LPIC-2 File Sharing and Samba Practice Test 2 — 15 Questions

Question 1

Given the smb.conf exhibit, which share(s) allow write access to user 'alice' who is a member of the 'staff' group?

Accepted Answer

share1 only. In the smb.conf exhibit, share1 has 'write list = @staff' which grants write access to all members of the staff group, including user alice. share2 has 'read only = yes' and no write list, so it is read-only for everyone. share3 has 'valid users = bob' and 'write list = bob', so only bob can write; alice is not listed and is not in the bob group, so she has no write access.

Answer

share1 and share3

Answer

share3 only

Answer

share2 only

Question 2

Based on the smbstatus output, which statement is true?

Accepted Answer

User 'alice' connected from IP 192.168.1.10 using SMB3 protocol. The smbstatus output shows that user 'alice' is connected from IP address 192.168.1.10 and the 'Protocol' column explicitly lists 'SMB3_11', which is a variant of the SMB3 protocol. This directly matches the statement in option A that alice is using SMB3 protocol.

Answer

Both users are using SMB2 protocol

Answer

User 'bob' is accessing share2 with write permissions

Answer

User 'alice' has an exclusive lock on report.pdf

Question 3

Your company runs a Samba file server (version 4.15) in a mixed environment with Windows 10 and Linux clients. The server is part of an Active Directory domain. Recently, a new security policy requires that all SMB connections use SMB3 encryption. You have configured 'smb encrypt = required' in the [global] section of smb.conf and restarted smbd. However, Windows clients report that they cannot connect to the server, while Linux clients can connect using mount.cifs with the 'seal' option. You check smb.conf and verify that 'server min protocol = SMB3' is set. What is the most likely cause of the Windows clients' inability to connect?

Accepted Answer

Windows clients do not have SMB encryption enabled by default, so they reject the required encryption. Windows 10 clients do not enable SMB encryption by default; they require the client to request encryption, but when the server sets 'smb encrypt = required', the server demands encryption on all connections. Windows clients without explicit encryption configuration (e.g., via Group Policy or registry) will fail to connect because they do not negotiate SMB3 encryption automatically. Linux clients succeed because mount.cifs with the 'seal' option explicitly requests encryption, matching the server's requirement.

Answer

The 'server min protocol = SMB3' should be 'SMB2' to allow Windows 10 to negotiate SMB3

Answer

The Samba server must be joined to the domain again after changing encryption settings

Answer

The 'smb encrypt' parameter is deprecated and should be replaced by 'server smb encrypt'

Question 4

A system administrator wants to configure a Samba share that grants read-only access to the 'staff' group and full control to the 'managers' group. Which share configuration achieves this?

Accepted Answer

[share]
path = /srv/share
valid users = +staff
write list = @managers. The `valid users = +staff` directive restricts access to members of the 'staff' group (the `+` prefix means a Unix group), while the `write list = @managers` directive grants write access to members of the 'managers' group (the `@` prefix also means a Unix group). This combination ensures that 'staff' members have read-only access by default, and 'managers' members have full control (read/write).

Answer

[share]
path = /srv/share
valid users = @managers
write list = @managers

Answer

[share]
path = /srv/share
valid users = +staff
write list = +managers

Answer

[share]
path = /srv/share
valid users = @staff
write list = @staff

Question 5

A Linux server running Samba as a domain member is experiencing slow authentication for users. Which two configuration changes are most likely to improve authentication performance?

Accepted Answer

Enable 'winbind offline logon = yes'. Enabling 'winbind offline logon = yes' allows winbind to cache user credentials locally, so authentication can proceed without contacting the domain controller if it is temporarily unreachable, reducing latency for repeated logins. Option C is correct because setting 'idmap config * : backend = tdb' stores ID mappings (UID/GID to SID) in a local tdb database, avoiding repeated queries to the domain controller for mapping resolution, which directly improves authentication performance in a domain member setup.

Answer

Disable SMB signing by setting 'server signing = disabled'

Answer

Change 'security = ADS' to 'security = user'

Answer

Set 'name resolve order = lmhosts host wins bcast'

Question 6

A Samba server is configured as a print server. Clients running Windows 10 report that printer drivers cannot be uploaded. The relevant smb.conf section is:

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
printable = yes

What is the most likely cause?

