What is the difference between a vulnerability scan and a penetration test?

• A. A vulnerability scan identifies known weaknesses; a penetration test validates exploitability and real risk by attempting to breach.
• B. A vulnerability scan tests the exploitability of vulnerabilities; a penetration test fixes them.
• C. A vulnerability scan is the exhaustive manual approach; a penetration test is automated.
• D. Vulnerability scan fixes vulnerabilities; penetration test creates new ones.

Answer: (A)

A vulnerability scan identifies potential weaknesses in systems by automatically checking assets against known vulnerability databases. It surface-level indicates what could be vulnerable but does not prove that those weaknesses can be exploited in practice. A penetration test takes it a step further by actively attempting to exploit those weaknesses in a controlled environment to determine if an attacker could breach the system, how deep the access could go, and what real impact it would have. This validates exploitability and reveals the actual risk, not just the existence of issues.

That’s why this description is the best match: it clearly separates discovery (what could be vulnerable) from validation of real risk (whether those weaknesses can be exploited and what it would mean). The other statements misrepresent what vulnerability scans do, how penetration tests operate, or the outcomes of each process—for example, assuming scans test exploitability or that tests fix vulnerabilities, or mischaracterizing automation and manual effort.