Which statement best describes the difference between a vulnerability assessment and a penetration test?

• A. A penetration test includes exploitation of vulnerabilities; a vulnerability assessment identifies vulnerabilities without exploitation.
• B. A vulnerability assessment uses social engineering.
• C. They are identical in scope and objective.
• D. A penetration test is limited to physical security.

Answer: (A)

The main idea being tested is the difference between identifying weaknesses and validating them through active exploitation. A vulnerability assessment focuses on finding and listing weaknesses in systems, often using automated scanners and configuration reviews, and it typically provides a prioritized report with remediation steps. It does not attempt to breach or control the systems, so it stops at detection and risk assessment.

A penetration test, on the other hand, takes those identified weaknesses and tries to exploit them in a controlled, authorized way to prove whether an attacker could actually breach defenses, gain access, escalate privileges, or move laterally. It demonstrates real-world impact and provides evidence of exploit paths, which helps prioritize remediation based on true risk.

Social engineering or physical security can be part of a broader engagement, but they are not what fundamentally separates these two activities. The question’s correct statement captures the essential distinction: exploitation is part of a penetration test, whereas vulnerability assessment stops at identifying vulnerabilities.