| Topic | Details |
| Topic 1 | - Describe GitHub Advanced Security best practices: This section of the exam measures skills of a GitHub Administrator and covers outlining recommended strategies for adopting GitHub Advanced Security at scale. Test?takers will explain how to apply security policies, enforce branch protections, shift left security checks, and use metrics from GHAS tools to continuously improve an organization¡¯s security posture.
|
| Topic 2 | - Configure and use dependency management: This section of the exam measures skills of a DevSecOps Engineer and covers configuring dependency management workflows to identify and remediate vulnerable or outdated packages. Candidates will show how to enable Dependabot for version updates, review dependency alerts, and integrate these tools into automated CI
- CD pipelines to maintain secure software supply chains.
|
| Topic 3 | - Configure GitHub Advanced Security tools in GitHub Enterprise: This section of the exam measures skills of a GitHub Administrator and covers integrating GHAS features into GitHub Enterprise Server or Cloud environments. Examinees must know how to enable advanced security at the enterprise level, manage licensing, and ensure that scanning and alerting services operate correctly across multiple repositories and organizational units.
|
| Topic 4 | - Describe the GHAS security features and functionality: This section of the exam measures skills of a GitHub Administrator and covers identifying and explaining the built?in security capabilities that GitHub Advanced Security provides. Candidates should be able to articulate how features such as code scanning, secret scanning, and dependency management integrate into GitHub repositories and workflows to enhance overall code safety.
|
| Topic 5 | - Use code scanning with CodeQL: This section of the exam measures skills of a DevSecOps Engineer and covers working with CodeQL to write or customize queries for deeper semantic analysis. Candidates should demonstrate how to configure CodeQL workflows, understand query suites, and interpret CodeQL alerts to uncover complex code issues beyond standard static analysis.
|