GH-500 — GitHub Advanced Security Study Plan
A practical GitHub Advanced Security (GH-500) study plan with 7-day, 14-day, 30-day, and 60/90-day preparation paths.
Study plan orientation
This Study Plan is for candidates preparing for the GitHub Advanced Security (GH-500) exam, exam code GH-500, from GitHub.
Use it to turn your available calendar time into a realistic preparation schedule. The plan assumes you need to understand GitHub Advanced Security features in practical scenarios: how security features are enabled, how alerts are generated and triaged, how repositories and organizations are governed, and how teams use code scanning, secret scanning, and dependency security workflows.
This is an independent study planning guide. Use the current GitHub exam guide and GitHub documentation as your source of truth for the exact objectives.
What to study for GH-500
Organize your study around practical GHAS tasks, not only terminology.
| Study area | What you should be able to explain | What you should practice |
|---|---|---|
| GitHub Advanced Security setup and governance | Where GHAS features are enabled, how repository, organization, and enterprise settings interact, and how permissions affect security administration | Trace who can configure features, dismiss alerts, view security data, and manage repository security settings |
| Code scanning | Default setup vs. advanced setup, CodeQL workflow concepts, third-party tool/SARIF results, alert states, and remediation flow | Read a CodeQL workflow, identify why scans run or fail, interpret an alert, and choose an appropriate remediation path |
| CodeQL concepts | Query suites, language/build considerations, custom queries at a conceptual level, and how CodeQL analysis fits into CI | Match a scanning scenario to a setup approach and recognize when build configuration matters |
| Secret scanning | Secret scanning alerts, push protection concepts, custom or partner patterns at a high level, bypass handling, and remediation workflow | Decide what should happen when a secret is detected in a commit, pull request, or existing repository history |
| Dependency security | Dependency graph, Dependabot alerts, Dependabot security updates, dependency review, vulnerable dependency triage, and supply-chain risk | Distinguish security updates from general version updates and decide how to respond to vulnerable dependency alerts |
| Alert triage and remediation | Alert severity, status, dismissal reasons, ownership, fix validation, and recurring alert patterns | Review missed scenarios and explain why an alert should be fixed, dismissed, assigned, or escalated |
| Repository and organization security posture | Security overview, repository risk prioritization, policies, security configurations, and reporting views | Use scenario questions to decide which setting or report helps a security team find risk fastest |
| Secure development workflow | Pull request security checks, branch and workflow controls, least-privilege automation, and developer remediation behavior | Analyze a CI/CD security scenario and identify the safest GHAS-supported workflow |
Which plan should you use?
| Your situation | Use this path | Typical study time | Main goal |
|---|---|---|---|
| Exam is in 7 days and you have already studied | 7-day final review | 1.5 to 3 hours/day | Find weak areas, drill alerts and workflows, take timed practice |
| Exam is in 7 days and you are starting from scratch | 7-day emergency path | 2.5 to 4 hours/day | Cover only high-yield objectives and consider rescheduling if practice results are unstable |
| Exam is in 2 weeks | 14-day focused plan | 1.5 to 2.5 hours/day | Build exam coverage quickly and leave time for two timed reviews |
| Exam is in about 1 month | 30-day balanced plan | 60 to 120 minutes/day | Learn, practice, review, and improve without cramming |
| Exam is 2 to 3 months away | 60/90-day full path | 4 to 7 hours/week | Build durable hands-on skill and finish with timed exam readiness |
| You work with GitHub daily but not GHAS | 14-day or 30-day plan | Depends on gaps | Convert GitHub familiarity into GHAS-specific exam readiness |
| You are new to GitHub security features | 60/90-day path | 5 to 8 hours/week | Learn concepts, practice workflows, then move into timed practice |
Start with a diagnostic
Do this before you spend days reading.
- Take a short diagnostic practice set or timed quiz.
- Mark every missed or guessed question by objective area.