Accepted Answer

The 'guest ok = yes' directive is missing. The 'printable = yes' directive is present, so option A is not the issue. The 'path' /var/spool/samba is the standard spool directory for Samba print jobs, so option B is incorrect. The 'browseable = no' only hides the share from browsing, but does not prevent driver uploads; Windows clients can still connect directly. The most likely cause is that 'guest ok = yes' is missing, because by default Samba requires authentication for printer shares, and Windows 10 clients attempting to upload drivers often do so under the guest account (or without valid credentials) unless the share explicitly allows guest access. Without 'guest ok = yes', the upload is denied.

Answer

The 'printable = yes' directive is missing

Answer

The 'path' is incorrectly set to /var/spool/samba

Answer

The 'browseable = no' directive prevents driver discovery

Question 7

Which TWO of the following are valid ways to map a Windows user to a Linux account in Samba?

Accepted Answer

Using a 'username map' file specified by the 'username map' parameter. The 'username map' parameter in smb.conf specifies a file (e.g., /etc/samba/smbusers) that maps Windows usernames to Linux usernames, allowing Samba to translate incoming Windows user credentials to a corresponding Linux account. Option B is correct because 'force user' in a share definition forces all connections to that share to run as a specific Linux user, effectively mapping any Windows user to that Linux account for file operations. Both are valid ways to map Windows users to Linux accounts in Samba.

Answer

Using the 'map user' command in smbpasswd

Answer

Setting 'winbind use default domain = yes'

Answer

Using the 'valid users' directive in smb.conf

Question 8

A company runs a mixed Linux/Windows environment. The Samba server (version 4.15) is configured as a domain member using 'security = ADS'. Recently, the IT team enabled 'winbind use default domain = yes' to simplify logins. After the change, users report that they can no longer access Samba shares when authenticating with just their username (e.g., 'jdoe') instead of 'DOMAIN\jdoe'. However, authentication using the full domain-qualified name still works. The smb.conf includes:

[global]
security = ADS
workgroup = MYDOM
realm = MYDOM.LOCAL
winbind use default domain = yes
winbind separator = /

Users are in the 'Domain Users' group and the share configuration is:
[share]
path = /srv/share
valid users = @"MYDOM\domain users"

Which of the following is the most likely cause and solution?

Accepted Answer

Change 'winbind separator' to backslash or remove it to default to backslash. When 'winbind use default domain = yes' is set, Samba expects the winbind separator to be a backslash (\), not a forward slash (/). With a forward slash separator, the username 'jdoe' is not correctly mapped to 'MYDOM\jdoe' during authentication, causing access failures. Changing the separator to backslash (or removing it to default to backslash) resolves the issue by aligning with Samba's internal handling of default domain usernames.

Answer

Disable 'winbind use default domain' to force full domain qualification

Answer

The valid users line uses quotes around the group name; remove the quotes

Answer

Enable 'winbind offline logon' to allow cached credentials

Question 9

Refer to the exhibit. A user reports that they can connect to the 'shared' share from a Windows client and read files, but cannot write any files. The share permissions on the filesystem are set to 777 on /srv/samba/shared. What is the most likely cause of the write failure?

Accepted Answer

The global 'create mask = 0700' restricts the permissions of newly created files, and the share is using a default user with no write permission.. The global `create mask = 0700` setting in the Samba configuration restricts the permissions of newly created files to owner-only read/write/execute. When a user connects to the share, Samba maps them to a default user (e.g., `nobody` or `guest`) if no specific user mapping is configured. Since the default user is not the owner of the files, the 0700 mask prevents write access, even though the filesystem permissions on `/srv/samba/shared` are 777. The `read only = no` in the share definition allows writes in principle, but the create mask overrides the effective permissions for file creation.

Answer

The 'guest ok = yes' parameter prevents writes for authenticated users.

Answer

The 'read only = no' parameter is overridden by the 'printable = yes' in the printers share.

Answer

The 'browseable = yes' parameter prevents writing by design.

Question 10

You are the administrator for a small office network with 20 Linux workstations and 5 Windows 10 clients. The company uses a Samba server (version 4.15) running on Ubuntu 22.04 to share a central directory /data with user-level security. Each user has a home directory on the server, and all users are in the 'staff' group. Recently, users have complained that they can access the /data share from Windows but cannot modify any files, even though they could before. The Samba configuration for the share is:

[data]
   path = /data
   browseable = yes
   read only = no
   valid users = @staff
   create mask = 0660
   directory mask = 0770
   force group = staff

You check the filesystem permissions on /data and find it is owned by root:staff with permissions 775. Files inside are owned by individual users and group staff with permissions 664. You also check smbstatus and see that users are connected as 'guest' rather than their actual username. What is the most likely cause of the problem?

