A county IT manager points at a green vulnerability-scanner dashboard and says the annual penetration test is finished. What clarification should the assessor give?
Select an answer to reveal the explanation.
Short Explanation
A green scanner light is like a smoke detector that did not beep—useful, but it is not a fire drill that walked every exit. VA finds candidates; a pentest shows what an attacker can actually chain under the RoE.
Full Explanation
Vulnerability scanners automate detection of known issues and misconfigurations, which supports vulnerability assessment. They do not demonstrate realistic exploit paths, chaining, or business impact the way a controlled penetration test does. Equating a clean dashboard with a completed pentest misunderstands both engagements.