- Separate knowledge gaps from wording mistakes.
- Build your schedule around the top three weak areas.
- Retest those areas within 48 hours.
| Diagnostic result | What it means | What to do next |
|---|---|---|
| Strong on GitHub basics, weak on GHAS features | You need feature-specific review | Prioritize code scanning, secret scanning, dependency security, and security overview |
| Strong on definitions, weak on scenarios | You are memorizing but not applying | Use scenario drills and explain why each wrong option is wrong |
| Weak on permissions and settings | You may confuse repo, org, and enterprise scope | Create a scope map and review governance scenarios daily |
| Weak on CodeQL/code scanning | You need workflow and alert-lifecycle practice | Review setup modes, workflow anatomy, alert states, and remediation paths |
| Weak on dependency and secret workflows | You need triage practice | Drill “what happens next?” questions for alerts, push protection, and Dependabot |
Daily practice rhythm
Use this rhythm on most study days. Adjust the time blocks, but keep the sequence.
| Time block | Action | Output |
|---|---|---|
| 5 minutes | Review yesterday’s missed-question log | Pick 2 to 3 items to retest |
| 20 to 30 minutes | Study one focused GH-500 objective | Notes in your own words |
| 20 to 40 minutes | Do hands-on or scenario review | One concrete workflow, setting, or alert lifecycle understood |
| 20 to 30 minutes | Answer practice questions | Mark missed, guessed, and slow questions |
| 10 to 20 minutes | Review explanations deeply | Add corrections to your log |
| 5 minutes | Write a closing summary | “I can now explain…” and “I still confuse…” |
If you only have 30 minutes
Use this compressed version:
- 5 minutes: review yesterday’s misses.
- 15 minutes: study one narrow objective.
- 10 minutes: answer and review 5 to 10 targeted questions.
Do not spend the whole session passively reading.
GH-500 hands-on practice map
You do not need a production environment to study effectively. If you use a sandbox repository or organization, avoid real secrets, real customer data, and real production workflows.
| Drill | What to practice | What to be ready to explain |
|---|---|---|
| Code scanning setup review | Compare default setup and workflow-based setup | When each setup is appropriate and what can cause scan coverage gaps |
| CodeQL workflow reading | Identify trigger, permissions, initialization, build, and analysis steps | Why a workflow runs, what it analyzes, and where results appear |
| Alert lifecycle | Follow a code scanning alert from detection to remediation or dismissal | Severity, status, ownership, fix validation, and dismissal reasoning |
| Secret scanning scenario | Walk through a detected secret in a repository or push | What the developer and security team should do next |
| Push protection scenario | Decide how to respond to a blocked push or bypass request | When bypass may be reviewed, rejected, or followed by remediation |
| Dependency alert triage | Review a vulnerable dependency scenario | Difference between dependency alert, security update, and general version update |
| Dependency review | Analyze a pull request that introduces dependency risk | How dependency changes are surfaced before merge |
| Organization security posture | Review security overview-style prioritization | How to identify risky repositories and recurring alert patterns |
| Permissions and roles | Map who can view, configure, dismiss, or manage alerts | Why scope matters: repository vs. organization vs. enterprise |
| Secure automation | Review least-privilege workflow behavior | How Actions permissions and repository controls affect security posture |
7-day final review plan
Use this if your exam is one week away. This is best for candidates who have already completed at least one pass through the material. If you are starting from zero, treat this as an emergency plan and focus on the highest-yield GHAS workflows.
