Which activity would be performed during penetration testing that is not typical of vulnerability assessment?

Which activity would be performed during penetration testing that is not typical of vulnerability assessment?

• A. Exploit weaknesses to validate exploitable risk.
• B. Document remediation steps.
• C. Scan for known vulnerabilities.
• D. Map network topology.

Answer: (A)

The main idea here is that a penetration test goes beyond finding weaknesses and proves whether those weaknesses can be turned into real access by actively exploiting them. Exploiting weaknesses to validate exploitable risk is what sets penetration testing apart because it demonstrates the actual impact an attacker could have, not just that a vulnerability exists. This step shows whether a flaw can be chained with other weaknesses, what data or systems could be reached, and how far an attacker could escalate privileges. In contrast, vulnerability assessment focuses on identifying and listing flaws without attempting to break in, so scanning for known vulnerabilities or mapping the network are typical discovery and reconnaissance activities. Documenting remediation steps is important in security work overall, but it isn’t the unique action that distinguishes penetration testing from a vulnerability assessment.

The main idea here is that a penetration test goes beyond finding weaknesses and proves whether those weaknesses can be turned into real access by actively exploiting them. Exploiting weaknesses to validate exploitable risk is what sets penetration testing apart because it demonstrates the actual impact an attacker could have, not just that a vulnerability exists. This step shows whether a flaw can be chained with other weaknesses, what data or systems could be reached, and how far an attacker could escalate privileges. In contrast, vulnerability assessment focuses on identifying and listing flaws without attempting to break in, so scanning for known vulnerabilities or mapping the network are typical discovery and reconnaissance activities. Documenting remediation steps is important in security work overall, but it isn’t the unique action that distinguishes penetration testing from a vulnerability assessment.