GH-500 - GitHub Security suites administration (14% of the exam) - Section 6.3

Define enterprise and organization security policies and rulesets, configure enforcement boundaries, bypass permissions, exceptions, and security roles.

Define enterprise and organisation security policies and rulesets, setting enforcement boundaries that determine which repositories are covered and which teams hold bypass permissions. Configure the security manager role and policy exceptions to balance strict enforcement with the flexibility required for legitimate operational needs.

organization rulesetsenforcement boundariesbypass permissionssecurity managerpolicies

Practice question for this objective

Free sampleGitHub Security suites administrationmedium

An enterprise on GitHub Enterprise Cloud uses an enterprise policy to require that push protection for secret scanning is enabled and cannot be turned off by member organisations. An organisation owner inside that enterprise tries to disable push protection for one of their repositories because a team finds the blocking inconvenient. What governs whether the organisation owner can do this?

AThe organisation owner can disable it, because organisation-scope settings always take precedence over an enterprise policy that conflicts with a local preference.
BThe organisation owner can disable it for that single repository, because enterprise policies set defaults only and never restrict an explicit per-repository override.
CThe organisation owner cannot disable it, because an enforced enterprise policy removes the option at the organisation and repository levels beneath it. Correct
DThe organisation owner cannot disable it unless they first remove the repository from any security configuration, after which the enterprise policy stops applying to it.

Recognise that an enforced enterprise policy locks a security setting so organisations and repositories beneath cannot override it. Enterprise policies cascade downward, and when one is set to enforce rather than merely recommend, it removes the matching control at organisation and repository scope. A required push protection policy therefore leaves the organisation owner with no option to disable it on a repository below.

Why A is wrong: This reverses the precedence model; a more restrictive enterprise policy overrides a looser organisation choice, not the other way round. It is tempting because organisation owners do control many settings, but an enforced enterprise policy removes that local option.

Why B is wrong: Enterprise policies can be set to enforce, not merely recommend, which closes off per-repository overrides. The distinction between a default and an enforced policy is exactly the trap; treating every policy as just a default is the mistake.

Why C is correct: When an enterprise policy is set to enforce a setting such as push protection, the corresponding control is locked for the organisations and repositories below, so the option to disable is unavailable. The organisation owner therefore cannot turn push protection off.

Why D is wrong: Detaching a security configuration does not exempt a repository from an enforced enterprise policy; the policy applies regardless of configuration attachment. The mention of configurations is plausible, but it conflates two separate governance mechanisms.

See more GH-500 practice questions, answers explained.

Exam traps in GitHub Security suites administration

Answers that look right on this material and are not. Each one is a distractor from a different question in the GH-500 bank for this domain.

Add the group as organisation owners, then rely on an organisation ruleset to strip their ability to push code and edit non-security settings.
Why it is wrong: Owner status grants total control of the organisation, and rulesets govern repository actions like merges and pushes rather than revoking owner privileges. A ruleset cannot claw back the broad administrative powers that ownership confers, so this overshoots the requirement.
The organisation configuration takes effect as written, because organisation-scoped settings are evaluated after and therefore override enterprise-level policy.
Why it is wrong: Assuming the more specific scope wins is a reasonable instinct from other systems, but enterprise policy is not subordinate to organisation choices here. An organisation cannot relax a control the enterprise has mandated, so the organisation configuration cannot simply override it.
The default failed to save because the lead did not also publish the configuration to the enterprise, so they should reauthor it at enterprise scope to make the organisation default take effect.
Why it is wrong: This is tempting if one conflates scopes, but an organisation default does not require enterprise publication to function, so reauthoring at enterprise level is not the missing step.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.