What does a ROA specify in relation to an AS and a prefix?

• A. A ROA lists all ASes that should not originate a prefix.
• B. A ROA is a contract with peers.
• C. A ROA defines routing policy for all prefixes.
• D. A ROA specifies that an AS is authorized to originate a specific prefix.

Answer: (D)

A ROA is a digitally signed assertion in the RPKI that binds a specific IP prefix to an AS that is authorized to originate it (often with a maximum prefix length). In BGP origin validation, routers check the ROA to decide whether a route’s origin is allowed. If the route comes from the authorized AS and the prefix length is within the ROA’s maximum, the route is considered valid; otherwise it may be marked as invalid or unknown, helping prevent prefix hijacking.

It isn’t a blacklist of ASes, nor a contract with peers, and it doesn’t define routing policy for all prefixes. It’s specifically about authorizing one AS to originate a particular prefix (up to a stated length).