Which activity is directly related to ROA publishing in BGP security?

• A. Publishing private keys
• B. Publishing general routing policies to the internet
• C. Publishing ROAs for internal use only
• D. Publishing ROAs to authorize ASes to originate prefixes

Answer: (D)

ROA publishing is about declaring which AS is allowed to originate which prefix, and with what maximum prefix length. In the RPKI system, a Route Origin Authorization (ROA) is a signed object that ties a specific IP prefix to an AS number. These ROAs are published so global validators can verify BGP announcements against them.

Publishing ROAs to authorize ASes to originate prefixes is the direct activity because it creates the verifiable bindings that prevent unauthorized origination. Without publicly available ROAs, validators can’t confirm whether an AS is permitted to originate a given prefix, weakening route security.

Publishing private keys would compromise security, as the keys used to sign ROAs must remain confidential. Publishing ROAs for internal use only would defeat the purpose of global origin validation, since the whole point is to be able to verify routes across the Internet. Publishing general routing policies to the internet is not about authorizing origin; it’s about policy rather than cryptographic validation.