Accepted Answer

The global 'map to guest = Bad User' setting is causing users who mistype their password to be mapped to the guest account, losing write permissions.. The 'map to guest = Bad User' global setting in Samba causes any user who fails authentication (e.g., due to a typo or incorrect password) to be mapped to the guest account. Since the share does not define a 'guest ok' or 'guest only' setting, and the guest account typically has no write permissions on the /data directory, users connected as guest cannot modify files. The smbstatus output confirming users are connected as 'guest' directly points to this misconfiguration.

Answer

The 'valid users = @staff' directive excludes root, so users cannot write because the share is owned by root.

Answer

The 'force group = staff' parameter overrides file ownership and prevents writes because the files are owned by root.

Answer

The 'create mask = 0660' is too restrictive and prevents users from writing to existing files.

Question 11

Arrange the steps to configure a Linux system as an Apache virtual host.

Accepted Answer

1. Create document root, 2. Create site configuration, 3. Enable the site, 4. Reload Apache, 5. Test. The correct order to configure an Apache virtual host is: first, create the document root directory with appropriate permissions; second, create a site configuration file in /etc/apache2/sites-available/; third, enable the site using a2ensite; fourth, reload Apache with systemctl reload apache2; fifth, test by accessing the site. Option A follows this sequence. Option B is incorrect because the site configuration must be created before enabling. Option C is incorrect because enabling occurs after configuration creation. Option D is incorrect because reloading must happen after enabling.

Answer

1. Create site configuration, 2. Create document root, 3. Enable the site, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Enable the site, 3. Create site configuration, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Create site configuration, 3. Reload Apache, 4. Enable the site, 5. Test

Question 12

Match each RAID level to its description.

Accepted Answer

RAID 0: Striping without parity, provides improved performance but no fault tolerance.. RAID 0 offers performance without redundancy; RAID 1 offers mirroring; RAID 5 and RAID 6 offer striping with single and double parity respectively. Common confusions include swapping mirroring and striping descriptions.

Answer

RAID 5: Mirroring with parity, provides high performance and fault tolerance.

Answer

RAID 1: Striping without parity, maximizes storage capacity.

Question 13

An administrator configures a Samba share with guest access. After testing, guests are prompted for a password. Which directive should be added to the [global] section to allow guest access without a password?

Accepted Answer

map to guest = Bad User. The 'map to guest = Bad User' directive in the [global] section tells Samba to automatically map any login attempt with an invalid username to the guest account, bypassing password authentication. This is the correct setting to allow guest access without a password prompt, as it treats unknown users as guests.

Answer

guest account = nobody

Answer

security = user

Answer

encrypt passwords = yes

Question 14

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users report that SIDs are not being resolved correctly. Which service and configuration file are critical for ID mapping?

Accepted Answer

winbind and /etc/samba/smb.conf. When Samba is configured with 'security = ads' and joined to an Active Directory domain, the winbind service is responsible for resolving Windows SIDs to Unix UIDs/GIDs and vice versa. The critical configuration for ID mapping is defined in the 'idmap config' directives within /etc/samba/smb.conf, making winbind and smb.conf the correct pair. Without winbind running and proper idmap configuration, SID resolution will fail.

Answer

smbd and /etc/samba/smb.conf

Answer

winbind and /etc/security/pam_winbind.conf

Answer

nmbd and /etc/samba/smb.conf

Question 15

A Samba share is used by macOS clients. File names with special characters (e.g., ©) appear garbled. Which parameter should be added to the share configuration?

Accepted Answer

fruit:aapl = yes. The `fruit:aapl = yes` parameter enables the Samba VFS module for macOS (Apple Filing Protocol) compatibility, which handles special characters like © by mapping them to Unicode-compatible representations that macOS clients expect. Without this, macOS clients may misinterpret or garble filenames with non-ASCII characters when accessing Samba shares.

Answer

vfs objects = catia

Answer

dos charset = CP850

Answer

mangled names = yes