How should Unknown/Not Found ROA status be treated in routing policy?

• A. Ignore ROA status and route normally.
• B. ROA Unknown is treated as trusted but with risk.
• C. ROA Unknown is treated as not applicable.
• D. Follow policy (often accept with caution or reject).

Answer: (D)

Unknown/Not Found ROA status means there is no ROA entry for that prefix (or the ROA data isn’t available), so there isn’t enough information to confirm the origin AS is authorized. In this situation you shouldn’t automatically trust or ignore the route. The proper approach is to enforce your ROA policy, which typically means either accepting with caution or rejecting the route depending on your risk tolerance and network needs. This ensures you maintain a deliberate security posture rather than making a blind assumption about safety or letting the data fall through.

Choosing to ignore ROA status would bypass the validation mechanism entirely, which weakens security. Treating unknown as trusted would imply you’re assuming safety without evidence. Treating unknown as not applicable would ignore the protective intent of ROA validation. Following policy keeps your decision aligned with your security goals and operational constraints.