Vulnerability assessment and penetration testing are two different phrases that both serve the same purpose: to secure the network environment.

Vulnerability Assessment is a process for defining, detecting, and prioritizing vulnerabilities in computer systems, network infrastructure, applications, and other systems, as well as providing the necessary information to the organization to correct the flaws.
Penetration Testing is also known as ethical hacking or pen-testing. It’s a method of identifying vulnerabilities in a network, system, application, or other systems in order to prevent attackers from exploiting them. It is most commonly used to supplement a web application firewall in the context of web application security (WAF).
A vulnerability scan is similar to approaching a door and checking to see if it is unlocked before stopping. A penetration test goes a step further, not only checking to see if the door is unlocked but also opening the door and walking right in.