Which statement best contrasts a vulnerability scan with a penetration test as activities within an enterprise vulnerability management programme?
- AA vulnerability scan is always credentialed and intrusive, while a penetration test is always non-credentialed and read-only, so only the scan can affect production stability.
- BA vulnerability scan reports a single severity score per host, while a penetration test reports findings using the Common Vulnerability Scoring System version four base metrics.
- CA vulnerability scan can be run continuously by the asset owner, while a penetration test may only be conducted by a regulator under statutory powers granted to that body.
- DA vulnerability scan identifies and reports known weaknesses largely through automated tooling, while a penetration test attempts to exploit weaknesses and chain them together to demonstrate real-world impact. Correct
Why A is wrong: Both activities can be credentialed or non-credentialed and both can affect stability. Penetration tests in particular are typically more intrusive than scans because they involve actual exploitation.
Why B is wrong: Both activities commonly use CVSS to score individual findings, and a scan usually reports per-finding severity rather than one score per host. The contrast is the depth of validation, not the scoring system.
Why C is wrong: Penetration tests are carried out by internal red teams or contracted firms under written authorisation; they are not restricted to regulators. The frequency contrast is real, but the legal claim about regulators is incorrect.
Why D is correct: Scanners are automated discovery tools that flag known issues from signatures and configuration checks. A penetration test goes further by actively exploiting those issues, pivoting through the environment and proving what an attacker could actually achieve.