GitHub Advanced Security Practice Exam

What the GitHub Advanced Security exam covers

• GitHub Security Suites, Features, and Ecosystem81 questions
• Secret Protection132 questions
• Supply Chain Security122 questions
• Code Security224 questions
• Security Operations and Remediation125 questions
• GitHub Security Suites Administration93 questions

Free GitHub Advanced Security practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 777.

1. Question 1GitHub Security Suites, Features, and Ecosystem

   While browsing the GitHub Advisory Database, a developer finds an entry describing a package that was found to contain intentionally malicious code rather than an accidental coding flaw. Which advisory category does this describe?

   • AAn unreviewed advisory still awaiting curation before it can be trusted
   • BA malware advisory, typically without a CVSS score, recommending removalCorrect
   • CA withdrawn advisory that GitHub has determined was reported in error
   • DA reviewed vulnerability advisory with a CVSS score and a suggested patch
   ✓ Correct answer: B

   Because there is no legitimate patched version for intentionally malicious code, malware advisories guide users to remove the affected package entirely rather than upgrade. They still receive a GHSA identifier and can trigger Dependabot alerts. GitHub's curation team reviews these reports before they are published to the database.

   Why the other options are wrong

   • AUnreviewed status describes a curation stage, not the malware category itself.
   • CA withdrawn advisory has been retracted, whereas this scenario describes an actively listed entry.
   • DA standard vulnerability advisory assumes an accidental flaw with a fix version, which does not match intentionally malicious code.
2. Question 2Secret Protection

   An engineer at Stark Industries answers a community question in GitHub Discussions and accidentally pastes a real signing key as an example. Does secret scanning check discussion posts?

   • ANo, discussions are a community feature and fall outside secret scanning
   • BYes, but only for discussions marked as answered by a maintainer
   • CNo, only the discussion title is scanned, not the post body
   • DYes, discussion posts and comments are covered by secret scanningCorrect
   ✓ Correct answer: D

   GitHub Discussions content, including the body of posts and their comments, is checked by secret scanning alongside issues, pull requests, and wikis. Marking a discussion as answered has no bearing on whether it was scanned. The check applies to the full post text, not merely the title.

   Why the other options are wrong

   • ADiscussions are one of the additional surfaces secret scanning covers, not an excluded feature.
   • BWhether a discussion is marked answered does not affect whether its content was already scanned.
   • CScanning covers the full body of a post and its comments, not just the title.
3. Question 3Secret Protection

   An engineer at Atlas Manufacturing edits a configuration file directly in the GitHub web interface and clicks commit changes. Push protection detects a secret in the new content. What happens next?

   • AThe file becomes locked from further edits until an administrator clears it
   • BThe commit is blocked, with the secret underlined for reviewCorrect
   • CThe commit completes right away, and a warning email follows afterward
   • DThe edit is discarded silently, with no message shown to the engineer
   ✓ Correct answer: B

   Just as with the command line, the web interface stops the commit from completing when a supported secret is detected, and it underlines the flagged text within the file so the engineer can find it quickly. The engineer can then remove the secret or, if permitted, choose a bypass reason to proceed.

   Why the other options are wrong

   • AThe file itself is not locked from future edits, the block applies to the specific commit attempt containing the secret.
   • CThe commit does not complete first, push protection intervenes before the change is committed, not after.
   • DThe engineer is shown a clear message identifying the secret, the edit is not silently dropped without explanation.
4. Question 4Supply Chain Security

   A Dependabot pull request has rebase-strategy set to disabled and now shows a merge conflict after the target branch moved forward. What must a maintainer do to get Dependabot to update the branch?

   • AComment @dependabot merge on the pull request
   • BWait for the next scheduled version update run
   • CComment @dependabot rebase on the pull requestCorrect
   • DClose and immediately reopen the pull request manually
   ✓ Correct answer: C

   With rebase-strategy set to disabled, Dependabot no longer rebases pull requests on its own when the target branch changes, so a maintainer has to explicitly request it with the rebase command. Merging, manually reopening, or waiting for the next scheduled run does not resolve the existing conflict on that pull request.

   Why the other options are wrong

   • AThe merge command attempts to merge the pull request, it does not resolve an existing conflict first.
   • BThe next scheduled run checks for new versions, it does not automatically rebase an existing conflicted pull request when rebasing is disabled.
   • DManually closing and reopening the pull request does not refresh its branch against the latest target branch commits.
5. Question 5Code SecuritySelect all that apply

   A CodeQL analysis of a very large C++ codebase keeps running out of memory on a self-hosted runner. Which two changes would directly help avoid this? (Choose two)

   • AAdd additional third-party vendor directories to paths
   • BMove the workflow to a machine or runner with more physical RAMCorrect
   • CSet disable-default-queries to false
   • DIncrease the query suite from default to security-and-quality
   • ESet the ram input to an explicit safe value based on available memoryCorrect
   ✓ Correct answer: B, E

   Setting ram lets CodeQL allocate memory appropriately for the available hardware, and moving to a machine with more physical RAM increases the ceiling before exhaustion occurs. Adding more source to paths, expanding the query suite, or toggling disable-default-queries would each increase resource demand or have no effect rather than reduce memory pressure.

   Why the other options are wrong

   • AAdding more directories to paths increases the amount of code analyzed, which raises rather than lowers memory pressure.
   • Cdisable-default-queries set to false is the existing default behavior and does not change memory usage during analysis.
   • DExpanding to a broader query suite increases the amount of query evaluation work, which raises rather than lowers memory pressure.
6. Question 6Code SecuritySelect all that apply

   An engineer at Proseware is explaining alert deduplication behavior across branches to a new team member. Choose two accurate statements about how this works.

