CISSP All Domains Practice test 10

We have hired an external company to do a penetration test. In which phase would the tester look around on our network, try to find new attack vectors, or maybe go back to the discovery phase?