Which statement best describes how RPKI and IRR data complement each other for inbound filtering decisions?

• A. IRR provides policy constraints; RPKI provides origin validation; together yield robust filter rules.
• B. RPKI provides origin validation, IRR provides policy constraints; together yield robust filter rules.
• C. They are redundant; either can be used alone.
• D. RPKI and IRR are unrelated to inbound filtering.

Answer: (B)

Pushing inbound filtering to be effective relies on two complementary pieces of data. RPKI gives you origin validation: it cryptographically binds a prefix to the AS that is authorized to originate it, so the router can drop updates that don’t match the ROA-based expectation. IRR provides policy constraints: routing policies and relationship-based rules stored in IRR objects tell you which origins should be allowed for which prefixes, how routes should be filtered, and what export or pref terms apply. When you use both, you enforce that only routes that comply with policy (IRR) are considered, and among those, only routes with a valid origin (RPKI) are accepted. This combination strengthens inbound filtering beyond what either data source could do alone. Options that swap the roles or claim redundancy miss how the two data sources operate: IRR is about policy, RPKI is about cryptographic origin, and they work together for robust filtering.