| Day | Focus | Study actions | Output |
|---|---|---|---|
| 1 | Diagnostic and triage | Take a timed or semi-timed diagnostic. Build a missed-question log by area. | Ranked weak-area list |
| 2 | Code scanning and CodeQL | Review setup types, workflow anatomy, CodeQL concepts, SARIF results, and alert lifecycle. Do targeted questions. | Code scanning decision notes |
| 3 | Secret scanning and dependency security | Review secret alerts, push protection, Dependabot alerts, security updates, dependency review, and remediation flow. | Secret/dependency triage notes |
| 4 | Governance, permissions, and security posture | Review repository, organization, and enterprise scope. Drill security overview and policy scenarios. | Scope and permissions map |
| 5 | Full timed mock or large timed set | Take a timed mock. Spend at least the same amount of time reviewing. Stop broad new material after review. | Final weak-area sprint list |
| 6 | Weak-area sprint | Rework missed questions, reread only targeted docs, and explain key workflows aloud. | One-page final review sheet |
| 7 | Light final review | Review notes, alert lifecycles, and common confusions. Avoid heavy new content. | Calm, focused exam readiness |
7-day priorities if time is very limited
If you have less than 90 minutes per day, prioritize in this order:
- Code scanning and CodeQL setup scenarios.
- Secret scanning and push protection workflows.
- Dependabot alerts, security updates, and dependency review.
- Repository, organization, and enterprise scope.
- Alert triage, dismissal, remediation, and reporting.
14-day focused plan
Use this if you have two weeks and can study most days.
| Day | Focus | Primary work |
|---|---|---|
| 1 | Baseline diagnostic | Take a diagnostic set, review every miss, and tag weak areas |
| 2 | GHAS overview and enablement | Review where features are configured and how scope affects behavior |
| 3 | Permissions and governance | Study roles, ownership, alert management, policies, and security posture views |
| 4 | Code scanning setup | Review default setup, advanced setup, workflow structure, and CI triggers |
| 5 | Code scanning alerts | Study alert states, remediation, dismissal, CodeQL concepts, and SARIF-based results |
| 6 | Secret scanning | Review secret detection, alert handling, push protection, and safe remediation |
| 7 | Dependency security | Review dependency graph, Dependabot alerts, security updates, and dependency review |
| 8 | Timed checkpoint | Take a timed mixed set. Review misses by objective area |
| 9 | Repository and organization scenarios | Drill “where should this be configured?” and “who can do this?” questions |
| 10 | Remediation workflows | Practice alert triage, assignment, dismissal, reopening, and fix validation scenarios |
| 11 | CI/CD and workflow security | Review Actions permissions, secure automation behavior, and scanning integration |
| 12 | Full timed mock | Take a full-length or large timed practice exam. Review deeply |
| 13 | Final weak-area repair | Rework missed topics. Build a one-page final sheet |
| 14 | Light review | Review lifecycles, decision rules, and common traps. Do not cram new topics |
30-day balanced plan
Use this if you want a realistic plan with enough time to learn, practice, and correct mistakes.
| Days | Focus | Actions |
|---|---|---|
| 1 to 2 | Orientation and diagnostic | Read the current exam objectives. Take a diagnostic. Create your tracking sheet. |
| 3 to 6 | GHAS foundations | Study feature scope, enablement, repository settings, organization settings, enterprise considerations, and security roles. |
| 7 | Review checkpoint | Do a mixed quiz. Rewrite confusing scope and permission rules. |
| 8 to 12 | Code scanning core | Study setup modes, CodeQL workflow structure, language/build considerations, alert lifecycle, and remediation. |
| 13 to 14 | Code scanning practice | Drill scenario questions and review any hands-on workflow examples. |
| 15 | Midpoint timed set | Take a timed mixed set. Review every miss before moving on. |
| 16 to 18 | Secret scanning | Study secret alerts, push protection, bypass concepts, custom/partner pattern concepts, and remediation. |
| 19 to 21 | Dependency security | Study dependency graph, Dependabot alerts, security updates, dependency review, and vulnerable dependency triage. |
| 22 to 23 | Security posture and reporting | Review security overview, prioritization, ownership, and alert management scenarios. |
| 24 | Full timed mock | Take a full or large timed practice exam. Identify recurring weaknesses. |
| 25 to 27 | Weak-area repair | Relearn the top weak areas. Redo missed questions without looking at explanations first. |
| 28 | Final timed checkpoint | Take a final timed mixed set. Confirm pacing and scenario accuracy. |
| 29 | Final review sheet | Review decision rules, alert lifecycles, and scope maps. Stop adding new broad material. |
| 30 | Light review and readiness | Do a short confidence check, then rest. |
30-day weekly checkpoints
| Week | You should be able to do by the end of the week |
|---|---|
| Week 1 | Explain where GHAS features are enabled and how permissions affect security management |
| Week 2 | Interpret code scanning scenarios and identify appropriate CodeQL setup choices |
| Week 3 | Triage secret scanning and dependency security scenarios |
| Week 4 | Complete timed practice with stable pacing and no repeated major weak area |
60/90-day full preparation path
Use this path if you are starting early, are new to GHAS, or want deeper hands-on confidence.
