What is the difference between vulnerability scanning and penetration testing?

• A. Scanning requires manual test; penetration testing uses automated tools only.
• B. Vulnerability scan automates detection of weaknesses; penetration test attempts to exploit vulnerabilities to assess real risk.
• C. Scanning fixes vulnerabilities; penetration testing deletes data.
• D. They are the same.

Answer: (B)

The difference is about what each activity actually demonstrates. A vulnerability scan uses automated tools to detect known weaknesses in systems, configurations, and services. It goes through hosts and networks to produce a list of potential problems, typically with severity estimates and suggested fixes. This is largely non-intrusive and focused on finding what could be vulnerable, not on proving that those weaknesses can cause real harm in the live environment.

A penetration test goes a step further by simulating real attacker behavior. Skilled testers actively attempt to exploit detected weaknesses to see if they can gain access, escalate privileges, or move laterally within the network. This demonstrates whether a vulnerability is truly exploitable and what the actual impact would be, providing a clearer assessment of risk and the effectiveness of security controls. Pen tests are usually more time-bound, hands-on, and may involve manual techniques in addition to automated tooling, all within a defined scope and with proper authorization.

So, vulnerability scanning automates detection of potential flaws; penetration testing tries to exploit those flaws to assess real risk. The other options misstate how each activity works—scanning isn’t about fixes or data deletion, and they aren’t the same or exclusively automated/manual in the opposite way.