GitHub Advanced Security (GH-500) Full-Length Practice Test
Sixty questions on a 100-minute clock. Ten complete sets aligned to the six GH-500 skill areas Microsoft revised in July 2026, with a 700 pass line on the 1–1000 technical-exam scale.
- 60 questions / 100 min
- 1–1000 scaled result
- 700 pass line
- 4 Select TWO per test
- 6 current skill areas
Choose how many practice tests you want
Every option uses the same 60-question format, the same 100-minute clock, and the same six-area blueprint. Pick one set or work through the full bank.
One test
60 questions
One complete GH-500 practice test
- 60 questions under a 100-minute clock
- 56 single-answer and 4 Select TWO questions
- All six GH-500 skill areas
- Explanation on every question
All 10 tests
600 questions
Ten full-length sets for repeated timed practice
- 600 questions across ten complete sets
- The same six-area distribution in every set
- Forty Select TWO questions across the pack
- Use later tests to check whether weak areas are moving
Five tests
300 questions
Five complete GH-500 practice tests
- 300 questions across five sets
- 100 minutes available in every test
- All six current GH-500 skill areas
- Explanations included throughout
One payment. No Subscription.
What Microsoft currently publishes for GH-500
The exam objectives changed significantly in July 2026. These practice tests use that six-area version rather than the older GHAS blueprint.
| Exam code | GH-500 |
| Level | Intermediate |
| Assessment time | 100 minutes |
| Passing score | 700 or greater |
| Technical exam scale | 1–1000 |
| Skill areas | 6 |
| Objectives version | July 2026 |
| Delivery | Pearson VUE, proctored |
| Languages | English, Spanish, Portuguese (Brazil), Korean, Japanese |
| US-region exam price | $99 USD |
| Certification validity | 2 years |
Written to the current objectives
GH-500 now separates Secret Protection, supply chain security, Code Security, security operations, administration, and the wider GitHub security ecosystem into six measured areas. The July 2026 revision also refreshed the terminology around GitHub’s security suites.
The practice bank follows those current headings. Every 60-question set uses an 11 / 11 / 11 / 8 / 11 / 8 distribution, keeping each area inside Microsoft’s published percentage range.
The questions are original and scenario-led. Expect configuration choices, alert triage, secure workflow decisions, policy trade-offs, and practical GitHub security administration rather than a list of definitions.
One hundred minutes to make sixty security decisions
GH-500 rewards people who can choose the right GitHub control in context. The clock matters, but the harder part is separating a merely reasonable answer from the one that best fits the requirement.
How it's built
- 60 questions in each full-length test
- 100-minute timer
- 56 single-answer questions
- 4 clearly marked Select TWO questions
- Six skill areas at the same distribution in every set
Under the clock
- About 1 minute 40 seconds available per practice question
- Read the requirement before the GitHub feature names
- Watch for scope: repository, organization, enterprise, or workflow
- Treat prevention, detection, and remediation as different jobs
- Do not let one CodeQL or policy question consume the section
What comes back
- Practice result on a 1–1000 scaled model
- 700 used as the pass line
- Explanation on every question
- Skill-area breakdown to show where the misses are clustering
A real question from the GH-500 bank
The useful part is not spotting OIDC. It is seeing why key rotation still loses once the requirement asks for short-lived credentials and an approval boundary.
A deployment workflow currently stores a long-lived cloud access key in repository secrets, and production jobs can read that key as soon as they start. The platform team wants to reduce credential lifetime and add an approval boundary before production credentials become usable. Which TWO changes BEST strengthen the workflow?
- AUse GitHub Actions OIDC to exchange workload identity for short-lived cloud credentials
- BPlace production access behind a protected environment that must pass its deployment protection rules
- CKeep the long-lived cloud key in repository secrets and rotate it on a fixed calendar
- DCommit an encrypted copy of the cloud credential so secret scanning can monitor changes
Why A and B
OIDC removes the need to keep a long-lived cloud credential in GitHub, while a protected environment can gate production access until its deployment rules are satisfied.
Why C is the tempting one
Rotation helps operational hygiene, so it sounds responsible. It still leaves a long-lived repository secret in place and does not create the same short-lived federation or approval boundary.
D puts credential material into the repository. Encryption does not turn that into the prevention-first design the scenario asks for.
Correct answer: A and B.
Six GH-500 skill areas, kept inside the official ranges
Microsoft publishes ranges rather than fixed weights for GH-500. The practice sets use one stable distribution inside those ranges so scores stay comparable from one set to the next.
| Skill area | Microsoft range | Questions per test |
|---|---|---|
| 1. Describe GitHub Security suites, features, and ecosystem | 15–20% | 11 |
| 2. Configure and use Secret Protection | 15–20% | 11 |
| 3. Configure and use supply chain security | 15–20% | 11 |
| 4. Configure and use Code Security | 10–15% | 8 |
| 5. Security operations: best practices, prioritization, and remediation | 15–20% | 11 |
| 6. GitHub Security suites administration | 10–15% | 8 |
All 10 GH-500 full-length practice tests
Each set stands on its own: 60 questions, 100 minutes, the same six-area distribution, and the same single-answer versus Select TWO structure.
About GH-500, and about these practice tests
The GH-500 exam
How long is the GH-500 exam?
Microsoft gives you 100 minutes to complete the GH-500 assessment.
What score do I need to pass GH-500?
A score of 700 or greater is required. Microsoft technical exams use a 1–1000 scaled score, so 700 is a pass line, not a statement that 70% of the questions must be correct.
What does GH-500 cover?
The July 2026 blueprint has six skill areas: GitHub Security suites and ecosystem, Secret Protection, supply chain security, Code Security, security operations, and GitHub Security suites administration.
How much does the GH-500 exam cost?
Microsoft currently lists GH-500 at $99 USD for US-region scheduling. Exam pricing is set from the country or region in which the exam is proctored.
How soon can I retake GH-500 after a failed attempt?
After the first failed attempt, Microsoft requires a 24-hour wait. A 14-day wait applies between later attempts, with no more than five attempts on the same exam within a 12-month period.
How long is the GitHub Advanced Security certification valid?
GitHub certifications are currently valid for two years. GitHub is moving them into Microsoft’s recertification process, and the GH-500 certification page describes the transition.
What languages is GH-500 offered in?
The exam is offered in English, Spanish, Portuguese (Brazil), Korean, and Japanese.
These practice tests
How many questions are in each GH-500 practice test?
Each full-length practice test contains 60 questions and runs on a 100-minute clock.
Do the practice tests follow the July 2026 GH-500 blueprint?
Yes. Every set uses the same six-area distribution: 11, 11, 11, 8, 11, and 8 questions. Each count sits inside Microsoft’s published percentage range for that skill area.
Do the tests include Select TWO questions?
Yes. Each 60-question set contains 56 single-answer questions and four clearly marked Select TWO questions.
Do the questions include explanations?
Yes. Every question includes an explanation so you can review why the correct choice fits the scenario and why a plausible distractor does not.
How are the practice tests scored?
The practice result uses a 1–1000 scaled model with 700 as the pass line, matching the score range and passing standard used for Microsoft technical exams.
What are the pack prices?
One test is $2.49₹99£1.99€2.29. The five-test pack is $5.49₹219£4.29€4.99, and the ten-test pack is $8.99₹399£6.99€8.49.
Ten GH-500 practice tests. 600 questions.
$8.99₹399£6.99€8.49
Work through the same six-area blueprint ten times and see whether Secret Protection, Code Security, supply chain security, and administration are still costing you points when the clock is running.
