GitHub Advanced Security study plan
GitHub Advanced Security · Give each week a clear focus.
8 weeks · About 6 hours per week
GitHub Advanced Security (skills measured per exam study guide)
Map every topic in the official study guide to a personal checklist and rate current confidence 1-5 per topic
Describe how secret scanning, code scanning, and Dependabot differ in what they detect and where alerts surface
Configure a test repository so secret scanning and push protection are enabled, then trigger and resolve a test alert
Explain the difference between a push-protection bypass and an alert dismissal, and who can do each
Your checkpoint
A one-page capability matrix (detector, trigger point, alert location, remediation owner) plus a screenshot-free written log of one triggered and one resolved secret scanning alert
GitHub Advanced Security (skills measured per exam study guide)
Write custom secret scanning patterns and validate them against a test token format
Explain how push protection decides to block versus warn, and list the bypass paths available to developers
Configure code scanning with the default setup and then with an advanced workflow file, noting what changes
Read a code scanning alert's data-flow path and state in one sentence what tainted input reaches what sink
Your checkpoint
A repository with a custom secret pattern and a custom code scanning workflow, plus a written walkthrough of one code scanning data-flow path in your own words
GitHub Advanced Security (skills measured per exam study guide)
Configure Dependabot alerts and security updates, then tune a dependabot.yml for version updates on two ecosystems
Distinguish Dependabot security updates from version updates by trigger, PR author, and scope
Set up dependency review on pull requests and explain which severity threshold blocks a merge
Triage a batch of Dependabot alerts using dismissal reasons and document the reasoning for each
Your checkpoint
A dependabot.yml covering two package ecosystems, an active dependency review rule, and a triage log of at least five alerts with dismissal reasons
GitHub Advanced Security (skills measured per exam study guide)
Explain how the dependency graph is built for supported versus unsupported ecosystems and what that means for alert coverage
Compare CodeQL with third-party SARIF upload by detection model, setup effort, and result parity
Configure a security policy file and describe what it commits the maintainer to
Walk through the private vulnerability reporting flow from reporter submission to advisory publication
Your checkpoint
A written comparison of CodeQL versus SARIF-based scanning and a draft SECURITY.md plus a private vulnerability report rehearsed end to end in a test repo
GitHub Advanced Security (skills measured per exam study guide)
Create a repository security advisory, request a CVE, and explain the difference between a repository advisory and a global advisory
Describe how GHAS licensing is counted and which features are metered per active committer
Configure organization-level security configurations and apply them to a group of repositories
Explain how security overview aggregates risk across repositories and which filters you would use to find the riskiest repos
Your checkpoint
An applied security configuration across at least three repos plus a written summary of how you would use security overview to prioritize remediation for a 50-repo organization
GitHub Advanced Security (skills measured per exam study guide)
Write a CodeQL query pack or customize an existing query suite and explain the metadata fields that matter
Explain how to add a custom query to a code scanning workflow and how query filters select rules
Interpret code scanning severity and security severity scores and how each affects merge blocking
Automate alert export or retrieval using the REST API and paginate results correctly
Your checkpoint
A working custom CodeQL query included in a scanning workflow plus a short script or documented API call sequence that lists open code scanning alerts for a repo
GitHub Advanced Security (skills measured per exam study guide)
Design a rollout plan that sequences secret scanning, code scanning, and Dependabot for a mid-size org
Explain which roles can view and dismiss alerts at repo, org, and enterprise level
Define metrics that show whether the program is reducing risk rather than just producing alerts
Identify the top three failure modes of a GHAS rollout and a mitigation for each
Your checkpoint
A rollout plan document covering sequencing, role assignments, and at least four program metrics with target thresholds
GitHub Advanced Security (skills measured per exam study guide)
Re-rate every study-guide topic against your week 1 checklist and close the three weakest
Complete timed practice on missed topics without consulting notes, then review every wrong answer
Explain aloud, without notes, the full alert lifecycle for each of the three detector families
Write a one-page cheat sheet of facts you keep forgetting and review it twice
Your checkpoint
An updated confidence checklist showing movement on every topic, a scored timed practice run with a written error analysis, and a final one-page cheat sheet
Milestones
Week 2: You can trigger, explain, and resolve both a secret scanning alert and a code scanning alert in a test repo without looking anything up
Week 4: All three detector families are configured and you can state, for each, the trigger point, alert location, and remediation owner from memory
Week 6: You have shipped a custom CodeQL query into a workflow and pulled alerts programmatically, proving depth beyond default setup
Week 8: Every study-guide topic is rated 4 or 5 on your checklist and your timed practice error analysis shows no repeated mistake category