LPIC-2 File Sharing and Samba Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A user reports that they can connect to the 'shared' share from a Windows client and read files, but cannot write any files. The share permissions on the filesystem are set to 777 on /srv/samba/shared. What is the most likely cause of the write failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The global 'create mask = 0700' restricts the permissions of newly created files, and the share is using a default user with no write permission.. The global `create mask = 0700` setting in the Samba configuration restricts the permissions of newly created files to owner-only read/write/execute. When a user connects to the share, Samba maps them to a default user (e.g., `nobody` or `guest`) if no specific user mapping is configured. Since the default user is not the owner of the files, the 0700 mask prevents write access, even though the filesystem permissions on `/srv/samba/shared` are 777. The `read only = no` in the share definition allows writes in principle, but the create mask overrides the effective permissions for file creation.

Answer

The 'guest ok = yes' parameter prevents writes for authenticated users.

Answer

The 'read only = no' parameter is overridden by the 'printable = yes' in the printers share.

Answer

The 'browseable = yes' parameter prevents writing by design.

Question 2

You are the administrator for a small office network with 20 Linux workstations and 5 Windows 10 clients. The company uses a Samba server (version 4.15) running on Ubuntu 22.04 to share a central directory /data with user-level security. Each user has a home directory on the server, and all users are in the 'staff' group. Recently, users have complained that they can access the /data share from Windows but cannot modify any files, even though they could before. The Samba configuration for the share is:

[data]
   path = /data
   browseable = yes
   read only = no
   valid users = @staff
   create mask = 0660
   directory mask = 0770
   force group = staff

You check the filesystem permissions on /data and find it is owned by root:staff with permissions 775. Files inside are owned by individual users and group staff with permissions 664. You also check smbstatus and see that users are connected as 'guest' rather than their actual username. What is the most likely cause of the problem?

Accepted Answer

The global 'map to guest = Bad User' setting is causing users who mistype their password to be mapped to the guest account, losing write permissions.. The 'map to guest = Bad User' global setting in Samba causes any user who fails authentication (e.g., due to a typo or incorrect password) to be mapped to the guest account. Since the share does not define a 'guest ok' or 'guest only' setting, and the guest account typically has no write permissions on the /data directory, users connected as guest cannot modify files. The smbstatus output confirming users are connected as 'guest' directly points to this misconfiguration.

Answer

The 'valid users = @staff' directive excludes root, so users cannot write because the share is owned by root.

Answer

The 'force group = staff' parameter overrides file ownership and prevents writes because the files are owned by root.

Answer

The 'create mask = 0660' is too restrictive and prevents users from writing to existing files.

Question 3

Match each RAID level to its description.

Accepted Answer

RAID 0: Striping without parity, provides improved performance but no fault tolerance.. RAID 0 offers performance without redundancy; RAID 1 offers mirroring; RAID 5 and RAID 6 offer striping with single and double parity respectively. Common confusions include swapping mirroring and striping descriptions.

Answer

RAID 5: Mirroring with parity, provides high performance and fault tolerance.

Answer

RAID 1: Striping without parity, maximizes storage capacity.

Question 4

An administrator configures a Samba share with guest access. After testing, guests are prompted for a password. Which directive should be added to the [global] section to allow guest access without a password?

Accepted Answer

map to guest = Bad User. The 'map to guest = Bad User' directive in the [global] section tells Samba to automatically map any login attempt with an invalid username to the guest account, bypassing password authentication. This is the correct setting to allow guest access without a password prompt, as it treats unknown users as guests.

Answer

guest account = nobody

Answer

security = user

Answer

encrypt passwords = yes

Question 5

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users report that SIDs are not being resolved correctly. Which service and configuration file are critical for ID mapping?

Accepted Answer

winbind and /etc/samba/smb.conf. When Samba is configured with 'security = ads' and joined to an Active Directory domain, the winbind service is responsible for resolving Windows SIDs to Unix UIDs/GIDs and vice versa. The critical configuration for ID mapping is defined in the 'idmap config' directives within /etc/samba/smb.conf, making winbind and smb.conf the correct pair. Without winbind running and proper idmap configuration, SID resolution will fail.

Answer

smbd and /etc/samba/smb.conf

Answer

winbind and /etc/security/pam_winbind.conf

Answer

nmbd and /etc/samba/smb.conf

Question 6

A Samba share is used by macOS clients. File names with special characters (e.g., ©) appear garbled. Which parameter should be added to the share configuration?

Accepted Answer

fruit:aapl = yes. The `fruit:aapl = yes` parameter enables the Samba VFS module for macOS (Apple Filing Protocol) compatibility, which handles special characters like © by mapping them to Unicode-compatible representations that macOS clients expect. Without this, macOS clients may misinterpret or garble filenames with non-ASCII characters when accessing Samba shares.

Answer

vfs objects = catia

Answer

dos charset = CP850

Answer

mangled names = yes

Question 7

A Samba share is configured with 'writable = no'. What does this mean?

Accepted Answer

The share is read-only.. When a Samba share is configured with 'writable = no', it explicitly denies write access to the share at the Samba level, regardless of underlying Unix file permissions. This directive overrides any other settings (like 'write list') and makes the share read-only for all clients connecting via SMB/CIFS protocols. The correct interpretation is that the share is read-only, which matches option A.

Answer

Users can read and write.

Answer

Only root can write.

Answer

Write access depends on Unix permissions.

Question 8

Which TWO commands can be used to list Samba shares on a remote server?

