A client authorizes testing of one production hostname, but it resolves to infrastructure shared with other tenants. What must the tester clarify before intrusive testing?

1. Whether every neighboring tenant has weak passwords
2. The authorized assets, shared-provider conditions, and permitted methods
3. How to bypass the provider's abuse monitoring
4. Whether the tester can rename the client report