A chief financial officer asks why the company pays for an annual third-party penetration test of its cloud application when the security team already runs weekly automated vulnerability scans of the same environment. Which explanation is most accurate?
Select an answer to reveal the explanation.
Short Explanation
A vulnerability scan is a home inspector's checklist of every unlocked window; a pen test is someone actually climbing through one to see how far they get. You need both: the checklist for breadth and frequency, the climb to prove impact. Watch for answers that flip which one is automated and broad.
Full Explanation
A vulnerability assessment uses largely automated tools to enumerate hosts, services and configurations and to compare them with known weaknesses, producing a broad, frequent inventory of potential issues ranked by severity. A penetration test is a goal-oriented, largely manual exercise in which authorized testers attempt to exploit weaknesses, chain them together and demonstrate what an attacker could actually achieve, such as reaching sensitive data or escalating privileges. The two answer different questions, which is why mature programs run scans often and tests periodically. Claiming scans must be external while tests are internal reverses nothing meaningful; either activity can be performed internally or by third parties, and independence is a choice of the program. Saying tests are automated and broad while scans are deep inverts the defining characteristics. Asserting that scans exist only for compliance and that testing replaces patching is wrong on both counts: scans drive remediation, and a test is a point-in-time check that never substitutes for ongoing vulnerability management. Exam caveat: in cloud, both activities must stay within the provider's acceptable use and testing policies. Operational check: confirm scan findings feed a remediation workflow with deadlines, and that test reports include exploited paths, evidence and retest results.