Explain the difference between a vulnerability assessment and a penetration test, and when you would use each.