Which statement correctly contrasts a vulnerability assessment with a penetration test?

• A. They are the same.
• B. A vulnerability assessment identifies weaknesses; a penetration test attempts to exploit them to gauge real-world risk.
• C. A vulnerability assessment is more expensive than a penetration test.
• D. A penetration test is less risky than a vulnerability assessment.

Answer: (B)

The key idea here is the difference between discovering weaknesses and proving how those weaknesses can be exploited in a real attack. A vulnerability assessment focuses on identifying and listing weaknesses, misconfigurations, and missing patches, often using automated scanners, and it prioritizes what needs remediation. It provides a view of potential exposure but doesn’t try to break in or demonstrate actual access.

A penetration test goes a step further by actively attempting to exploit those weaknesses within an authorized scope. The goal is to determine whether an attacker could gain access, escalate privileges, or move laterally, and to measure the real-world impact and risk to the organization. This hands-on approach yields concrete evidence of exploit success and helps justify remediation with a clearer sense of actual risk.

So the correct statement captures that distinction: a vulnerability assessment identifies weaknesses, and a penetration test attempts to exploit them to gauge real-world risk. The other options don’t fit because they either say they’re the same, or impose ideas about cost or relative risk that aren’t what fundamentally differentiates the two activities.