EAP-GTC, or EAP Generic Token Card, supports authentication using token-based or one-time-password credentials. It can operate within a protected EAP method, such as PEAP, so that the token credentials are transmitted through an encrypted TLS tunnel. This makes it appropriate when Cisco Secure Client users authenticate against an LDAP-backed token system. MS-CHAPv2 is primarily designed for username-and-password authentication and requires password-verification capabilities that generic LDAP or token systems may not provide. LEAP is a legacy Cisco authentication method with known security weaknesses and should not be selected for a new secure deployment. EAP-MD5 provides only basic challenge-response authentication, lacks mutual authentication, and does not provide suitable protection for wireless enterprise access. Therefore, EAP-GTC is the protocol aligned with secure-token authentication through Cisco Secure Client.