Which practice is part of defensive interdomain routing during an hijack or DDoS?

• A. Disable RPKI validation
• B. Enable strict inbound/outbound filtering, apply RPKI-based validation, contact peers, switch to secure routes, monitor
• C. Ignore peer communications
• D. Turn off monitoring

Answer: (B)

During a hijack or DDoS, the goal is to quickly verify route legitimacy and limit the spread of bogus paths across the Internet. The best defensive interdomain routing approach combines strict filtering, cryptographic validation, coordinated action with peers, proactive routing choices, and ongoing visibility.

Strict inbound and outbound filtering prevents accepting or advertising prefixes that aren’t authorized, reducing the chance that a misrouted or malicious path propagates further. RPKI-based validation adds cryptographic origin verification, so you can discard routes that don’t have valid ROAs, cutting off invalid announcements from affecting traffic. Coordinating with peers is essential in interdomain routing because neighboring networks can apply harmonized filters and quickly implement mitigations, creating a safer overall routing environment. Switching to secure routes means prioritizing or forcing paths that are RO/RPKI-validated or otherwise considered trustworthy, and can include rerouting traffic away from compromised or congested links. Continuous monitoring provides real-time visibility into route changes and the effectiveness of mitigations, enabling rapid adjustments as the situation evolves.

Disabling RPKI validation eliminates a key defense against invalid origins, making hijacks more likely to succeed. Ignoring peer communications wastes the opportunity for coordinated defense. Turning off monitoring leaves you blind to the attack’s progression and the impact of any mitigations.