GH-500 Practice Test

GH-500 practice test: what's covered

• CodeQL Code Scanning
• Secret Protection
• Supply Chain Security
• Dependabot
• Security Overview
• GHAS Admin
• DevSecOps CI/CD

Free GH-500 sample questions

1. An organization is mapping the GitHub security feature set. They need the feature that scans the source code of a repository for vulnerabilities such as SQL injection and path traversal using static analysis. Which GitHub Advanced Security feature does this?

   • A. Code scanning (Code Security)
   • B. Secret scanning (Secret Protection)
   • C. Dependabot alerts
   • D. Push protection
   Show answer

   Correct: A. Code scanning, part of Code Security, runs static analysis (CodeQL or third-party SARIF tools) over the source to find vulnerabilities and coding errors. Secret scanning finds leaked credentials, Dependabot finds vulnerable dependencies, and push protection blocks secrets at push time.

2. A security lead is explaining where GitHub Advanced Security features are available by default versus paid. On GitHub.com, which statement about availability is correct?

   • A. GHAS features (code scanning, secret scanning, Dependabot) are free on public repositories; on private repositories they require a GHAS / GitHub Secret Protection and Code Security license
   • B. All GHAS features require a paid license on both public and private repositories
   • C. GHAS features are free on private repositories but paid on public repositories
   • D. Only GitHub Enterprise Cloud can use any GHAS feature, regardless of repository visibility
   Show answer

   Correct: A. For public repositories the core GHAS features are free. For private/internal repositories they require a license (now sold as GitHub Secret Protection and GitHub Code Security). The other options misstate the public/private split.

3. GitHub recently rebranded the GHAS product into purchasable components. Which two products did the bundled GitHub Advanced Security license split into? (The exam expects the current naming.)

   • A. GitHub Secret Protection and GitHub Code Security
   • B. GitHub Dependabot Pro and GitHub CodeQL Cloud
   • C. GitHub Security Lab and GitHub Sentinel
   • D. GitHub Shield and GitHub Guardian
   Show answer

   Correct: A. GitHub now sells GHAS capabilities as two standalone products: GitHub Secret Protection (secret scanning, push protection) and GitHub Code Security (code scanning, dependency/supply chain features). The other names are not GitHub products.

4. A developer asks where GitHub publishes the curated vulnerability data (CVEs and GitHub-reviewed advisories) that powers Dependabot alerts. Which source does GitHub maintain for this?

   • A. The GitHub Advisory Database
   • B. The npm audit registry
   • C. The NIST NVD mirror only
   • D. The CodeQL query packs
   Show answer

   Correct: A. The GitHub Advisory Database stores GitHub-reviewed and unreviewed security advisories that Dependabot uses to flag vulnerable dependencies. NVD feeds into it, but the curated, ecosystem-mapped source GitHub maintains is the Advisory Database.

5. An admin wants a single place to see the security alert posture (code scanning, secret scanning, Dependabot) across all repositories in the organization, with filters and trends. Which GitHub feature provides this aggregated view?

   • A. The organization-level Security Overview dashboard
   • B. Each repository's individual Security tab only
   • C. The Insights > Traffic graph
   • D. The Actions workflow run summary
   Show answer

   Correct: A. Security Overview aggregates alerts from all three GHAS features across repositories at org (and enterprise) level, with risk and coverage views. Per-repo Security tabs show only one repo; Insights and Actions are unrelated to alert aggregation.

Last updated: 2026-10-19

GH-500 practice test FAQ