An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk
assessments. A friend recently started a company and asks the hacker to perform a penetration test and
vulnerability assessment of the new company as a favor. What should the hacker’s next step be before starting
work on this job?

A.
Start by foot printing the network and mapping out a plan of attack.

B.
Ask the employer for authorization to perform the work outside the company.

C.
Begin the reconnaissance phase with passive information gathering and then move into active information
gathering.

D.
Use social engineering techniques on the friend’s employees to help identify areas that may be susceptible
to attack.