Recap. Inside an AS use an IGP (OSPF/IS-IS link-state, or RIP/EIGRP distance-vector). Between ASes use BGP (path-vector, TCP 179). BGP path selection: highest LOCAL_PREF, shortest AS_PATH, lowest origin, lowest MED, eBGP over iBGP, lowest IGP metric, lowest router ID.
BGP assumes ASes trust each other and has no proof of ownership. A rogue/misconfigured AS announces a network it does not own (e.g. 8.8.8.0/24); because BGP trusts it, the fake route spreads worldwide and traffic is diverted (eavesdrop, black-hole, impersonation). RPKI adds a digital ID: a certificate/ROA proves which AS may announce which block; routers check announcements and reject false ones. Limits: RPKI secures the origin, not the whole path (forged-origin hijacks and route leaks remain), so it is used with MANRS and path validation.
MPLS: short fixed labels; ingress LER adds, LSRs swap via LFIB, egress removes; paths (LSPs) set up with RSVP-TE can reserve bandwidth and guarantee QoS. Reliable but expensive and slow to set up.
SD-WAN: encrypted tunnels (IPsec) over any link (MPLS/broadband/4G/5G); a central controller watches loss/delay/jitter and steers traffic dynamically. Cheap, flexible, central, but best-effort.
Choose SD-WAN for many branches, cost cutting, mixed links, cloud/SaaS traffic, fast central changes, tolerable best-effort. Keep MPLS for strict low steady delay, few critical sites, hard guarantees.