What is the difference between vulnerability scanning and penetration testing?

• A. Scanning and pentesting are the same
• B. Penetration testing only reviews code without exploitation
• C. Scanning automatically detects known weaknesses; penetration testing actively exploits vulnerabilities to assess exploitability and impact
• D. Scanning is manual and pentesting is automated

Answer: (C)

The difference lies in approach and purpose. Vulnerability scanning uses automated tools to check systems, networks, and applications against known vulnerability databases. It flagss weaknesses it finds, but it does not try to exploit them. The goal is to provide a prioritized list of issues so defenders can remediate them.

Penetration testing, on the other hand, goes beyond detection. A tester actively attempts to exploit identified vulnerabilities or other weaknesses to assess whether an attacker could gain access, how far they could move once inside, and what sensitive data might be at risk. This simulates a real attack to measure exploitability and potential impact, providing a concrete picture of risk and helping to validate security controls.

That’s why the option describing automated detection of known weaknesses plus active exploitation and impact assessment is the best fit. The other statements are inconsistent with how these activities actually operate: scanning and pentesting are not the same, pentesting includes exploitation rather than just code review, and scanning is typically automated while pentesting may involve manual techniques as well.