Why is a penetration test considered more thorough than a vulnerability scan?

• A. A vulnerability scan also exploits vulnerabilities to verify impact.
• B. A penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan typically does not involve active exploitation.
• C. Both perform the same level of testing.
• D. Penetration testing is less thorough.

Answer: (B)

The core idea is that a penetration test proves whether a vulnerability can be abused and what real impact an attacker could achieve, not just whether a weakness exists. A vulnerability scan automates the discovery of potential flaws and typically reports what’s present and how severe it might be, but it doesn’t try to break in or move through the environment. By actively attempting to exploit vulnerabilities, a penetration test demonstrates actual exploitability, privilege escalation, data access, and how defenses hold up in a real-world attack. This hands-on validation of risk makes it more thorough because it moves from theoretical weaknesses to observed security outcomes.

That’s why the best description is that a penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan typically does not involve active exploitation. The other options mischaracterize the process: scans don’t usually exploit to verify impact, the tests aren’t the same level of testing, and penetration testing is not less thorough.