hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A company uses BGP to exchange routes with its ISP
A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?
⚠ Common exam trap
ISC2 often tests BGP MD5 authentication as a security measure, but the trap here is confusing session-level authentication (MD5) with route-level validation (RPKI), leading candidates to choose A because they think 'authentication' covers route integrity, when it only protects the BGP session itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RPKI
RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BGP MD5 authentication
Why it's wrong here
BGP MD5 authentication secures the BGP session itself by cryptographically validating the identity of the BGP peer sending updates, preventing unauthorized routers from establishing sessions or tampering with BGP messages in transit. However, it does not verify the legitimacy of the IP prefix being advertised or whether the originating Autonomous System (AS) is authorized to announce that prefix. Therefore, it cannot prevent a legitimate but compromised peer from advertising hijacked routes.
- ✗
BGP community values
Why it's wrong here
BGP community values are optional, transitive attributes used to tag routes for applying specific routing policies or for informational purposes within and between Autonomous Systems. While they can influence routing decisions, such as local preference or export policies, they are purely informational and lack any cryptographic mechanism to validate the authoritative ownership or origin of an IP prefix. Consequently, community values offer no defense against route hijacking, as they do not verify the legitimacy of the advertised prefix's origin.
- ✓
RPKI
Why this is correct
Resource Public Key Infrastructure (RPKI) provides a robust cryptographic framework for validating the origin of IP prefixes, directly addressing route hijacking. It enables legitimate IP address holders to create cryptographically signed Route Origin Authorizations (ROAs), which explicitly state which Autonomous System (AS) is authorized to originate specific IP prefixes. Routers can then use these ROAs to verify the authenticity of BGP announcements, filtering out routes where the advertised origin AS does not match the authorized AS, thereby effectively mitigating route hijacking.
- ✗
AS-path filtering
Why it's wrong here
AS-path filtering involves configuring routers to accept or reject BGP routes based on the sequence of Autonomous Systems listed in the AS_PATH attribute. This technique is primarily used to prevent routing loops, enforce peering policies, or filter out clearly invalid or undesirable paths based on the path's length or specific ASes present. However, AS-path filtering relies on the accuracy of the advertised AS path and does not cryptographically verify the *origin* of the prefix or whether the originating AS is the legitimate owner, thus failing to prevent a malicious AS from announcing a prefix it doesn't own.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.