An ethical hacker for a large security research firm performs penetration tests, vulnerability
tests, and risk assessments. A friend recently started a company and asks the hacker to perform a
penetration test and vulnerability assessment of the new company as a favor. What should the
hacker’s next step be before starting work on this job?
A.
Start by foot printing the network and mapping out a plan of attack.
B.
Ask the employer for authorization to perform the work outside the company.
C.
Begin the reconnaissance phase with passive information gathering and then move into active
information gathering.
D.
Use social engineering techniques on the friend’s employees to help identify areas that may be
susceptible to attack.