GitHub Advanced Security exam-day guide
GitHub Advanced Security · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the exact ID document required by the exam provider. The name on the ID must match the name on your registration. Confirm acceptable ID types and any name-change documentation with the provider before test day.
Exam appointment confirmation
Have your appointment confirmation email or booking reference available. For online proctoring, you may need the session link or check-in code. Confirm the exact check-in process with the provider.
Stable internet connection and backup plan
For online-proctored delivery, use a wired or stable connection and know how to switch to a backup (mobile hotspot). Run the provider's system test at least 24 hours ahead. Confirm minimum bandwidth and supported browsers with the provider.
Working webcam, microphone, and speakers/headset
Online proctoring typically requires a webcam for room scan and continuous monitoring, plus a microphone. Test all devices in advance. Confirm whether external headsets are permitted with the provider.
Compatible computer and browser
Use a supported operating system and browser version. Close all other applications. Confirm the supported OS/browser list and whether a secure browser lock is required with the provider.
Clean, private, well-lit room
Clear your desk of notes, phones, and smart devices unless the provider explicitly allows specific items. Ensure lighting faces you and the room is quiet. Confirm the provider's rules on room scans, cleared surfaces, and allowed materials.
Review the exam's domain outline and task statements
Use the official exam description to map each domain to what you can do in GitHub: secret scanning, code scanning with CodeQL, dependency review and Dependabot, security overview, and security policies. Do not rely on memory of a single practice test.
Hands-on practice with GitHub Advanced Security features
Be able to explain and configure secret scanning (including push protection and custom patterns), code scanning (CodeQL setup, query suites, SARIF upload), Dependabot alerts and security updates, dependency review, and security overview at the organization and enterprise level.
Understand GHAS licensing and enablement boundaries
Know that GitHub Advanced Security features differ between public repositories and private/internal repositories, and that GHAS is licensed per active committer for private repositories. Confirm current licensing terminology and metrics with GitHub documentation, as naming has changed over time.
Practice reading alerts and remediation workflows
Be ready to interpret a code scanning alert (rule, severity, location, data flow), a secret scanning alert (validity, push protection bypass), and a Dependabot alert (severity, patched version, compatibility). Practice triage, dismissal reasons, and assignment.
Confirm break and timing policy
Ask the provider whether breaks are allowed, whether the clock stops, and how to request a break. Do not assume; policies vary by delivery method. Mark as needs_review until confirmed.
Confirm scoring and retake policy
Ask the provider about the passing score, score report timing, and retake waiting period. Do not rely on secondhand claims. Mark as needs_review until confirmed.
Plan the day
Run the provider's system test on the exact computer and network you will use. Update the browser and OS, disable VPNs or proxies that may interfere, and confirm webcam and microphone permissions. Re-read the official exam domain outline and list any domain where you cannot explain the workflow end to end. Spend the remaining study time on those gaps using GitHub Docs and hands-on repositories.
Do a timed practice run using original questions or the official outline, not a commercial question bank. Focus on scenario reasoning: which GHAS feature detects this issue, what configuration is required, and what the remediation path is. Review mistakes by writing the correct workflow in your own words.
Confirm the appointment time, time zone, and check-in window. Verify your ID is valid and the name matches the registration. Prepare the room: clear the desk, remove notes and devices, and plan lighting. Charge devices and test the backup internet option. Get a full night of sleep; avoid cramming new topics.
Do a light review only: the GHAS feature map (secret scanning, code scanning, Dependabot, dependency review, security overview), the difference between alert types, and common configuration steps. Stop studying early enough to rest.
Eat and hydrate before check-in. Start the check-in process early; online proctoring often includes identity verification and a room scan that take time. Close all unnecessary applications, silence phones and notifications, and keep your ID and confirmation within reach. Use the restroom before starting if breaks are not guaranteed.
Read each question fully and identify what is being asked: feature selection, configuration, or remediation. Eliminate options that describe a different GHAS feature or a manual process where automation is expected. Flag uncertain questions and return to them. Manage the clock: if a question takes too long, mark it and move on. If a technical issue occurs, note the time and contact the proctor immediately.
Rules to check
Present the exact government-issued photo ID required by the provider; the name must match your registration. If your legal name differs, confirm acceptable documentation with the provider before test day.
Follow all proctoring instructions, including room scans, showing your desk, and remaining in camera view. Do not communicate with anyone during the exam. Confirm the provider's specific rules on permitted items and environment with the provider.
Do not use unauthorized materials, notes, phones, smart devices, or second screens. Unless the provider explicitly allows a resource, assume it is prohibited. Confirm allowed materials with the provider.
Breaks are not universally guaranteed. Ask the provider in advance whether breaks are permitted, whether the exam clock stops, and how to request one. If breaks are not allowed, plan hydration and restroom use before check-in.
Scoring and passing standards are set by the provider and may change. Do not rely on secondhand claims about passing scores or question counts. Confirm the current scoring policy with the provider.
If a technical failure occurs, stay in view of the camera and contact the proctor or support immediately. Do not attempt to troubleshoot by closing the exam session unless instructed. Confirm the provider's technical-support process in advance.
Retake and rescheduling policies vary. Confirm the waiting period, fees, and rescheduling window with the provider rather than assuming a fixed rule.
Answer based on current GitHub Advanced Security behavior and official documentation. If a question seems to depend on a specific product version or licensing change, choose the answer that reflects the documented default and note the assumption in your reasoning.