Penetration Testing is an authorized, simulated attack that tries to actually exploit weaknesses rather than just list them. That is what separates it from vulnerability scanning. A scanner flags a potential flaw; a penetration test proves whether that flaw leads somewhere real, chaining findings into a genuine path to systems or data.
Engagements come in flavors based on what the tester knows going in: black box means no inside knowledge, white box means full documentation and code, and gray box lands somewhere between. Scope might cover networks, web applications, wireless, physical entry, or social engineering. Written rules of engagement are not optional, because they define what is authorized and keep a sanctioned test from looking like a crime. Skipping that paperwork is how testers end up in serious trouble. Strong teams also retest after fixes, since a remediation nobody verified is just an assumption.
How is penetration testing tested on the CISSP?
It belongs to Domain 6: Security Assessment and Testing. Know when a penetration test fits versus a vulnerability assessment, the legal and ethical guardrails, and the phases of reconnaissance, scanning, exploitation, and reporting that drives remediation.