After Network Containing a host, your Incident Response team states they are unable to remotely connect to the host. Which of the following would need to be configured to allow remote connections from specified IP's?

When a host is placed in Network Containment, the Falcon sensor blocks all inbound and outbound traffic except to the CrowdStrike cloud. To permit responders to RDP, SSH, or otherwise connect, you must create or edit a Containment Policy and add “Containment Exceptions” for the responders’ source IP addresses (or CIDRs). The policy is then applied to the contained host, selectively re-enabling communication only with those specified IPs.

A. Response Policy – Governs automated remediation actions (kill process, quarantine file) and does not alter network restrictions imposed by containment.
C. Maintenance Token – Temporarily disables prevention features on the endpoint but leaves network containment rules unchanged.
D. IP Allowlist Management – No independent module; IP allowlists for contained hosts are configured inside a Containment Policy, not in a separate setting.

1. CrowdStrike Falcon Platform Documentation v6.54, “Host Containment Guide,” Section 3 “Create Containment Policies and Exceptions,” pp. 14-16.

2. CrowdStrike Falcon Console Online Help (2023-09-15), article “Contain a Host and Configure Exceptions,” para. “Allow traffic to specific IP addresses during containment.”

3. CrowdStrike Falcon Administrator Guide v6.x, Chapter 9 “Response Actions,” subsection “Network Containment,” p. 228-230.