secret Protection licence only covers private and internal ones.
Configure and use Secret Protection
Common misconception
That Dependabot alerts come from CodeQL scanning your code for vulnerable calls. Alerts instead come from matching dependency versions against advisory data.
Configure and use supply chain security
Common misconception
That a CVE groups every vulnerability sharing a root cause across products. A CVE names one specific disclosed flaw; CWE is the weakness category.
Security operations: best practices, prioritization, and remediation
Common misconception
That enabling code scanning means CodeQL analyses every language in the repository. CodeQL only covers its supported languages; others need a SARIF-integrated tool.
Configure and use Code Security
Common misconception
That assigning the security manager role makes organisations inherit a standard set of enabled security features. The role only grants visibility and management access, not distribution.
GitHub Security suites administration
Common misconception
That code scanning and secret scanning are cloud-only features. GitHub Enterprise Server supports both, gated behind a GitHub Advanced Security licence rather than being unavailable.
Describe GitHub Security suites, features, and ecosystem
Common misconception
That push protection on a public repository needs a paid Secret Protection licence before it will block anything.
Configure and use Secret Protection
Key terms
Exam-day rules
- Read the scenario for its requirement first. The security need named in the question, paired with the scope it concerns, is what picks the answer, so find both before you judge the options.
- Prefer the documented, built-in mechanism. When an option describes a supported GitHub feature and another describes a hand-rolled workaround such as re-pushing files or parsing artifacts, the supported feature is almost always the answer.
- Choose prevention over cleanup. Push protection at push time, dependency review before merge, and a CodeQL pull request scan beat after-the-fact remediation when the scenario allows catching the problem early.
- Match the enablement scope exactly. Decide whether the action belongs at repository, organisation, or enterprise level, and remember a default security configuration only covers repositories created after it is set, so existing ones need bulk attachment.
- Map every feature to its product. Code scanning with CodeQL is Code Security, secret scanning and push protection are Secret Protection, and dependency review and Dependabot are supply chain features; licensing questions hinge on this split.
Revision schedule
- Day 1Map the blueprint and book a date
- Week 1Build the product and scope maps
- Weeks 1 to 2Go deep on Secret Protection and supply chain security
- Weeks 2 to 3Lock Code Security and the CodeQL model
- Weeks 3 to 4Cover security operations and remediation at scale