A building-permits office wants to accept only the provider-assigned blocks from its ISP and drop unexpected Internet prefixes. Which inbound BGP policy approach best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
Inbound filtering is the bouncer at the door: only the blocks you expect get in. A prefix-list on the ISP neighbor inbound is the classic way to keep junk Internet routes out of the permits office.
Full Explanation
A building-permits office that must accept only provider-assigned blocks and drop unexpected Internet prefixes needs an inbound BGP acceptance filter on the ISP session. The correct approach is an inbound prefix-list (or a route-map that matches a prefix-list/ACL) applied toward the ISP neighbor so only the expected aggregates or more-specifics enter the civic BGP table. Everything else is denied at update-processing time, which keeps junk, leaks, and full-table surprises out of the permits-office edge before they can influence the RIB or attract traffic.
Raising the ISP peer's administrative distance above OSPF so all eBGP routes are ignored fails the goal by discarding wanted and unwanted eBGP routes alike. Administrative distance chooses among sources already in the routing table; it is not a selective inbound BGP prefix filter for assigned blocks only.
Enabling next-hop-self on the eBGP session does not stop the ISP from advertising prefixes. next-hop-self rewrites the NEXT_HOP attribute when advertising routes (typically into iBGP); it is not an inbound prefix permit/deny policy and does not inherently block unexpected Internet NLRI.
Stripping private AS numbers outbound is an outbound AS_PATH hygiene action for routes you advertise. It does not evaluate or deny inbound unwanted prefixes from the ISP, so it cannot fulfill the permits office's accept-only-assigned-blocks requirement.
Exam caveat: know where the filter is applied (in vs out), that prefix-lists match length and prefix, and that soft-reconfiguration or route-refresh is needed to reapply policy without bouncing the session. Do not confuse AD tweaks, next-hop-self, or private-AS stripping with inbound prefix filtering.
Operational check: before and after the change, use show bgp neighbors <isp> routes / received-routes, confirm only assigned blocks appear in Loc-RIB, and test that a bogus more-specific or foreign prefix is denied. Validate the prefix-list sequence and that the route-map is bound inbound on the correct neighbor/address-family.