← WA Computer Science ATAR Unit 2

Vulnerability scanning versus penetration testing

A vulnerability scan is an automated check that lists known weaknesses, some false positives. A penetration test is manual: testers try to exploit them to prove the real impact.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 142

Understanding Vulnerability scanning versus penetration testing in WA Computer Science ATAR Unit 2

What it does: The scanner runs by itself and only produces a report of known weaknesses. It does not try to break in, which matches the definition of a vulnerability scan. A penetration tester actively uses a weakness to gain access, proving what damage an attacker could do. This exploitation is what separates a pen test from a scan. Scanners run automatically. Penetration tests rely on skilled testers who think creatively and chain weaknesses together. A false positive is a reported weakness that is not real. Scans produce these because they match patterns rather than testing real exploitation. Automated tools can flag weaknesses that are not really there. Assuming every result is confirmed ignores false positives, which is why manual verification matters.

Common mistakes: A vulnerability scan only lists known weaknesses. It does not exploit them, so the output should be labelled "Known:", not "Exploited:". A penetration test tries to exploit each weakness to show real impact. Only listing it is what a scan does, so the line should be tester.exploit(v).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Vulnerability scanning versus penetration testing to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which tool automatically checks systems and lists known weaknesses?
A vulnerability scanA penetration test
Matches
"Our vulnerability scan proved attackers could steal customer data."
↓
A scan only lists possible known weaknesses. It does not exploit them, so it cannot prove real data theft. Proving impact needs a penetration test.
Applying
Meanings
Term
vulnerability scan vs penetration test
Meaning
A vulnerability scan is an automated check that lists known weaknesses, some false positives. A penetration test is manual: testers try to exploit them to prove the real impact.
Practice
Vulnerability scan: automated, lists known weaknesses
Testing
Gaps
Vulnerability : automated check
Check Answer
Spots
2found = scan.run(server)
3print("Exploited:", found)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Giraffe' badge — High Perspective, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which tool automatically checks systems and lists known weaknesses?
A. A vulnerability scan ✓
B. A penetration test
A vulnerability scan is automated software that compares systems against a database of known weaknesses and produces a list.
2. Which activity tries to exploit weaknesses to show the real impact of an attack?
A. A vulnerability scan
B. A penetration test ✓
A penetration test goes beyond listing weaknesses. Testers attempt to exploit them to prove what an attacker could actually do.
3. Which is mostly automated and which is mostly manual?
A. Scan is automated; penetration test is manual ✓
B. Scan is manual; penetration test is automated
Scanners run automatically. Penetration tests rely on skilled testers who think creatively and chain weaknesses together.
4. A scanner reports a weakness that does not actually exist on the system. What is this called?
A. A zero-day
B. A false positive ✓
A false positive is a reported weakness that is not real. Scans produce these because they match patterns rather than testing real exploitation.
5. How can a team confirm whether a scan result is a false positive?
A. Manually verify it, for example by trying to exploit it ✓
B. Assume every scan result is correct
Scan results need checking. A penetration tester trying to exploit the finding shows whether the weakness is real.

Match the Pairs

nmap -sV 192.168.1.10 → An automated scan that probes a host and lists open ports and service versions, which can then be checked against known vulnerabilities
Scan result: "Possible SQL injection" - tester confirms it is not exploitable → A false positive: the scan flagged a weakness that does not really exist, so a person must verify it
A vulnerability scan is automated and produces a list of known weaknesses without exploiting them → scan_report = run_scanner(target) # lists issues only
A penetration test is manual: a tester tries to exploit a weakness to show the real impact → exploit(target, "weak_admin_login") # tester gains access
"Our vulnerability scan proved attackers could steal customer data." → A scan only lists possible known weaknesses. It does not exploit them, so it cannot prove real data theft. Proving impact needs a penetration test.
"Every item in the scan report is a confirmed, real vulnerability." → Scans can return false positives, so items in the report must be checked and verified by a person before being treated as real.

Key Term

vulnerability scan vs penetration test
A vulnerability scan is an automated check that lists known weaknesses, some false positives. A penetration test is manual: testers try to exploit them to prove the real impact.

Fill in the Blanks

1. Vulnerability scan: automated check Output: list of known weaknesses
Hint: Type the one-word name of the automated check that lists known weaknesses.
2. Penetration test: manual work by testers Goal: exploit weaknesses to show impact
Hint: Type the word that describes how a penetration test is carried out, as opposed to a scan.
3. A scan reports a weakness that is not real: This is called a false positive.
Hint: Type the term for a scan result that wrongly reports a weakness.
4. Scan finds a weakness. Tester tries to exploit it to prove impact.
Hint: Type the action a tester performs on a found weakness to show it is a real risk.
5. A penetration test proves real impact. A scan only lists known weaknesses.
Hint: Type the name of the activity where testers try to exploit weaknesses to show real impact.

Spot the Error

Question 1
A scan = Scanner("automated")
B found = scan.run(server)
C print("Exploited:", found)
Line C — A vulnerability scan only lists known weaknesses. It does not exploit them, so the output should be labelled "Known:", not "Exploited:".
Question 2
A vulns = Scanner().run(server)
B tester = Tester("manual")
C for v in vulns:
D tester.list(v)
Line D — A penetration test tries to exploit each weakness to show real impact. Only listing it is what a scan does, so the line should be tester.exploit(v).
Question 3
A scan_type = "manual"
B if scan_type == "automated":
C print("Lists known flaws")
Line A — A vulnerability scan is automated software, so scan_type should be "automated". Manual work is what penetration testers do.
Question 4
A flag = scan.finding("SQLi")
B confirmed = tester.verify(flag)
C if not confirmed:
D status = "real exploit"
Line D — If a tester cannot confirm a scan finding, it is a false positive: the scanner reported a weakness that is not really there. It should be "false positive".
Question 5
A alerts = scan.run(server)
B real = alerts
C print(len(real))
Line B — Scans can produce false positives, so alerts must be checked manually before they are treated as real. Assigning real = alerts skips that check.

Student with a class code? Join your class →