Exercise 1: Vulnerability Scanning vs. Penetration Testing — Possible Solution ==================================================================== WHAT VULNERABILITY SCANNING DOES ------------------------------ Per this chapter's own comparison table, vulnerability scanning is automated and tool-driven, identifying KNOWN vulnerability signatures — matching a target against a database of already-documented issues (missing patches, known-vulnerable software versions, common misconfigurations). Critically, per the chapter's own wording, it is "largely non-invasive" and "doesn't attempt exploitation" — a scanner flags that something LOOKS potentially vulnerable based on a signature match, but never actually tries to exploit it to confirm that. WHAT PENETRATION TESTING DOES DIFFERENTLY ------------------------------ Per this chapter's own table, penetration testing is manual and expert-driven, and specifically DOES attempt real exploitation — the explicit goal is to prove actual, demonstrable impact, not just flag a theoretical possibility. A pentester doesn't stop at "this looks like it might be vulnerable"; they actually attempt the exploit, to determine whether the vulnerability is real, exploitable in practice, and what an attacker could genuinely accomplish with it. THE SPECIFIC DIFFERENCE ------------------------------ The core distinction is the step a scan deliberately never takes: ATTEMPTING EXPLOITATION. A vulnerability scan can produce a long list of "potential" issues, many of which might not actually be exploitable in the real, specific context of the target system (a flagged vulnerability might be mitigated by some other control the scanner doesn't know about, for instance). A penetration test's whole purpose is to go one step further and actually confirm, hands-on, whether a given weakness is real and what real-world impact it enables — which is exactly why it requires manual, expert judgment rather than being something a scheduled automated tool alone can do. WHY THIS WORKS AS AN ANSWER ------------------------------ It identifies the specific missing step (actual exploitation attempt) that separates the two disciplines, using the chapter's own precise wording for each, rather than a vague "pentesting is more thorough" answer.