Microsoft GH-500: GitHub Advanced Security

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Configure and use code scanning

   A team wants to find SQL injection and other vulnerabilities in its Python and JavaScript code automatically on every pull request. Which feature should be configured?

   1. ASecret scanning custom patterns defined per repository
   2. BOrganization audit log streaming to a SIEM destination
   3. CDependabot alerts for vulnerable dependency versions
   4. DCode scanning with CodeQL default or advanced setup
   Show answer and explanationHide answer

   Correct answer: D

   CodeQL-based code scanning analyzes source code for vulnerabilities and can run on pull requests. Dependabot checks dependencies, secret scanning finds credentials, and audit logs record administrative events.

2. Question 2Manage security for an organization

   An organization wants all new repositories to have Advanced Security features enabled automatically. Which approach implements this?

   1. AConfiguring code security settings at the organization level with defaults for new repositories
   2. BAsking developers to enable features on new repositories when they remember to do so
   3. CEnabling features manually on each repository after creation via its security settings page
   4. DDisabling features for new repositories by default to reduce configuration overhead
   Show answer and explanationHide answer

   Correct answer: A

   Organization-level code security configurations can apply defaults to new repositories, which keeps coverage consistent. Manual or memory-based enabling leaves gaps, and disabling defaults works against the goal.

3. Question 3Configure and use dependency management

   A project depends on a library that has a published high-severity vulnerability with a fixed version available. Which GitHub feature alerts maintainers and identifies the fix?

   1. ACode scanning default setup for C++ to flag risky coding patterns
   2. BBranch protection rules with required status checks
   3. CSecret scanning push protection on new commits
   4. DDependabot security alerts for vulnerable dependencies
   Show answer and explanationHide answer

   Correct answer: D

   Dependabot security alerts identify vulnerable dependencies and show the patched version when one exists. Secret scanning finds credentials, code scanning analyzes code patterns, and branch protection controls merges.

4. Question 4Configure and use secret scanning

   A developer accidentally commits an AWS access key to a repository. Which GitHub feature stops the push before the secret reaches the remote?

   1. APush protection in secret scanning
   2. BBranch protection requiring two reviews
   3. CDependabot version updates
   4. DCodeQL default setup
   Show answer and explanationHide answer

   Correct answer: A

   Push protection blocks commits that contain detected secrets before they reach the repository. Dependabot and CodeQL analyze dependencies and code after the push, and review rules do not inspect for secrets.

5. Question 5Configure and use code scanning

   Which format does code scanning use to upload analysis results from third-party tools to GitHub?

   1. ACSV only
   2. BSARIF
   3. CPDF reports
   4. DJPEG screenshots
   Show answer and explanationHide answer

   Correct answer: B

   SARIF is the Static Analysis Results Interchange Format that code scanning accepts from external tools. CSV and PDF are not the upload format, and screenshots carry no structured results.