1Y0-350 · Question #127
Which type of authentication server could an engineer configure in order to provide the use of RSA token authentication as a permitted authentication method to access a AAA Virtual Server?
The correct answer is C. RADIUS. See the full explanation below for the reasoning.
Question
Which type of authentication server could an engineer configure in order to provide the use of RSA token authentication as a permitted authentication method to access a AAA Virtual Server?
Options
- ALDAP
- BSAML
- CRADIUS
- DNegotiate
How the community answered
(23 responses)- A4% (1)
- B4% (1)
- C74% (17)
- D17% (4)
Community Discussion
12
Ola B.Jun 10, 2026RADIUS is your answer here, and it makes sense once you think about how AAA works on a Citrix ADC. RADIUS is the authentication protocol built to handle token-based systems like RSA SecurID, because it acts as a broker between the ADC and the RSA Authentication Manager in the backend. When a user submits their PIN plus the one-time token, the ADC forwards that credential to the RADIUS server, which then talks to RSA and returns an accept or reject. LDAP is directory lookups for username and password, SAML is federated SSO assertions, and Negotiate is Kerberos and NTLM for Windows-integrated auth, so none of those fit the RSA token flow. Spin up a lab with a free RADIUS server like FreeRADIUS and a soft token app to see the handshake yourself before exam day.
Kemal J.Feb 17, 2026RADIUS is the right call here because it acts as a middleman that can hand off the actual authentication challenge to the RSA SecurID server, so Citrix just talks RADIUS and the token stuff happens behind the scenes. LDAP is directory lookups, SAML is federated web SSO, and Negotiate is Kerberos/NTLM territory, none of which have a native path to RSA token OTP flows the way RADIUS does.
Imani T.Feb 18, 2026RADIUS is dead-on for the SecurID integration, and worth adding that the Citrix gateway acts as a RADIUS client while RSA Authentication Manager is the actual RADIUS server doing the OTP validation, so that client-server distinction matters when you're troubleshooting auth failures or configuring shared secrets.
Hiroshi T.May 27, 2026I kept thinking LDAP, but RSA token support is RADIUS-specific per the Citrix ADC docs.
Ola B.May 27, 2026That is mostly right, but RADIUS is the authentication protocol carrying the token challenge, not the token tech itself, so you can actually pair RSA SecurID tokens with other RADIUS-speaking systems too, not just Citrix ADC.
Ingrid P.Feb 8, 2026I kept thinking LDAP, but RSA tokens are RADIUS protocol, full stop.
Luis F.Jun 27, 2026I honestly thought it was RADIUS right away but then second-guessed myself and almost picked LDAP because I kept mixing up directory services with auth protocols. What snapped me back was remembering that RADIUS is the one that actually supports token-based MFA like RSA SecurID natively, while LDAP is just a directory lookup service and wouldn't handle that token flow on its own.
Hiroshi T.Jun 28, 2026RADIUS does not natively understand RSA SecurID tokens on its own, the RADIUS server acts as the intermediary that proxies the credential to the RSA Authentication Manager, which is the component that actually validates the one-time passcode, per RSA's own integration documentation and RFC 2865.
Imani T.Feb 21, 2026LDAP is the move here because it handles token-based auth schemes through its directory service framework, and RSA tokens map cleanly to the attribute lookups LDAP performs when validating credentials against the AAA Virtual Server. I have seen this come up in lab environments where the engineer ties the RSA token policy directly into the directory entries, and LDAP is what makes that binding work.
Ingrid P.Feb 23, 2026Imani, good effort on the reasoning but RSA SecurID tokens use the SDI protocol to communicate with the AAA server, not LDAP, because SDI is the native protocol RSA Authentication Manager speaks for validating one-time passwords. LDAP handles directory attribute lookups for username and group data, which is a different job entirely.
Mateus R.Jun 15, 2026LDAP handles token-based auth natively, RSA integrates right into that directory lookup chain.
Ola B.Jun 15, 2026LDAP is a directory protocol for lookups and authentication, not built for token-based flows, so RSA SecurID plugs into RADIUS to handle the one-time token validation, which is why C is the correct pick.