LPIC-2 Practice Test 9 — 10 Questions

Question 1

Which THREE of the following parameters can improve Samba file transfer performance under heavy load?

Accepted Answer

write raw = Yes. Enabling 'write raw = Yes' allows Samba to use the raw write SMB protocol, which sends larger write requests without waiting for intermediate acknowledgments, reducing protocol overhead and improving throughput under heavy load. This setting is particularly effective when combined with other performance tuning parameters.

Answer

strict allocate = Yes

Answer

oplocks = Yes

Question 2

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

Accepted Answer

The winbind service is not running.. The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Answer

The smb.conf file is missing the 'idmap config' lines.

Answer

The Kerberos ticket is expired.

Answer

The system clock is not synchronized with the domain controller.

Question 3

A Samba administrator needs to configure a share that allows only the user 'alice' and the group 'developers' to read and write files. Others should have no access. Which two parameters should be set in the share definition? (Choose two.)

Accepted Answer

valid users = alice, @developers. The 'valid users' parameter restricts access to only the specified users and groups, so setting 'valid users = alice, @developers' ensures only alice and members of the developers group can connect to the share. The 'write list' parameter grants write access to the listed users and groups, overriding any read-only setting; combining it with 'valid users' ensures that alice and the developers group have both read and write permissions, while all others are denied access entirely.

Answer

invalid users = alice, @developers

Answer

force user = alice

Answer

read list = alice, @developers

Question 4

A Samba share uses the 'acl_xattr' VFS module to store NT ACLs in extended attributes. The administrator runs 'getfattr -d /srv/share/file.txt' and sees no system attributes related to NT ACLs. What is the most likely cause?

Accepted Answer

The filesystem is not mounted with the 'user_xattr' option.. The 'acl_xattr' VFS module stores NT ACLs in extended attributes within the 'system' namespace. If 'getfattr -d' shows no system attributes, the most likely cause is that the underlying filesystem is not mounted with the 'user_xattr' option, which is required to enable extended attribute support. Without this mount option, the filesystem cannot store or retrieve extended attributes, so the NT ACL data is not persisted.

Answer

The VFS module is not loaded globally.

Answer

The share does not have 'nt acl support = yes' set.

Answer

The file's extended attributes are stored in a different namespace.

Question 5

A company develops a custom PCIe device driver as a kernel module. After installing a new kernel version 5.10.50 via a distribution update, the existing driver module fails to load with the error: 'insmod: ERROR: could not insert module mydriver.ko: Invalid module format'. The administrator checks the kernel version and sees that the module was compiled against a previous kernel version 5.10.45. The driver source code is available in /usr/src/mydriver. The administrator needs to get the driver working with the new kernel. Which of the following is the correct course of action?

Accepted Answer

Recompile the module using 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules'. The kernel module was compiled against a different kernel version (5.10.45) and the new kernel (5.10.50) has a different vermagic string, which includes the kernel version and other build parameters. The module must be recompiled against the new kernel's build tree located at /lib/modules/$(uname -r)/build to match the vermagic and ensure symbol compatibility. The command 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules' uses the kernel build system to compile the module against the running kernel's configuration and headers.

Answer

Copy the compiled .ko file to /lib/modules/5.10.50/kernel/drivers/misc/ and run 'depmod -a'

Answer

Edit the module's Makefile to change the version string to match the new kernel

Answer

Use 'modprobe --force mydriver' to bypass the version check

Question 6

Which TWO conditions are most likely to cause 'NT_STATUS_ACCESS_DENIED' when accessing a Samba share?

Accepted Answer

Linux filesystem permissions disallow write. Samba ultimately relies on the underlying Linux filesystem permissions to enforce write access. Even if Samba share permissions allow writing, if the Linux user or group mapped to the Samba session lacks write permission on the file or directory (e.g., due to chmod or ACL settings), the kernel will deny the write operation, resulting in NT_STATUS_ACCESS_DENIED. This is a common misconfiguration where administrators set share-level permissions correctly but forget to adjust the filesystem ACLs.

Answer

Lmhosts file misconfiguration

Answer

SMB protocol version mismatch

Answer

Windows firewall blocking port 445

Question 7

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

Accepted Answer

security = user. The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Answer

security = domain

Answer

security = server

Answer

security = share

Question 8

Which THREE commands are specifically used to diagnose Samba issues?

Accepted Answer

smbstatus. smbstatus is correct because it displays the current Samba connections, including active SMB sessions, open files, and locked files, which is essential for diagnosing who is accessing Samba shares and what resources are in use. It queries the Samba internal state via the smbd daemon, providing real-time diagnostic information about connected clients.

Answer

netstat

Answer

ping

Question 9

Refer to the exhibit. If a user on the local machine tries to SSH to a remote host on eth1, what will happen?

Accepted Answer

The connection will succeed because the OUTPUT chain accepts all.. The OUTPUT chain has a default policy of ACCEPT, meaning all outgoing packets, including SSH traffic (TCP port 22), are allowed by default. Since the user is initiating an SSH connection from the local machine, the packet traverses the OUTPUT chain, and with no explicit DROP or REJECT rule, it is permitted. The INPUT chain's default DROP policy only affects incoming packets, not outgoing connections.

Answer

The connection will succeed only if the remote host is on eth0.

Answer

The connection will fail because there is no rule accepting outgoing SSH.

Answer

The connection will fail because the INPUT chain drops all.

Question 10

An administrator wants to ensure a kernel module is loaded automatically at boot for a hardware device. Which file should be modified to add the module name?

Accepted Answer

/etc/modules-load.d/. The `/etc/modules-load.d/` directory contains configuration files that list kernel module names to be loaded automatically at boot by the `systemd-modules-load.service`. This is the standard mechanism in modern Linux distributions using systemd to ensure specific modules are loaded early in the boot process, before udev or other services handle device detection.

Answer

/etc/modprobe.d/blacklist.conf

Answer

/etc/udev/rules.d/

Answer

/proc/sys/kernel/