CompTIA Security+ guideHigh-value skills
Vulnerability Scanning vs Penetration Testing for Security+
Match three business questions to a scan, a penetration test, or a retest, and see what each result cannot prove.
Short answer
A vulnerability scan looks for known weaknesses and missing fixes. A penetration test tries to see whether weaknesses can be used along a path the rules of engagement allow. SY0-701 also expects you to validate a fix by rescanning or otherwise verifying it. A scan is not automatically harmless, and a test does not find every weakness. Logging into a scanner is not the same idea as a known-environment penetration test.
What each assessment is for
The objectives name vulnerability scanning as a way to identify weaknesses, and they name false positives. Under penetration testing they list physical, offensive, defensive, and integrated tests, plus known, partially known, and unknown environments, and passive or active reconnaissance. Rules of engagement sit with third-party risk. Validation of remediation includes rescanning, audit, and verification.
The words “credentialed” and “non-credentialed” do not appear in the SY0-701 objectives PDF. People still use them to mean whether the scanner authenticates. That is a useful practical distinction. It is not the exam’s name for a known-environment test. A known environment means the testers receive substantial information about the target. A scanner login does not, by itself, make the engagement a penetration test.
| Question you are answering | Better fit | What the result still does not prove |
|---|---|---|
| Which systems look like they are missing a known fix? | Vulnerability scan | That an attacker can chain those findings, or that every finding is real |
| Can these weaknesses form a path to a specific system, inside an agreed scope? | Penetration test, with rules of engagement | That every weakness was found, or that a later change stays safe |
| Did the fix remove the finding we already recorded? | Rescan or another verification of that fix | That a different weakness was not introduced outside the check |
What a vulnerability or an attack means is the threats guide. This page only picks the assessment.
Three requests
1. “List the missing patches on the clinic servers this month.” A vulnerability scan fits. Run it against the agreed hosts. If the scanner can authenticate, it may see missing patches that an outside probe cannot see. That login is still a scan. Review false positives before anyone treats the report as a work list. The scan does not show whether those missing patches can be chained into the scheduling database. It can also disrupt a fragile device, so “scan” is not a synonym for “safe on anything.”
2. “We need to know whether a guest on the wireless network can reach patient notes.” A penetration test fits if the rules say which network, which hours, which systems are out of scope, and when to stop. An unknown environment gives the testers little information. A known environment gives them a lot. Partially known sits between them. The test is not a scan with a different cover page. It is also not a promise that every path was found. This article will not describe how to exploit a flaw.
3. “We installed the patch. Confirm the old finding is gone.” Verify that finding. A rescan of the same check is the validation step the objectives name. A new full penetration test answers a broader question and is not required to close one patch record, unless the agreement says the finding can only be closed that way. A clean rescan does not prove a different bug is absent.
Practice an original Security+ assessment question. The free set will not operate a scanner.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.