Quick Answer

The answer is that EAP-GTC matches to Generic Token Card for one-time password authentication, while EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses a Protected Access Credential (PAC), and EAP-MD5 relies on a simple password hash. This mapping is correct because each EAP method defines a specific credential type and exchange mechanism: EAP-TLS requires mutual certificate-based authentication, PEAP creates a TLS tunnel to protect inner MSCHAPv2 exchanges, EAP-FAST uses a PAC for symmetric-key authentication, and EAP-MD5 sends only a hashed password with no server authentication. On the ENCOR 350-401 exam, this drag-and-drop task tests your ability to distinguish between certificate-based, token-based, tunneled, and shared-secret methods—a common trap is confusing PEAP with EAP-TLS since both use TLS, but PEAP tunnels a secondary protocol like MSCHAPv2. For a memory tip, remember that “TLS” stands for certificates, “GTC” for a token code, “FAST” for a pre-shared PAC, “PEAP” for a tunneled inner method, and “MD5” for a simple hash—just think of the acronym “TGPFM” (TLS, GTC, PEAP, FAST, MD5) to lock in the pairings.