A penetration test actively exploits vulnerabilities to determine their real-world impact, while a vulnerability assessment identifies and categorizes potential vulnerabilities without exploitation. The assessment finds them; the penetration test exploits them.