What is the difference between network vulnerability assessment and a penetration test?
-
A penetration test enumerates resources, and a vulnerability assessment enumerates vulnerabilities
-
They are one and the same
-
A penetration test identifies running services, and vulnerability assessments provide a more in-depth understanding of vulnerabilities
-
A penetration test exploits vulnerabilities, and a vulnerability assessment finds vulnerabilities
Penetration testing is an active simulation of an attack to exploit vulnerabilities and determine actual risk, while vulnerability assessment is a broader process of identifying and classifying security weaknesses without exploiting them. Option A is wrong because both can enumerate resources and vulnerabilities. Option C is incorrect because penetration testing goes beyond identifying services to actually exploiting weaknesses.
A vulnerability assessment identifies and catalogs potential weaknesses (often via automated scanning) without actually exploiting them, while a penetration test goes further by actively attempting to exploit discovered vulnerabilities to demonstrate real-world impact. This is the key distinction — assessment finds, pentest exploits — rather than differences in resource enumeration or depth of service identification.