What is the GH-500 exam pattern?

GitHub Advanced Security contains 50 questions across 1 section: GH-500 (50 Q). Total duration is 120 minutes (about 144 seconds per question).

Does GH-500 have negative marking?

No — GH-500 has no negative marking. Each correct answer is worth 1 mark, so attempt every question.

How is GH-500 scored?

Scaled score range: 100 to 1000. GH-500 (pass 700/1000).

How can I practise GH-500 online for free?

Wrexa Edge gives you a free full-length GH-500 mock test — with instant scoring, detailed explanations and analytics — plus 49 more with a one-time $1.99 unlock that never expires. Start practising in under a minute, no card required.

How long is the GH-500 exam?

GH-500 runs for 120 minutes total. On Wrexa Edge the timer is enforced exactly as on the real exam — including no inter-section breaks.

What tools or aids are allowed during GH-500?

No special tools are required. Note: real exam is proctored — Wrexa Edge mirrors this with a webcam-based proctoring flow you can enable.

Is the GH-500 test adaptive?

No — GH-500 is a fixed-form (linear) test. Every candidate sees the same number of questions per section.

How many GH-500 mock tests does Wrexa Edge offer?

Wrexa Edge generates 50 distinct GH-500 variants — each with different question content, not just shuffled options — the first one free for everyone and 49 more with a one-time $1.99 unlock. That's 2500 unique practice questions in the real test-day interface.

Is there a free GH-500 test series 2026?

Yes. The Wrexa Edge GH-500 test series for 2026 gives you a free full-length mock test (50 in total) plus subject-wise and topic-wise tests — instant scoring and detailed analysis, no card required.

Are GH-500 previous year question–style papers included?

Every GH-500 mock is modelled on the official exam pattern and the style of previous years' papers — the same 50-question structure, sections and marking — so your practice mirrors the real paper you'll sit.

Which is the best free GH-500 mock test online?

Wrexa Edge's GH-500 mock test replicates the real exam interface, timing and marking scheme, with instant score, section-wise analysis and 50 fresh variants — a strong free choice for 2026 preparation.

Can I take the GH-500 mock test on mobile?

Yes. GH-500 mock tests run in any browser on mobile, tablet or desktop — no app or download needed. Start on your phone and your progress and analytics sync when you sign in.

What is the GH-500 syllabus?

The GH-500 syllabus maps to its 1 section: GH-500 (50 Q). Wrexa Edge's mock tests cover the complete syllabus topic by topic — see the topics-covered breakdown above — so you practise every area at real exam difficulty.

What is the eligibility for GH-500?

Aimed at professionals who use GitHub Advanced Security (GHAS) to secure code, secrets and dependencies; familiarity with GitHub is expected. Wrexa Edge focuses on realistic GH-500 practice: a free full-length mock in the exact exam pattern, ready whenever you are.

When is the GH-500 exam and how should I prepare?

Official GH-500 exam dates are announced by the conducting body for each cycle — check the latest notification for the current schedule. To be ready, follow a phased study plan and take full-length timed mocks; Wrexa Edge gives you a free GH-500 mock with instant scoring so you can track your readiness week by week.

GH-500 Mock Test 2026 — Free Online Practice

GH-500 exam at a glance

Questions

120

Minutes total

Section

Variants

50 full-length mock tests

Attempt 50 full-length mocks

Each is a distinct question set built on the real 50-question, 120-minute pattern, with instant scoring and section-wise analysis. The first is free; unlock all 50 forever for $1.99 (one-time, no subscription).

Mock 1Free Mock 2Full-length Mock 3Full-length Mock 4Full-length Mock 5Full-length Mock 6Full-length Mock 7Full-length Mock 8Full-length Mock 9Full-length Mock 10Full-length Mock 11Full-length Mock 12Full-length Mock 13Full-length Mock 14Full-length Mock 15Full-length Mock 16Full-length Mock 17Full-length Mock 18Full-length Mock 19Full-length Mock 20Full-length Mock 21Full-length Mock 22Full-length Mock 23Full-length Mock 24Full-length Mock 25Full-length Mock 26Full-length Mock 27Full-length Mock 28Full-length Mock 29Full-length Mock 30Full-length Mock 31Full-length Mock 32Full-length Mock 33Full-length Mock 34Full-length Mock 35Full-length Mock 36Full-length Mock 37Full-length Mock 38Full-length Mock 39Full-length Mock 40Full-length Mock 41Full-length Mock 42Full-length Mock 43Full-length Mock 44Full-length Mock 45Full-length Mock 46Full-length Mock 47Full-length Mock 48Full-length Mock 49Full-length Mock 50Full-length

