A water-utility board treats a vulnerability assessment and a full penetration test as the same deliverable. What distinction should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Picture a building inspection versus a supervised break-in drill. The assessment finds and ranks weak spots; the pentest carefully tries to walk through a few of them under permission. Same neighborhood of ideas — different depth of proof.
Full Explanation
For a water-utility board, the useful distinction is that a vulnerability assessment finds and prioritizes weaknesses—often via scanning, configuration review, and analysis—while a penetration test goes further by attempting controlled exploitation paths within authorized rules of engagement to demonstrate realistic impact. Physical-versus-remote access is not the defining split; both VA and pentest work can be remote or on-site depending on scope. Claiming a pentest only reviews policies while a VA always includes social engineering reverses and invents categories that do not match commercial practice. Treating the terms as identical cover titles erases methodology differences that procurement, insurers, and boards rely on when buying services. Exam caveat: some RFPs misuse the labels; clarify deliverables in writing rather than assuming synonymy, especially when OT or safety systems are nearby. Operational check: in the kickoff packet, state whether exploitation is authorized, what proof-of-concept depth is allowed on utility systems, and how critical findings will be validated without treating a green scanner dashboard as a finished pentest. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.