Pen testing and recon: passive vs active

A penetration test (pen test) is an authorized, simulated attack on systems to find and demonstrate exploitable weaknesses before real attackers do. Unlike a vulnerability scan, which lists possible weaknesses, a pen test tries to exploit them and chain them together to show real impact, such as reaching sensitive data. Security+ covers the types of tests, the rules that make them legal and safe, and the difference between passive and active reconnaissance. The single most important point is authorization: without written permission, the same activities are illegal attacks.