   • AWhen the same fingerprint is found on more than one monitored branch, it is tracked as one alert with a list of affected branches.Correct
   • BGitHub computes a fingerprint from the rule and code location to recognize the same finding across analyses.Correct
   • CEvery branch that is analyzed always receives its own independently numbered alert for the same code.
   • DAn administrator must manually flag two alerts as duplicates before they are combined.
   • EDeduplication only applies if the two branches were created on the exact same calendar day.
   ✓ Correct answer: A, B

   This automatic process avoids flooding the alert list with duplicate entries for code that exists identically in more than one place. It happens without any manual flagging step and is not tied to the branches sharing a creation date.

   Why the other options are wrong

   • CIndependently numbered alerts per branch would defeat the purpose of fingerprint based deduplication.
   • DNo manual administrator action is needed, the matching and merging into one alert record is automatic.
   • EFingerprint matching does not depend on when the branches were created.
7. Question 7Code Security

   While iterating on a new query, an author highlights a single predicate in the middle of a ql file and wants to see its intermediate results against the open database without running the entire query. Which VS Code CodeQL feature is designed for this?

   • AQuick EvaluationCorrect
   • BCodeQL Test Explorer
   • CThe query history comparison view
   • DThe AST viewer
   ✓ Correct answer: A

   Quick Evaluation lets a query author select a portion of a query, such as one predicate, and see its intermediate results against the currently open database, which is much faster than running the full query while iterating on logic. The AST viewer shows a file's parsed syntax tree rather than predicate results, the Test Explorer runs saved test cases, and the history comparison view compares full past runs rather than partial expressions.

   Why the other options are wrong

   • BCodeQL Test Explorer runs and reports on saved query test cases rather than evaluating an arbitrary highlighted expression.
   • CThe query history comparison view compares results between previously completed full runs, not a partial in progress expression.
   • DThe AST viewer shows a source file's parsed syntax tree, it does not evaluate a highlighted predicate's results.
8. Question 8Security Operations and RemediationSelect all that apply

   A platform team is hardening how their organization's webhooks for security alert events are configured, given that the receiving endpoint will be reachable over the public internet. Choose three practices that meaningfully strengthen the webhook's security posture.

   • ADisabling the webhook secret to simplify parsing
   • BMaking the receiving URL obscure as the sole defense
   • CVerifying the HMAC signature with a strong secretCorrect
   • DValidating and sanitizing the payload before useCorrect
   • ERequiring TLS on the receiving endpointCorrect
   ✓ Correct answer: C, D, E

   Signature verification confirms the request truly came from GitHub and was not tampered with, TLS protects the payload from interception in transit, and input validation prevents malformed or unexpected payload content from causing downstream issues in systems that consume it. Relying only on an obscure URL verifies nothing about authenticity, and disabling the webhook secret removes the primary mechanism for verifying requests.

   Why the other options are wrong

   • ADisabling the webhook secret removes the ability to verify signatures at all, trading away the primary authenticity control for simpler code.
   • BAn obscure URL might reduce casual discovery, but it verifies nothing about a request's authenticity and should not be relied on as the actual protection.
9. Question 9Code Security

   Before onboarding a very large repository to CodeQL scanning, an administrator wants to estimate the memory the analysis will need. Which factor most influences the memory required for the CodeQL extraction and analysis phases?

   • AThe size and complexity of the codebase being scannedCorrect
   • BThe number of open issues currently tracked inside the repository overall
   • CThe choice of default branch name currently used by the repository
   • DThe number of collaborators who currently have write access to the repo
   ✓ Correct answer: A

   Larger and more complex codebases, especially compiled ones that CodeQL must instrument during the build, drive up the memory required for extraction and later analysis. Collaborator counts, default branch naming, and open issue counts have no bearing on the computational resources a scan needs.

   Why the other options are wrong

   • BOpen issue counts reflect project activity tracking, not the size or complexity of the code being scanned.
   • CDefault branch naming is a cosmetic configuration choice with no effect on memory usage during analysis.
   • DThe number of collaborators with write access is an access control detail unrelated to scan resource needs.
10. Question 10Security Operations and Remediation

    Reviewing push protection metrics, a security lead sees that most bypasses in the last month were categorized under a reason indicating the secret was used only in tests. What does this metric primarily help her do?

    • APermanently disable push protection for every repository associated with that bypass reason
    • BAutomatically block any future push that selects that same bypass reason going forward
    • CRevoke the credentials that triggered each of those bypassed pushes automatically
    • DUnderstand common bypass justifications to judge whether tuning or guidance is neededCorrect
    ✓ Correct answer: D

    Push protection metrics break down bypasses by the reason selected, and a pattern dominated by a test value justification suggests the detection pattern may be too broad for test fixtures, or that developers need clearer guidance on using dedicated test secret conventions. This is informational and does not itself take automated action like blocking future pushes, disabling protection, or revoking credentials, which would require separate deliberate steps.

    Why the other options are wrong

    • AReviewing bypass reasons does not itself disable push protection anywhere; that would be a separate manual configuration change.
    • BThe metrics view reports patterns for human review, it does not automatically block future pushes based on a chosen bypass reason.
    • CCredential revocation is a separate remediation action that metrics reporting does not perform automatically.

Who this GitHub Advanced Security practice exam is for

This practice set is for anyone preparing for the GitHub Advanced Security exam at the advanced level - from first-time candidates building a foundation to experienced GitHub practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this GitHub Advanced Security practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real GitHub Advanced Security exam.

Related GitHub resources

• GitHub Advanced Security study guideKey concepts
• GitHub practice examsAll GitHub
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• GitHub Copilot practice examRelated
• GitHub Enterprise Administrator practice examRelated
• GitHub Foundations practice examRelated

GitHub Advanced Security practice exam FAQ