Which are common indicators of a BGP security incident in router logs?

• A. Only increased CPU usage.
• B. New or unexpected prefixes or origins, AS_PATH anomalies, invalid ROA matches, rapid changes in routes, neighbor session resets.
• C. Regularly scheduled maintenance messages.
• D. No anomalies.

Answer: (B)

Recognizing signals of a BGP security incident in router logs means spotting patterns that point to problems with how routes are announced and learned. The strongest indicators are: new or unexpected prefixes or origins, which can mean someone is announcing routes you don’t own or from an origin AS you didn’t expect; AS_PATH anomalies, such as unusual sequences, unexplained length changes, or loops, which suggest path manipulation or misconfiguration; invalid ROA matches, where a route fails ROA or RPKI validation, signaling that the origin isn’t authorized or the ROA data is inconsistent; rapid changes in routing information, i.e., frequent updates or route flapping, which reflect instability often tied to hijacks or leaks; and neighbor session resets, where BGP peering sessions repeatedly reset, hinting at interference, misconfigurations, or disruption attempts. These together form a realistic portrait of a BGP security incident as seen in logs.

Other options don’t fit as well because isolated symptoms like only increased CPU usage can occur for many benign reasons, regularly scheduled maintenance messages are expected maintenance activity rather than anomalies, and no anomalies would not indicate an incident.