What is the difference between a vulnerability scan and a penetration test?

What the interviewer wants to hear

• Scan is automated and broad, finds known issues
• Pentest is manual, deep and tries to safely exploit and chain weaknesses
• Scans run often; pentests are periodic and scoped
• Pentests need written authorisation and rules of engagement

Model answer

A vulnerability scan is an automated check, using tools like Nessus, that compares systems against a database of known issues such as missing patches or weak settings. It is broad, fast and should run regularly, often weekly or continuously. It tells you what might be vulnerable but can include false positives. A penetration test is a manual, deeper exercise where skilled testers try to safely exploit weaknesses and chain them together, for example from a phishing foothold to domain admin. It shows real impact and finds logic flaws that scanners miss. Pentests are done less often, have a defined scope, and always need written authorisation and agreed rules of engagement. Both are useful: scans for hygiene, pentests to validate defences and priorities.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the principle of least privilege, and how would you apply it in an organisation?