A business hires a reputable pen$-$testing firm to test their cloud based system. Which of these must be done before proceeding?

The pen tester will have to travel to the physical location where the cloud infrastructure is located.

The pen tester and company must obtain written permission from the cloud vendor before accessing the customer$$s network.

They need to add an access fee from the cloud vendor.

They need to be paid in advance.