FreeUnlock for $1.99

Unlock all 50 GH-500 tests — $1.99 Start free mock →

GH-500 key facts & eligibility

GH-500 at a glance — verified exam facts
Conducting body	GitHub; delivered via a proctored online exam.
Official website	learn.microsoft.com ↗
Mode	A proctored exam (GH-500) of around 65–75 questions — multiple-choice and multiple-select, some scenario-based — in about 100 minutes.
Frequency	On demand, year-round.
Scoring & marking	Questions cover the GitHub security suite, secret protection (secret scanning), supply-chain security (Dependabot/dependency review), code security (CodeQL code scanning), and security operations. You need roughly 70% to pass.
Score validity	GitHub certifications are valid for 2 years.
Language	English.

Who is eligible for GH-500?

Aimed at professionals who use GitHub Advanced Security (GHAS) to secure code, secrets and dependencies; familiarity with GitHub is expected.

Last verified July 2026 against GitHub Advanced Security — certification. Always confirm current details on the official website before you register.

GH-500 section breakdown

The GH-500 mock test on Wrexa Edge replicates the real exam's section structure — same names, same question count per section, same time limits. No inter-section breaks — the timer runs continuously.

GH-500 (50 Q)

50 questions · 120 minutes · ~144 sec/question

Marking scheme

+1 per correct. Try your score.

+1Correct

0Wrong

0Unanswered

Correct answers 33 Wrong answers 6

Your score0/ 1000

Strategy: GH-500 has no negative marking. Attempt every question — blank answers cost you potential marks but cannot pull your score down.

Scale: GH-500 (pass 700/1000).

How GH-500 is conducted

Mode
Proctored — Wrexa Edge mirrors this with a webcam-based proctoring flow (face detection, room scan, fullscreen lock, tab-switch detection).
Test format
Linear / fixed-form — every candidate sees the same number of questions per section.
Backtracking
Allowed — you can revisit and change answers within a section.
Mark for review
Available — flag tough questions and return to them before submitting the section.

GH-500 time strategy

With 50 questions in 120 minutes, you have about 144 seconds per question on average. Successful candidates aim for the following pacing on each section:

GH-500 (50 Q)
Target ~144 sec/question. If a question takes more than 216 seconds, mark for review and move on.

Wrexa Edge's analytics show your actual time-per-question after every mock so you can spot which sections you're losing time on.

GH-500 topics covered

Across the 50 Wrexa Edge variants of GH-500, the following topics appear most often (sample distribution from one variant):

GH-500 (50 Q)

GH-500 — Code Scanning with CodeQL · 10
GH-500 — Secret Scanning · 10
GH-500 — Dependabot · 10
GH-500 — Security Policies · 4
GH-500 — Alert Triage · 4
GH-500 — GHAS Features & Licensing · 4
GH-500 — Roles & Permissions · 3
GH-500 — Remediation Workflows · 3

GH-500 difficulty calibration

Advanced tier. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep.

GH-500 · ~75 Q in 120m. Configure & use GitHub Advanced Security — code scanning (CodeQL), secret scanning, dependency review/Dependabot, security overview. · Official language: English.

Verified content — Wrexa Edge's GH-500 bank has been deeply curated with real exam-aligned content (estimated 100% syllabus coverage).

How Wrexa Edge prepares you for GH-500

Real test-day interface
Our cert skin mirrors the actual GH-500 testing software — same timer, palette, tools, and navigation.
50 distinct variants
2500 unique practice questions, each variant a fresh test — not just shuffled options.
Detailed analytics
Scaled score, section accuracy, topic-wise heatmap, time-per-question — see where to focus after every attempt.
Spaced repetition (Notebook)
Wrong answers and flagged questions flow into an SM-2 spaced-repetition deck so you actually retain what you learn.
Optional proctoring
Browser-based face-api detection (no install) — turn it on to simulate real GH-500 test-day conditions.
Free to start
No credit card. Sign up, pick a variant, and your first GH-500 mock starts in under a minute.

Expert take: what GH-500 really tests

GH-500 certifies GitHub Advanced Security (GHAS) skills, and it is a practical, tool-specific exam: secret scanning (secret protection), Dependabot and dependency review (supply-chain security), and CodeQL code scanning are the core, plus the operations side of triaging and remediating alerts. Because it maps to features you configure, enabling GHAS on a real repository teaches far more than reading — and the certification is valid two years.