| Phase | 60-day calendar | 90-day calendar | Focus |
|---|---|---|---|
| Phase 1 | Days 1 to 5 | Days 1 to 7 | Exam objective review, diagnostic, study environment setup, tracking sheet |
| Phase 2 | Days 6 to 14 | Days 8 to 21 | GHAS foundations, governance, permissions, repository and organization scope |
| Phase 3 | Days 15 to 32 | Days 22 to 49 | Code scanning, CodeQL concepts, workflow setup, SARIF, alert lifecycle |
| Phase 4 | Days 33 to 44 | Days 50 to 66 | Secret scanning, push protection, dependency security, Dependabot workflows |
| Phase 5 | Days 45 to 55 | Days 67 to 82 | Security posture, reporting, remediation scenarios, mixed timed practice |
| Phase 6 | Days 56 to 60 | Days 83 to 90 | Final mocks, weak-area repair, final review, exam readiness |
60-day weekly structure
| Week | Main focus | Required practice |
|---|---|---|
| 1 | Baseline and GHAS map | Diagnostic plus objective checklist |
| 2 | Scope, settings, and permissions | Repository vs. organization vs. enterprise scenarios |
| 3 | Code scanning setup | Default setup, advanced setup, workflow anatomy |
| 4 | CodeQL and alert operations | Alert interpretation, remediation, dismissal, SARIF concepts |
| 5 | Secret scanning | Secret alerts, push protection, remediation decisions |
| 6 | Dependency security | Dependabot alerts, security updates, dependency review |
| 7 | Security posture and remediation | Security overview, prioritization, ownership, reporting |
| 8 | Timed exam readiness | Full timed mock, weak-area sprint, final review |
How to use the extra time in a 90-day plan
Do not simply stretch passive reading. Use the extra time for:
- More hands-on review of repository and organization settings.
- More scenario drills on permissions and scope.
- Repeated code scanning workflow interpretation.
- More practice explaining why wrong answers are wrong.
- Weekly mixed quizzes so older topics do not decay.
- One additional timed mock before the final two weeks.
Timed mock exam strategy
Timed practice should measure readiness, not replace learning.
| When | What to take | What to do after |
|---|---|---|
| Start of plan | Short diagnostic | Identify weak areas and avoid studying blindly |
| Middle of plan | Timed mixed set | Test recall across topics and update your study schedule |
| Final 10 to 14 days | Full or large timed mock | Practice pacing and scenario interpretation |
| Final 3 to 5 days | Last major timed set | Confirm readiness and identify final review topics |
| Final 24 hours | No heavy mock unless necessary | Light review only; avoid creating fatigue |
Mock review rules
After every timed set:
- Review missed questions first.
- Review guessed questions second, even if correct.
- Identify the objective area for each miss.
- Write the rule or concept you should have used.
- Redo the missed questions later without the explanation.
- Look for repeated patterns, not isolated trivia.
A mock is useful only if the review changes what you do next.
