GitHub Advanced Security certification: GH-500 exam, domains and renewal

What is the GitHub Advanced Security certification?

The GitHub Advanced Security certification — often shortened to GHAS — is one of GitHub’s five certifications, next to Foundations, Actions, Administration and Copilot. It is earned with a single exam, GH-500, and GitHub lists vulnerability identification, workflow security and security implementation as its subject.

Microsoft Learn now carries the certification page and the study guide. It rates the exam as intermediate and describes the candidate as someone who uses GitHub Advanced Security to secure code, secrets and dependencies across the software development lifecycle: configuring the security features, triaging and remediating alerts, and applying prevention-first practices with policies, workflows and automation.

The roles Microsoft lists are administrator, developer, DevOps engineer, solution architect and student. In practice that means the person who turns the security features on and keeps the alert queue under control — not a penetration tester.

Source: Microsoft Learn — GitHub Advanced Security certification. Checked 8 October 2026.

How much does the GitHub Advanced Security certification cost?

Microsoft Learn does not print a USD amount for GH-500. It states that the price is based on the country or region in which the exam is proctored, so you see the binding figure when you schedule with Pearson VUE.

If you fail, you can retake the exam 24 hours after the first attempt; for later retakes the waiting time varies. Microsoft does not state a separate retake price on the page. GitHub notes that a missed appointment forfeits the exam fee without refund.

One cost detail is specific to the renewal transition: holders whose GitHub certification has already expired can contact GitHub, which says it will provide one exam voucher to cover the first renewal attempt.

Source: Microsoft Learn — GitHub Advanced Security certification. Checked 8 October 2026.

What is the GitHub Advanced Security exam format?

GH-500 is proctored and lasts 100 minutes. Microsoft says you “may have interactive components to complete as part of this exam”, so expect more than plain multiple choice, and it offers an exam sandbox to try the interface beforehand.

You book through Pearson VUE and choose an online exam or a local test centre, no more than 90 days ahead. GitHub requires a valid, unexpired government-issued ID with your name, photo and signature, and the registration name must match it exactly.

The exam is available in English, Spanish, Portuguese (Brazil), Korean and Japanese. Neither GitHub nor Microsoft publishes a question count for GH-500.

Source: GitHub Docs — Registering for a GitHub Certifications exam. Checked 8 October 2026.

GitHub Advanced Security certification passing score

The GH-500 study guide states that a score of 700 or greater is required to pass. It is a scaled score, so it is not 70 per cent of the questions, and it does not convert into a fixed number of correct answers — especially as the question count is not published.

For preparation, that means no domain can be written off. The two smallest domains still carry 10 to 15 per cent each, and with scaled scoring you do not know in advance how many items any one weak area will cost you.

Source: Microsoft Learn — Study guide for Exam GH-500. Checked 8 October 2026.

What is on the GitHub Advanced Security exam?

Microsoft publishes six domains with weightings, listed as skills measured as of July 2026. The study guide’s change log says the exam changed significantly that month: objectives were added and removed, some moved between groups, and all were reworded.

Note the product names. The domains use GitHub’s current names — Secret Protection and Code Security — with the older names (secret scanning, Dependabot and Dependency Review, code scanning with CodeQL) in brackets. Material that only uses the old names was most likely written against the pre-July outline.

• Describe GitHub Security suites, features, and ecosystem — 15–20%
• Configure and use Secret Protection (formerly secret scanning) — 15–20%
• Configure and use supply chain security (formerly Dependabot/Dependency Review) — 15–20%
• Configure and use Code Security (formerly Code Scanning with CodeQL) — 10–15%
• Security operations: best practices, prioritization, and remediation — 15–20%
• GitHub Security suites administration — 10–15%

Source: Microsoft Learn — Study guide for Exam GH-500. Checked 8 October 2026.

GitHub Advanced Security certification prerequisites

Microsoft lists no formal prerequisite for GH-500 — no earlier GitHub exam and no required course.

The audience profile does set expectations: hands-on experience with GitHub Advanced Security, and familiarity with GitHub fundamentals, CI/CD and secure development concepts. Without access to an organisation where these features are switched on, the configuration and administration domains are hard to learn from reading alone.

Source: Microsoft Learn — GitHub Advanced Security certification. Checked 8 October 2026.

How long is the GitHub Advanced Security certification valid?

GitHub certifications are valid for two years, according to Microsoft Learn. GitHub is moving to Microsoft’s recertification process, which will let holders maintain the certification without retaking the full exam; the page gives no date for the switch.

Until then, GitHub certifications that would expire before the new process is available are extended by six months. If yours has already expired, Microsoft Learn says to contact GitHub for one exam voucher covering the first renewal attempt.

Source: Microsoft Learn — GitHub Advanced Security certification. Checked 8 October 2026.

GitHub Advanced Security study materials and training

Start with the GH-500 study guide: it is the only document that carries the current domains, weightings and the July 2026 change log.

For training, Microsoft points to two self-paced learning paths on Microsoft Learn, GitHub Advanced Security Part 1 and Part 2, with instructor-led courses as the alternative. The study guide also links GitHub documentation for each area: the GHAS features, secret scanning, Dependabot and Dependency Review, code scanning with CodeQL, and best practices for acting on results.

Because the exam was reworded in July 2026, treat the learning paths and docs as the reference for how features work, and the study guide as the reference for what is examined.

Source: Microsoft Learn — Study guide for Exam GH-500. Checked 8 October 2026.

GitHub Advanced Security vs GitHub Actions certification

Both are intermediate GitHub exams of 100 minutes, in the same five languages, booked the same way through Pearson VUE. GH-500 is about the security of what you build: secrets, dependencies and code. GH-200, the GitHub Actions exam, is about automation: writing, consuming and managing workflows and actions.

They meet in one place. Security operations and administration in GH-500 rely on policies, workflows and automation, and GH-200 has its own security area for the pipeline itself. If your job is running the security tooling, GH-500 is the closer match; if you own the pipelines, GH-200 is.

Source: GitHub Docs — About GitHub Certifications. Checked 8 October 2026.

GitHub Advanced Security practice questions

Certsqill’s GitHub Advanced Security practice questions are expert-developed, with an explanation for every option, built against the July 2026 domains and weighted the way Microsoft weights GH-500.

GH-500 questions people ask

What exam is the GitHub Advanced Security certification?

GH-500, listed on Microsoft Learn and booked through Pearson VUE. Source: Microsoft Learn, checked 8 October 2026.

How long is the GH-500 exam?

100 minutes. No question count is published. Source: Microsoft Learn, checked 8 October 2026.

What is the GH-500 passing score?

700 or greater, on a scaled score. Source: Microsoft Learn GH-500 study guide, checked 8 October 2026.

How much does GH-500 cost?

No USD price is printed; the price is based on the country or region where the exam is proctored. Source: Microsoft Learn, checked 8 October 2026.

Did the GH-500 exam change recently?

Yes. The study guide says it changed significantly in July 2026, with objectives added, removed, regrouped and reworded. Source: Microsoft Learn, checked 8 October 2026.

What does GHAS stand for?

GitHub Advanced Security — the abbreviation Microsoft uses in the GH-500 audience profile.

Does the GitHub Advanced Security certification expire?

Yes, after two years. Certifications expiring before Microsoft’s recertification process is available are extended by six months. Source: Microsoft Learn, checked 8 October 2026.

Are there prerequisites for GH-500?

Microsoft lists none, checked 8 October 2026. It expects hands-on GHAS experience and familiarity with GitHub fundamentals and CI/CD.