A penetration tester is reviewing the Statement of Work. The client wants Active Directory testing but not testing of the cloud production environment. The cloud environment shares some authentication with on-premises AD. What is the appropriate scoping action?

• ATest the cloud environment quietly because it is connected to AD
• BDocument the AD-to-cloud trust relationship in the Rules of Engagement, confirm with the client whether cross-trust attacks against the cloud are in scope, and stop AD testing at any cloud boundary if the answer is no
• CRefuse the engagement because the scope is unclear
• DTest everything and report afterward