A penetration tester has been hired to conduct an assessment, but the company wants to exclude social engineering from the list of authorized activities. Which of the following documents would include this limitation?
1) Service level agreement
2) Memorandum of understanding
3) Acceptable use policy
4) Rules of engagement