Accepted Answer

findsmb. Option D, findsmb, is correct because it is a Samba utility that probes the local subnet and prints a list of hosts along with their workgroup, NetBIOS name, and available SMB shares, so it can enumerate shares on a remote server. Option E, smbclient -L //server, is correct because the -L flag tells smbclient to list the services (shares) offered by the specified server, which is the standard way to query remote Samba shares. Option A, smbstatus, only reports current Samba connections, locked files, and share usage on the local server, not shares on a remote host. Option B, nmblookup -S server, resolves NetBIOS names and can show a node's services, but it does not enumerate SMB share names. Option C, net view \server, is a Windows command that lists shares, but it is not a Samba/Linux command and thus does not fit the Samba context of the question.

Answer

smbstatus

Answer

nmblookup -S server

Answer

net view \server

Question 9

Which TWO parameters in the [global] section are REQUIRED for a Samba server to act as a standalone server (not a member of a domain)?

Accepted Answer

workgroup. Option B (workgroup) is correct because a standalone Samba server must define the workgroup (or domain) name it belongs to in the [global] section, which determines the NetBIOS domain/workgroup context used for authentication and browsing. Option C (security = user) is correct because standalone servers authenticate clients against a local user database rather than a domain controller, and security = user is the required mode for this local, non-domain authentication model. Option A (server string) is only a descriptive comment shown in browse lists and is optional. Option D (netbios name) defaults to the hostname if omitted, so it is not required. Option E (passdb backend = tdbsam) is a common default for storing local accounts but is not a required parameter for standalone operation.

Answer

server string

Answer

netbios name

Answer

passdb backend = tdbsam

Question 10

Which THREE configuration directives are necessary to enable Winbind for Active Directory authentication on a Samba domain member?

Accepted Answer

security = ads. Option A (security = ads) is correct because a Samba domain member authenticating against Active Directory must run in ADS security mode, which makes Samba use Kerberos for authentication and treat the AD domain as its security authority. Option C (realm = EXAMPLE.COM) is correct because Winbind needs the Kerberos realm name (uppercase DNS form of the AD domain) to locate the KDC and obtain tickets for AD authentication. Option E (idmap config * : range = 10000-20000) is correct because Winbind requires an idmap range for the default domain so it can map non-domain and fallback SIDs to local Unix UIDs/GIDs; without a defined range, Winbind cannot allocate IDs and authentication/identity mapping fails. Option B (winbind use default domain = yes) is not required — it is a convenience setting that lets users log in without the DOMAIN\ prefix, but Winbind works without it. Option D (workgroup = EXAMPLE) is not required for AD authentication; the workgroup parameter is used for NT4-style domains and is not the directive that binds Samba to the AD realm.

Answer

winbind use default domain = yes

Answer

workgroup = EXAMPLE

Question 11

Refer to the exhibit. A user attempts to access the 'public' share without authentication. What will be the outcome?

Accepted Answer

Access granted as guest because map to guest = Bad User and guest ok = yes. The Samba configuration combines `map to guest = Bad User` with `guest ok = yes`. When a user attempts to access the 'public' share without authentication, Samba treats the connection as a guest due to the 'Bad User' mapping (since no valid credentials were provided). The `guest ok = yes` directive then explicitly grants access to the share, allowing the user to connect as the guest account (typically 'nobody').

Answer

Access denied because security = user

Answer

Access denied because read only = yes

Answer

Access granted with full read/write because guest ok = yes

Question 12

Refer to the exhibit. What does the output indicate about the user John Doe's access to the file report.txt?

Accepted Answer

The user has a read lock with no deny mode.. The output shows that John Doe has a read lock on report.txt with no deny mode, meaning other processes can still read the file while he holds the lock. This is indicated by the lock type 'R' (read) and the absence of a deny mode (deny mode 'NONE'). In Samba, a read lock with no deny mode allows concurrent read access but prevents write access from other clients.

Answer

The user has a lease lock.

Answer

The file is opened for writing.

Answer

The user has an exclusive write lock.

Question 13

Refer to the exhibit. A user cannot connect to the 'share2' Samba share. What is the most likely cause?

Accepted Answer

The share path does not exist or is not accessible.. The most common cause of a user being unable to connect to a Samba share is that the share path specified in the smb.conf file does not exist or is not accessible by the Samba service. Samba does not create the underlying directory; it only maps the share name to a path. If the path is missing, permissions are wrong, or the filesystem is not mounted, the connection will fail with an error like 'NT_STATUS_OBJECT_PATH_NOT_FOUND'.

Answer

The Samba service is not running.

Answer

The user does not have permission to read the share.

Answer

The share name is too long.

Question 14

A new user needs access to a Samba share. The administrator adds the user to the system with `adduser alice` and then sets up a Samba password. Which command is used to set the Samba password?

Accepted Answer

smbpasswd -a alice. The correct command is `smbpasswd -a alice`. This command adds a new user to the Samba password database and sets their initial Samba password. The `-a` flag specifically indicates that the user should be added to the local Samba user database (smbpasswd file or tdbsam), which is required before the user can authenticate to Samba shares.

Answer

passwd -a alice

Answer

pdbedit -a -u alice

Answer

net ads user add alice

Question 15

An organization runs a Samba server in standalone mode. They want to allow anonymous (guest) access to a public share. Which configuration option enables guest access for a share?

Accepted Answer

map to guest = Bad User and guest ok = yes. Samba requires both `map to guest = Bad User` (which tells Samba to treat any connection attempt with an invalid username as a guest connection) and `guest ok = yes` (which explicitly permits guest access to the share). Without both, anonymous access will be denied. The `map to guest` directive can also be set to `Bad Password` or `Never`, but `Bad User` is the typical choice for public shares.

Answer

anonymous = yes

Answer

security = share

Answer

guest account = nobody