A penetration test should answer a simple question: where could an attacker get in, and what could they reach after that? The answer changes when the test looks at an internet-facing service rather than an internal network. External testing checks what the public can reach. Internal testing checks...