GitHub • GH-900
Validates understanding of foundational topics, products, and concepts of collaborating, contributing, and working on GitHub.
Questions
409
Duration
100 minutes
Passing Score
700/1000
Difficulty
FoundationalLast Updated
Jan 2026
The GitHub Foundations certification (GH-900) validates a candidate's understanding of the foundational topics, products, and concepts central to collaborating, contributing, and working on GitHub. The exam covers Git version control fundamentals, GitHub repository management, collaboration workflows via issues and pull requests, GitHub Actions for automation, GitHub Copilot's AI-assisted development capabilities, GitHub Codespaces, and core security and administration concepts. As of January 2026, the exam objectives were significantly updated to reflect modern GitHub features including Copilot Agent Mode, multi-model support, Enterprise Managed Users (EMUs), and passkey authentication.
This certification is administered through Pearson VUE and is available in English, Spanish, Portuguese (Brazil), Korean, and Japanese. It is designed as a beginner-level credential spanning seven domains, making it accessible to developers and non-developers alike who regularly interact with GitHub in professional settings. GitHub Education also offers verified students the opportunity to take the exam at no cost.
The GitHub Foundations certification is designed for a broad range of GitHub users, including software developers, DevOps engineers, solution architects, app makers, and IT administrators who want a formal credential validating their GitHub proficiency. It is equally suitable for non-technical roles such as project managers, technical writers, and open-source contributors who collaborate on GitHub but may not write code daily.
This certification is particularly valuable for early-career professionals and students looking to establish credibility in collaborative development environments, as well as experienced professionals who use GitHub daily but have never formally validated their skills. Anyone preparing for more advanced GitHub certifications—such as GitHub Actions, GitHub Advanced Security, or GitHub Administration—should consider GH-900 as a natural starting point.
There are no formal prerequisites required to sit for the GitHub Foundations exam. However, candidates are expected to have hands-on familiarity with GitHub's core interface and basic Git operations before attempting the exam. Comfortable navigation of repositories, understanding of commits, branches, and pull requests, and exposure to GitHub's collaboration features (issues, discussions, notifications) will provide a meaningful foundation.
Microsoft Learn recommends completing the official 'GitHub Foundations Part 1' and 'GitHub Foundations Part 2' learning paths before sitting the exam. Candidates who have spent time working on real or practice GitHub repositories—creating branches, submitting pull requests, and reviewing code—will be best positioned to pass without additional study.
The GH-900 exam consists of questions delivered through Pearson VUE's online proctored testing platform and allows 100 minutes to complete. The exam may include a variety of interactive question types in addition to standard multiple-choice questions; candidates can preview the interface and question styles via the official Exam Sandbox at GHCertDemo.starttest.com before their scheduled attempt.
Scoring uses a scaled score model with a maximum of 1000 points, and a passing score of 700 is required. The exact number of scored questions is not publicly disclosed by GitHub. The exam is fully proctored and available for remote delivery. If a candidate fails on the first attempt, a 24-hour waiting period is required before retaking; subsequent retake intervals vary per policy. Candidates are strongly advised to register using a personal Microsoft Account (MSA) rather than a work or school Azure AD account to ensure exam records are retained.
The GitHub Foundations certification demonstrates verified proficiency with the world's most widely used code collaboration platform, strengthening a candidate's profile for roles such as software developer, DevOps engineer, technical project manager, solution architect, and IT administrator. Because GitHub is a near-universal tool in modern software development, this credential holds relevance across industries and company sizes. GitHub Education also allows verified students to sit the exam for free, making it an accessible early-career credential.
As an entry-level certification, GH-900 is best viewed as a career foundation rather than a standalone salary driver. It serves as a recognized stepping stone toward more advanced GitHub certifications—GitHub Actions, GitHub Advanced Security, and GitHub Administration—which carry greater weight for senior engineering and DevOps roles. For professionals transitioning into tech or those in non-coding roles who collaborate on GitHub, the certification provides concrete evidence of platform proficiency that differentiates candidates in competitive hiring processes.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 409 questions.
1. GlobalDev Corporation wants to understand GitHub's security scanning capabilities for their repositories. The application security manager needs to evaluate automated security features. What automated security scanning capabilities does GitHub provide to identify vulnerabilities in code and dependencies?
Explanation
GitHub provides comprehensive automated security scanning including secret scanning that detects accidentally committed credentials, dependency vulnerability alerts that identify known security issues in project dependencies, and code scanning with CodeQL that analyzes source code for potential security vulnerabilities. These automated features help identify security issues early in the development process. GitHub doesn't rely only on manual reviews, doesn't provide live penetration testing of running applications, and doesn't provide complete security certification - it focuses on static analysis and dependency monitoring that can be automated within the development workflow.
2. CodeCraft company wants to implement code quality automation in their development process. They need to understand automated code review capabilities. What automated code quality checks can GitHub Actions perform as part of the development workflow?
Explanation
GitHub Actions can perform various automated code quality checks including code style checking (linting), security vulnerability scanning, dependency analysis for known vulnerabilities, code coverage analysis, and static code analysis. These automated checks help maintain consistent code quality, identify potential security issues, and ensure adherence to coding standards without requiring manual review of every aspect. GitHub Actions cannot completely rewrite code automatically, cannot generate meaningful documentation and comments that require understanding of business logic, and cannot provide real-time pair programming assistance - these require human judgment and understanding that automated tools cannot provide.
3. DevStudio Inc. is setting up repository permissions for their development team. The security administrator needs to understand permission levels for active contributors. What's the appropriate repository permission role for contributors who need to actively push changes to your repository?
Explanation
The Write permission is the appropriate permission level for collaborators who need to create branches, push changes, and create pull requests. This permission allows active contribution to the repository while maintaining appropriate security boundaries. Maintain permission includes additional repository management capabilities beyond basic contribution needs, Triage permission is limited to managing issues and pull requests without code access, and Admin permission provides full repository control including security settings that most contributors don't need. Write permission provides the right balance of access for active code contributors.
4. EnterpriseSecure Corp has GitHub Advanced Security (GHAS) enabled and wants to understand their billing model. They have developers contributing to multiple repositories with GHAS enabled and want to optimize their security licensing costs. How is GHAS billing calculated?
Explanation
GitHub Advanced Security billing is based on the number of unique active committers per billing period. An active committer is anyone who has pushed at least one commit to a repository with GHAS enabled within the last 90 days. If a committer contributes to multiple GHAS-enabled repositories, they only count once for billing purposes. This model ensures that organizations pay based on the number of people using the security features rather than the number of repositories or scans performed.
5. CommunityEngagement Corp has successfully contributed to several open source projects and wants to become more involved in the broader open source ecosystem. They want to build long-term relationships and find opportunities for deeper participation. Which approaches effectively build sustained community engagement?
Explanation
Sustained community engagement involves participating in issue and pull request discussions, attending meetups or conferences, joining communication channels like Discord or Slack, following project contributors and organizations, and engaging with broader community activities. Building relationships and understanding community dynamics leads to more impactful contributions and learning opportunities beyond just code.
One-time access to this exam