CCFA-200B: CrowdStrike Certified Falcon Administrator

Trusted operating-system update source IP addresses should be added to the Containment policy so update traffic is permitted while network containment remains in effect. Broadly allowing internal IP addresses or removing containment would weaken isolation.