An Ethical Hacker for a Large Security Research Firm Performs

An ethical hacker for a large security research firm performs penetration tests, vulnerability tests, and risk assessments. A friend recently started a company and asks the hacker to perform a penetration test and vulnerability assessment of the new company as a favor.  What should the hacker's next step be before starting work on this job?

A) Start by foot printing the network and mapping out a plan of attack.
B) Ask the employer for authorization to perform the work outside the company.
C) Begin the reconnaissance phase with passive information gathering and then move into active information gathering.
D) Use social engineering techniques on the friend's employees to help identify areas that may be susceptible to attack.