Missed-question review method
Use a missed-question log throughout your plan. Keep it short enough that you will actually maintain it.
| Field | What to record |
|---|---|
| Date | When you missed it |
| Topic | Code scanning, secret scanning, dependency security, permissions, governance, reporting, or workflow security |
| Error type | Knowledge gap, scope confusion, wording mistake, rushed answer, or weak scenario reasoning |
| Correct rule | The decision rule you should have applied |
| Retest date | When you will answer a similar question again |
| Status | Open, retested, or mastered |
Error types and fixes
| Error type | Example pattern | Fix |
|---|---|---|
| Scope confusion | Mixing repository, organization, and enterprise settings | Create a three-column scope map and review it daily |
| Feature confusion | Mixing secret scanning, dependency review, and code scanning | Write the input, output, and alert type for each feature |
| Alert lifecycle gap | Not knowing what happens after dismissal or remediation | Draw the lifecycle from detection to closure |
| CodeQL workflow gap | Misreading when or how analysis runs | Review workflow triggers, permissions, init, build, and analyze steps |
| Permission gap | Choosing an action for the wrong role or access level | Review who can configure, view, dismiss, or manage each feature |
| Scenario overthinking | Choosing a complex answer when a direct GHAS feature applies | Identify the exact problem before selecting the tool |
Final-week rules
Use these rules during the last week, regardless of which plan you followed.
| Rule | Why it matters |
|---|---|
| Stop broad new material 2 to 3 days before the exam | New topics can reduce confidence without improving score |
| Keep reviewing missed questions | Your log shows the highest-return work |
| Prioritize workflows over definitions | GH-500 scenarios often require choosing the right security action |
| Review scope daily | Many mistakes come from confusing repository, organization, and enterprise behavior |
| Do not run experimental labs the night before | Last-minute configuration surprises can create confusion |
| Practice pacing once, then stop | You need timing confidence, not exhaustion |
| Sleep and logistics count | A tired candidate misreads scenario questions |
Exam-readiness checks
You are closer to ready when you can do the following without notes.
| Readiness check | Can you do it? |
|---|---|
| Explain the main GHAS features and what risk each one addresses | Yes / No |
| Distinguish code scanning, secret scanning, dependency alerts, and dependency review | Yes / No |
| Choose between code scanning setup approaches for a scenario | Yes / No |
| Read a CodeQL workflow conceptually and identify what each major step does | Yes / No |
| Explain how a code scanning alert is triaged, fixed, dismissed, or reopened | Yes / No |
| Respond correctly to a secret scanning or push protection scenario | Yes / No |
| Explain the difference between Dependabot alerts, security updates, and general dependency updates | Yes / No |
| Identify whether a setting or action belongs at repository, organization, or enterprise scope | Yes / No |
| Interpret security posture and prioritization scenarios | Yes / No |
| Finish timed practice without rushing the final questions | Yes / No |
| Explain why wrong answer choices are wrong | Yes / No |
If several answers are “No,” do not add more random study material. Return to your missed-question log and repair the highest-frequency weak areas.
High-yield final review checklist
Use this list during the last few days.
- Code scanning setup options and when each is appropriate.
- CodeQL workflow structure and common reasons scanning may not behave as expected.
- Alert lifecycle: open, fixed, dismissed, reopened, assigned, and reviewed.
- Secret scanning detection, push protection, bypass handling, and remediation.
- Dependency graph, Dependabot alerts, Dependabot security updates, and dependency review.
- Repository vs. organization vs. enterprise scope.
- Permissions and ownership for viewing, configuring, and managing security alerts.
- Security overview and risk prioritization scenarios.
- CI/CD security basics related to GitHub Actions and least-privilege automation.
- Common wording traps from your own missed-question log.
Practical next step
Choose the schedule that matches your exam date, then take a diagnostic practice set before doing more reading. Build your missed-question log on day one, use it to drive each study session, and finish your preparation with timed GH-500 practice plus focused review of your weakest GitHub Advanced Security workflows.