Preparation tips

Enable GHAS on a test repo — secret scanning, Dependabot and CodeQL — hands-on.
Understand each pillar: secret protection, supply-chain security, and code scanning.
Study the operations side — prioritising and remediating alerts.

Common mistakes to avoid

Learning GHAS concepts without ever configuring the features on a repository.
Neglecting CodeQL code scanning, a core and testable part of the exam.

GH-500 study plan

A phase-by-phase roadmap from your first concept to test-ready. Stretch or compress each phase to fit the time you have before your attempt.

1 Phase 1 — GHAS overview & secrets Weeks 1–2

Learn the GitHub security suite and where each feature fits
Study secret protection (secret scanning) and push protection
Enable GHAS features on a test repository hands-on

2 Phase 2 — Supply chain & code scanning Weeks 3–4

Learn supply-chain security — Dependabot and dependency review
Study code security with CodeQL code scanning and custom queries
Practise triaging and remediating alerts

3 Phase 3 — Operations & practice Final week

Study security operations — prioritisation and remediation best practices
Take practice exams; aim comfortably above ~70%
Re-drill CodeQL and secret-scanning configuration in a repo

Where GH-500 can take you

A strong GH-500 result opens up these careers and higher-study paths:

Application security engineer
GH-500 validates securing code, secrets and dependencies with GHAS.
DevSecOps engineer
Code and supply-chain scanning skills fit DevSecOps pipelines.
Security-minded developer
It helps developers build secure software with GitHub-native tooling.
Platform / security operations
GHAS administration supports security-operations and platform roles.

Best books & official prep for GH-500

GitHub Advanced Security learning path (Microsoft Learn) — GitHub / Microsoft
The free official study path for GH-500.
GitHub Advanced Security documentation — GitHub
The authoritative reference for code, secret and supply-chain scanning.
GH-500 practice exams — Various
Benchmark readiness against the domains.
Hands-on GHAS (CodeQL) — Self-made
Enabling code and secret scanning on a repo cements the concepts.

Official practice: GitHub provides a free learning path and documentation; hands-on experience enabling CodeQL, secret scanning and Dependabot is the best preparation.

Previous-year papers: GitHub does not release past exams; the learning path and reputable practice tests are the best preparation.

Sample GH-500 practice questions

5 questions taken from the GH-500 mock tests on Wrexa Edge. Try each one, then reveal the answer.

GH-500 (50 Q) · GH-500 — Security Policies

Q1. Where should a project publish instructions for reporting vulnerabilities privately?
1. In the dependabot.yml configuration
2. In the CODEOWNERS file at the root
3. In a .gitattributes file in .github
4. In a SECURITY.md security policy file
Show answer

Answer: D — In a SECURITY.md security policy file

SECURITY.md defines the security policy shown on the repository Security tab.
GH-500 (50 Q) · GH-500 — Roles & Permissions

Q2. Which role can view secret scanning alerts for a repository by default?
1. Admins and org owners, plus users or teams granted alert access
2. Every user with read access, including anonymous viewers of public repos
3. Only the developer whose commit contained the leaked secret
4. Only enterprise billing managers who pay for the GHAS seats
Show answer

Answer: A — Admins and org owners, plus users or teams granted alert access

Secret scanning alerts are restricted to admins, org owners, security managers, and explicitly granted users.
GH-500 (50 Q) · GH-500 — Code Scanning with CodeQL

Q3. A company runs Jenkins and wants CodeQL analysis without using GitHub Actions. What should they use?
1. The dependency review action running inside a Jenkins container
2. The CodeQL CLI to create a database, analyze it, and upload SARIF
3. Secret scanning custom patterns triggered by a Jenkins webhook
4. Dependabot version updates configured with a Jenkins schedule
Show answer

Answer: B — The CodeQL CLI to create a database, analyze it, and upload SARIF

The CodeQL CLI supports database create, database analyze, and github upload-results in external CI.
GH-500 (50 Q) · GH-500 — Secret Scanning

Q4. An organization wants to stop secrets from ever reaching the remote repository during a git push. Which feature should be enabled?
1. Validity checks
2. Dependency review
3. Push protection
4. Branch protection
Show answer

Answer: C — Push protection

Push protection blocks pushes containing supported secrets before they land in the repository.
GH-500 (50 Q) · GH-500 — Roles & Permissions

Q5. Which repository role is required to see Dependabot alerts by default?
1. Read access, since alerts are visible to anyone who can clone
2. Triage access only, since alerts are treated as issues
3. Billing manager, since alerts consume Advanced Security seats
4. Write access or higher, plus users granted alert access
Show answer

Answer: D — Write access or higher, plus users granted alert access

Dependabot alerts are visible to users with write, maintain, or admin access, plus granted users.

