If a ROA-based validation fails for a received route, what is a typical corrective action?

• A. Advertise more routes.
• B. Disable ROA validation.
• C. Update the ROA to authorize the prefix/origin or adjust filtering policy.
• D. Ignore the route.

Answer: (C)

ROA-based validation checks that a route’s origin AS is authorized to originate that prefix according to a signed Route Origin Authorization. If a received route fails this check, the typical corrective action is to update the ROA so that the prefix/origin is authorized (for example, add the prefix with the correct origin ASN, or adjust the maximum prefix length), and publish the updated ROA so future validation passes. If the route should be permitted under policy, aligning the ROA with the intended origin prevents legitimate routes from being dropped. In some cases, operators may also tweak filtering policies to reflect current authorization rules. Advertising more routes won’t fix the authorization mismatch, disabling ROA validation reduces security, and ignoring the route risks dropping or accepting an unvalidated path.