GitHub Advanced Security Study Strategy¶

Study Approach¶

Phase 1: Platform and Licensing (Week 1)¶

Goal: Understand what GHAS is, what it includes, and how it is licensed.

1. Feature Inventory
2. Code scanning (CodeQL + SARIF)
3. Secret scanning, push protection, custom patterns, validity checks
4. Dependency graph, Dependabot alerts, security updates, version updates
5. Security advisories, Global Advisory Database

6. Security overview dashboards

7. Free vs Licensed

8. Public repos: most features are free
9. Private repos: code scanning and secret scanning require GHAS

10. Dependabot and dependency graph are free on private repos

11. Licensing Model

12. GHAS is licensed per active committer
13. Active committer: pushed a commit in the last 90 days to a GHAS-enabled repo

14. Committer counts once per enterprise regardless of repo count

15. Phase 1 Resources

16. About GHAS
17. GHAS Billing
18. Security Configurations

Phase 2: Code Scanning Depth (Week 2-3)¶

Goal: Master code scanning configuration, CodeQL query suites, SARIF, and the alert lifecycle.

1. Setup Options
2. Default setup: no YAML, GitHub-managed
3. Advanced setup: custom workflow with full control

4. Switching between the two

5. CodeQL

6. Supported languages and build modes
7. Query suites: code-scanning, security-extended, security-and-quality
8. Custom queries and CodeQL packs

9. Local analysis with the CodeQL CLI

10. SARIF

11. Upload from any third-party SAST tool

12. Required fields: ruleId, level, message, locations, partialFingerprints

13. Alert Lifecycle

14. Open, fixed, dismissed (false positive, won't fix, used in tests)
15. Branch protection integration via required status checks

16. Copilot Autofix for eligible plans

17. Phase 2 Resources

18. Code Scanning Docs
19. CodeQL Documentation
20. SARIF Support

Phase 3: Secrets and Supply Chain (Week 4)¶

Goal: Understand secret scanning, push protection, Dependabot, and dependency review deeply.

1. Secret Scanning
2. Partner, GitHub, and custom patterns
3. Validity checks where supported

4. Non-provider pattern detection (when enabled)

5. Push Protection

6. Blocks pushes containing detected secrets
7. Bypass reasons and audit events

8. Delegated bypass for controlled environments

9. Dependabot

10. Alerts for known vulnerabilities in dependency graph
11. Security updates vs version updates

12. dependabot.yml syntax and grouped updates

13. Dependency Review

14. PR UI showing dep changes

15. dependency-review-action with severity and license gating

16. Phase 3 Resources

17. Secret Scanning Docs
18. Dependabot Docs
19. Dependency Review

Phase 4: Advisories, Admin, and Review (Week 5-6)¶

Goal: Finish remaining domains and run mock exams.

1. Security Advisories
2. Repository advisories for coordinated disclosure
3. CVE requests, private forks, publication

4. Global Advisory Database and how Dependabot consumes it

5. Private Vulnerability Reporting

6. Enable at repo or org

7. Draft advisory creation for maintainers

8. Administration

9. Security configurations for scale
10. Security overview dashboards

11. REST API endpoints and webhooks

12. Phase 4 Resources

13. Security Advisories
14. Security Overview
15. REST API for Security

Study Resources¶

Official GitHub Resources¶

• Code Security Docs - Complete reference
• GHAS Product Page - Product overview
• CodeQL Site - CodeQL learning
• GitHub Security Lab - Research and CodeQL examples
• GitHub Blog - Security - Updates
• GitHub Skills - Interactive courses

Free Learning Resources¶

• CodeQL Learning Lab - CodeQL query writing
• OWASP Top 10 - Vulnerability classes context
• MITRE CWE - Weakness enumeration

Practice Platforms¶

• A sandbox GitHub Enterprise Cloud trial org
• Deliberately vulnerable demo repos (e.g., github/codeql-action examples)
• Personal repos with intentionally inserted issues for practice

Exam Tactics¶

Question Strategy¶

1. Identify the feature in scope - Is the question about code scanning, secret scanning, Dependabot, or advisory?
2. Distinguish alert types - code scanning vs Dependabot vs secret scanning alerts behave differently
3. Read YAML carefully - Many questions include small dependabot.yml or workflow snippets where a single field matters
4. Watch for licensing traps - Some features are free on public, GHAS on private
5. Use terminology precisely - "partner pattern" vs "custom pattern" vs "GitHub pattern" are distinct

Time Management¶

• ~75 questions in 120 minutes = ~1.6 minutes per question
• First pass (80 minutes): answer confident items, flag the rest
• Second pass (30 minutes): revisit flagged
• Final (10 minutes): verify nothing is blank
• Cap any single question at 3 minutes on the first pass

Question Types to Expect¶

• YAML completion - Fill in a missing field in dependabot.yml or a CodeQL workflow
• Alert triage - Given a scenario, what action is correct?
• Feature mapping - Which feature addresses this risk?
• Licensing - Does this scenario consume a seat?
• Configuration scope - Where is this configured: repo, org, enterprise?

Key Differentiators to Study¶

Common Pitfalls¶

Configuration Confusion¶

• Mixing default and advanced setup behaviors
• Forgetting that secret scanning push protection requires GHAS on private repos
• Using the wrong query suite name
• Missing required fields in dependabot.yml

Licensing¶

• Thinking every GitHub user consumes a seat (only active committers do)
• Assuming public repos need GHAS for code scanning (they do not)
• Forgetting that Dependabot is free even on private repos

Alert Triage¶

• Dismissing alerts with the wrong reason (affects metrics and automation)
• Not understanding auto-dismiss rules for fixed alerts
• Confusing a closed secret scanning alert with a revoked credential

Administration¶

• Enabling features repo by repo instead of using security configurations
• Overlooking the security overview dashboard
• Forgetting that audit logs and webhooks exist for automation

Advisories¶

• Publishing a draft advisory prematurely
• Not requesting a CVE when appropriate
• Missing the private fork step in coordinated disclosure