Frequently asked questions

What is the GH-500 exam pattern?: GitHub Advanced Security contains 50 questions across 1 section: GH-500 (50 Q). Total duration is 120 minutes (about 144 seconds per question).
Does GH-500 have negative marking?: No — GH-500 has no negative marking. Each correct answer is worth 1 mark, so attempt every question.
How is GH-500 scored?: Scaled score range: 100 to 1000. GH-500 (pass 700/1000).
How can I practise GH-500 online for free?: Wrexa Edge gives you a free full-length GH-500 mock test — with instant scoring, detailed explanations and analytics — plus 49 more with a one-time $1.99 unlock that never expires. Start practising in under a minute, no card required.
What is the difficulty level of GH-500?: GH-500 is rated Advanced difficulty on Wrexa Edge. Advanced-level: high-stakes exam with rigorous content depth. Expect 4-8 months of structured prep. GH-500 · ~75 Q in 120m. Configure & use GitHub Advanced Security — code scanning (CodeQL), secret scanning, dependency review/Dependabot, security overview. · Official language: English.
How long is the GH-500 exam?: GH-500 runs for 120 minutes total. On Wrexa Edge the timer is enforced exactly as on the real exam — including no inter-section breaks.
What topics are covered in GH-500?: GH-500 is split into: GH-500 (50 Q). Each section is timed and weighted separately. GH-500 · ~75 Q in 120m. Configure & use GitHub Advanced Security — code scanning (CodeQL), secret scanning, dependency review/Dependabot, security overview. · Official language: English.
What tools or aids are allowed during GH-500?: No special tools are required. Note: real exam is proctored — Wrexa Edge mirrors this with a webcam-based proctoring flow you can enable.
Is the GH-500 test adaptive?: No — GH-500 is a fixed-form (linear) test. Every candidate sees the same number of questions per section.
How many GH-500 mock tests does Wrexa Edge offer?: Wrexa Edge generates 50 distinct GH-500 variants — each with different question content, not just shuffled options — the first one free for everyone and 49 more with a one-time $1.99 unlock. That's 2500 unique practice questions in the real test-day interface.
Is there a free GH-500 test series 2026?: Yes. The Wrexa Edge GH-500 test series for 2026 gives you a free full-length mock test (50 in total) plus subject-wise and topic-wise tests — instant scoring and detailed analysis, no card required.
Are GH-500 previous year question–style papers included?: Every GH-500 mock is modelled on the official exam pattern and the style of previous years' papers — the same 50-question structure, sections and marking — so your practice mirrors the real paper you'll sit.
Which is the best free GH-500 mock test online?: Wrexa Edge's GH-500 mock test replicates the real exam interface, timing and marking scheme, with instant score, section-wise analysis and 50 fresh variants — a strong free choice for 2026 preparation.
Can I take the GH-500 mock test on mobile?: Yes. GH-500 mock tests run in any browser on mobile, tablet or desktop — no app or download needed. Start on your phone and your progress and analytics sync when you sign in.
What is the GH-500 syllabus?: The GH-500 syllabus maps to its 1 section: GH-500 (50 Q). Wrexa Edge's mock tests cover the complete syllabus topic by topic — see the topics-covered breakdown above — so you practise every area at real exam difficulty.
What is the eligibility for GH-500?: Aimed at professionals who use GitHub Advanced Security (GHAS) to secure code, secrets and dependencies; familiarity with GitHub is expected. Wrexa Edge focuses on realistic GH-500 practice: a free full-length mock in the exact exam pattern, ready whenever you are.
When is the GH-500 exam and how should I prepare?: Official GH-500 exam dates are announced by the conducting body for each cycle — check the latest notification for the current schedule. To be ready, follow a phased study plan and take full-length timed mocks; Wrexa Edge gives you a free GH-500 mock with instant scoring so you can track your readiness week by week.

Related exams & practice tests

Candidates preparing for GH-500 also practise these on Wrexa Edge:

Browse more: All Tech & IT Certifications exams → · Full exam catalog →

Ready to ace GH-500?

Join thousands of candidates practising on Wrexa Edge. Free signup, 50 variants per exam, instant scoring.

Start practising free →

Wrexa Edge — Mock Tests & ExamsAvailable

Practise on the go — 1,900+ exams with the real interface, timer & marking. 1 free mock each.

Get it onGoogle Play

GH-500 (GitHub Advanced Security) — Free Online Mock Test