What does 'secure by default' imply for BGP operations?

• A. Default policy trusts unknown routes
• B. Unknown routes are treated as trusted; automatic acceptance
• C. Validation is optional
• D. Default policy treats unknown/invalid routes as untrusted; require validation (RPKI), authentication, and strict filtering

Answer: (D)

Secure by default means you don’t treat any BGP route as trustworthy unless it has been verified. In practice, this means unknown or invalid routes are not accepted; you require proof of legitimacy through origin validation (like RPKI with ROAs), authentication of the advertising peer, and strict filtering to drop anything that fails those checks. This posture helps prevent hijacks and misconfigurations by only installing routes that pass proven checks, rather than automatically trusting every advertised entry.