During an active incident, a security engineer confirms that a single pod running in an Amazon EKS cluster has been compromised and is attempting lateral movement to other pods and out to the internet. The forensics team needs the pod preserved for investigation, but all network communication to and from the pod must be stopped immediately with minimal disruption to other workloads on the same node. Which action provides the fastest, most surgical containment while preserving the pod for analysis?