ROA coverage: what should you do if a necessary prefix is not covered?

• A. Delete all ROAs
• B. Only use ROA for IPv6
• C. ROA changes are not needed after deployment
• D. Ensure ROA covers the needed origin; add or adjust ROA for that prefix; otherwise apply policy for unknown

Answer: (D)

ROA coverage defines which origin ASes are authorized to announce a given prefix through signed ROA records. If a needed prefix isn’t covered, the proper move is to extend the ROA so that that prefix is explicitly included with the correct origin ASN and an appropriate maxLength. This keeps legitimate routes verifiable and prevents them from being treated as non-authentic. If updating the ROA isn’t possible right away, applying a policy for unknown origins can be a temporary fallback to maintain reachability, but it comes with security trade-offs and should be resolved by updating the ROA. Deleting all ROAs would remove the protective layer entirely, which isn’t desirable. ROAs apply to both IPv4 and IPv6, and changes after deployment are normal as networks evolve.