Describe the difference between vulnerability scanning and penetration testing.

• A. Scanning identifies known weaknesses; penetration testing actively exploits to test exploitability and impact, often with authorization.
• B. Scanning and penetration testing are the same, just different terms.
• C. Scanning involves design reviews; penetration testing is for code.
• D. Scanning only tests physical security; penetration tests digital systems.

Answer: (A)

Vulnerability scanning and penetration testing serve different purposes in assessing security. Vulnerability scanning uses automated tools to identify known weaknesses in systems, such as missing patches or misconfigurations, by checking against vulnerability databases. It’s mainly about discovery and reporting and is typically non-intrusive, often performed with clear authorization but not aimed at breaking in.

Penetration testing goes further: it simulates a real attacker and actively exploits vulnerabilities to verify whether they can be exploited, how far an attacker could go, and what the potential impact would be. This requires explicit authorization and a defined scope, and it uses both automated tools and manual techniques to demonstrate exploitability and real risk, not just the presence of weaknesses.

So the best description is that vulnerability scanning identifies known weaknesses, while penetration testing actively exploits those weaknesses to test exploitability and impact, usually with authorization. The other descriptions mischaracterize the activities or scope, such as equating scanning with design reviews, or focusing only on code or physical security.