Penetration testing

Penetration testing is an authorised, simulated attack against an organisation’s systems, networks, or applications, carried out to prove whether weaknesses can actually be exploited. Rather than stopping at a list of possible flaws, testers chain vulnerabilities into working attack paths and demonstrate real impact: extracted data, escalated privileges, compromised hosts. The exercise is commonly organised into teams. The red team attacks, the blue team defends, and a purple team arrangement has the two work together so defensive lessons transfer immediately.

What separates a penetration test from a crime is paper. Written authorisation from someone with the authority to grant it must exist before any testing starts, and the rules of engagement must define scope, timing, permitted techniques, and emergency contacts. Testing outside that scope, however well intentioned, is unauthorised access. A test is also distinct from a security audit, which evaluates conformance to a standard rather than resistance to attack, and it carries operational risk: exploitation can crash production systems, which is why scope is negotiated rather than assumed.

Exam relevance: if a scenario asks how to prove that vulnerabilities are exploitable, or mentions red teams and rules of engagement, the answer is penetration testing. If the question asks what must come first, it is written authorisation. Contrast the vulnerability assessment, which identifies and ranks weaknesses broadly but never exploits them: assessments answer what might be wrong, penetration tests answer what an attacker can actually do.