Advanced Security (GHAS) (GH-500) is where the exam stops asking “do you know this feature exists” and starts asking “do you understand why it matters.”
You’re covering secret scanning, code scanning, CodeQL, and Dependabot, but the questions aren’t just “where do you enable X.” They’re scenario-based: given this situation, what’s the right security response, and why.
What tripped me up: CodeQL configuration, specifically custom query packs and how scanning gets triggered across different workflows. I understood the concept fine, but translating that understanding into “which config option produces this exact outcome” took real practice, not just reading.
How I prepped: This is where hands-on repos earned their keep. I built a couple of demo repos, deliberately planted a fake secret, misconfigured a scanning workflow, and worked through fixing it properly instead of just reading how it’s supposed to work. I also leaned on AI tools here more than anywhere else asking for realistic “here’s an alert, what do you do” scenarios helped me practice the reasoning, not just the recall.
Who should take it: Anyone in or moving toward AppSec/DevSecOps. If you don’t have a security background, don’t underestimate this one it’s conceptually heavier than it looks on paper.
Resources