The primary function of CrowdStrike Falcon's network containment is to completely isolate a compromised or suspicious host from the network. This action blocks all inbound and outbound network traffic, both internal (lateral) and external (internet-bound), to prevent an attacker from moving laterally, exfiltrating data, or communicating with command-and-control (C2) servers. The only exception is that the device is still permitted to communicate with the CrowdStrike cloud, ensuring that the Falcon sensor remains active and the host can be managed remotely by administrators for investigation and remediation.

A. Disable all processes on the device until further investigation is completed. This describes a different type of host lockdown, not network containment. Network containment specifically targets and blocks network connections, not host processes.
B. Isolate the device from external network communications while allowing internal communication. This is incorrect. Allowing internal communication would fail to prevent lateral movement, which is a critical risk from a compromised host. Standard containment blocks internal traffic.
C. Allow network communication only for specific trusted applications. This describes application whitelisting or a granular firewall policy, which is a preventative control, not the broad, immediate response action that network containment represents.

1. CrowdStrike Official Documentation, "Falcon Host and Host Groups": In the section detailing response actions, the Network Containment feature is described. It explicitly states that containing a host will block all network activity for that host, with the exception of communication to the CrowdStrike cloud. This prevents threat propagation and C2 communication. (Reference: CrowdStrike Falcon Platform Documentation, Host Management App > Contain Host, accessed via official customer portal).

2. CrowdStrike Support Portal, "Frequently Asked Questions: Network Containment": This document clarifies the functionality, stating, "When a host is contained, all network traffic is blocked to and from that device, with the exception of traffic to the CrowdStrike cloud... This prevents an adversary from moving laterally within your environment, accessing other hosts, or connecting to the internet." (Document ID: PS000134, Section: "How does it work?").

3. SANS Institute, "Endpoint Protection and Response: A SANS Survey" (2021): While not a direct CCFA 200 source, SANS publications on endpoint security are academically reputable. They describe network isolation/containment as a key EDR capability used to "quarantine an endpoint from the network to prevent the spread of an attack," which aligns with blocking all traffic, not just external. (Reference: SANS 2021 Endpoint Protection and Response Survey, Page 12, "Key EDR Capabilities").