156-215.81.20 · Question #178
Name the authentication method that requires token authenticator.
The correct answer is A. SecureID. See the full explanation below for the reasoning.
Question
Name the authentication method that requires token authenticator.
Options
- ASecureID
- BRadius
- CDynamicID
- DTACACS
How the community answered
(50 responses)- A84% (42)
- B2% (1)
- C4% (2)
- D10% (5)
Community Discussion
8
Mateus R.Jun 7, 2026SecureID is the one that requires a token authenticator. Think of it like a keycard that generates a new number every 60 seconds, and you have to type that number plus your PIN to get in, so the physical token is a hard requirement, not optional, and that is exactly what RSA SecureID is built around.
Mei-Ling H.Jun 7, 2026Good description, just worth noting for the exam that the product name is RSA SecurID, no 'e' after Secur, because some questions use that exact spelling and it can trip you up if you are scanning fast, and also the PIN plus tokencode together is specifically called the passcode in RSA documentation, which is a term that shows up in some answer choices.
Ola B.Jun 4, 2026The gotcha here is DynamicID, which trips people up because it sounds token-like since it generates one-time codes, but Check Point's DynamicID delivers those codes via SMS or a mobile app, no physical or software token authenticator required. SecureID is the one built around a token authenticator, specifically the RSA token device or soft token that generates a time-synced passcode you combine with your PIN before it expires. RADIUS and TACACS are AAA protocols and can carry SecureID credentials as part of the flow, but neither one is itself the method that demands a token authenticator. Spin up a Check Point lab gateway, add a user in SmartConsole, and look at the authentication scheme dropdown side by side, it makes the distinction obvious fast.
Prof. SaraJun 6, 2026Solid breakdown, and the lab tip is the fastest cure for this confusion, though I would add that on the exam the SecureID trap goes one level deeper because candidates often forget that users present PIN-plus-passcode as a combined string, not separately, so any question phrasing that implies they authenticate with the passcode alone is a distractor pointing you away from SecureID.
Toby R.Jun 15, 2026SecureID is the one they're testing on here, it's the RSA token that generates a one-time code you physically carry around. Quick question though, do you remember if the exam distinguished between SecureID and DynamicID in terms of how the token is delivered, like hardware fob versus software or SMS based?
Mei-Ling H.Jun 11, 2026I kept second-guessing myself on this one because RADIUS feels like the obvious "token" answer since it is used so often in two-factor setups, but the question is asking specifically which method requires a token authenticator, and that word "requires" is the key. SecureID, which is RSA's product, is built around a physical or software token as a core requirement, not just an optional add-on, so A is the one they want here.
Prof. SaraJun 22, 2026The phrase "token authenticator" is the key discriminator here, and SecureID (A) is your answer, because RSA SecureID is the classic hardware or software token that generates a one-time passcode synchronized with an authentication server. A lot of students get pulled toward RADIUS (B) because RADIUS is the protocol that often carries the SecureID authentication traffic, but RADIUS itself is an authentication protocol framework, not the token mechanism, so conflating the carrier with the credential is a trap the exam sets deliberately. DynamicID (C) is Check Point's SMS-based one-time password solution and does involve a temporary code, but the token authenticator terminology maps specifically to the RSA-style token device, not an SMS delivery channel. Lock in A, understand that RADIUS and TACACS are protocols while SecureID is the actual token credential, and you will not fumble this question under pressure.
Ola B.Jun 22, 2026Solid breakdown, and the RADIUS-as-carrier point is the one worth drilling in a lab where you can watch the actual SecureID passcode ride inside a RADIUS Access-Request packet and see firsthand that swapping the credential for the protocol is exactly the trap.