A user-defined bridge network is correct because it enables users to create isolated networking environments. Containers attached to a user-defined bridge network can communicate via their internal IPs, and this network is isolated from other containers unless explicitly connected. The default bridge is less secure since all containers are able to communicate by default. A MACVLAN network allows containers to have their own MAC address providing the appearance of physical devices which is different from the network isolation described. An Overlay network is used for communication between containers on different Docker daemons, which was not the scenario described. Host mode directly attaches the container to the host's network, with no isolation. None disables all networking for a container, however, it doesn't allow communication within a subnet.