LPIC-2 File Sharing and Samba Practice Test 3 — 15 Questions

Question 1

A Samba server uses 'security = domain' with an NT4-style domain. After a domain controller outage, users cannot authenticate. Which configuration change would allow fallback to local authentication?

Accepted Answer

Set 'security = user' and 'passdb backend = tdbsam'. When a Samba server is configured with 'security = domain', it relies on a remote NT4-style domain controller for authentication. If the domain controller is unavailable, users cannot authenticate because Samba has no local fallback. Changing to 'security = user' and setting 'passdb backend = tdbsam' switches Samba to authenticate users against its own local password database (tdbsam), allowing authentication even when the domain controller is down.

Answer

Set 'domain master = no'

Answer

Set 'local master = yes'

Answer

Set 'preferred master = no'

Question 2

A Samba share is configured with 'writable = no'. What does this mean?

Accepted Answer

The share is read-only.. When a Samba share is configured with 'writable = no', it explicitly denies write access to the share at the Samba level, regardless of underlying Unix file permissions. This directive overrides any other settings (like 'write list') and makes the share read-only for all clients connecting via SMB/CIFS protocols. The correct interpretation is that the share is read-only, which matches option A.

Answer

Users can read and write.

Answer

Only root can write.

Answer

Write access depends on Unix permissions.

Question 3

In a Samba domain member server, which file contains the SID to Unix ID mappings?

Accepted Answer

/var/lib/samba/winbindd_idmap.tdb. B is correct because Samba domain member servers use the winbindd service to map Windows SIDs to Unix UIDs/GIDs, and these mappings are stored in the `winbindd_idmap.tdb` file located in `/var/lib/samba/`. This TDB (Trivial Database) file maintains the persistent ID mapping database, which is essential for translating between the two security identifier systems.

Answer

/etc/group

Answer

/var/lib/samba/private/secrets.tdb

Answer

/etc/passwd

Question 4

A Samba server is configured with 'vfs objects = recycle' to implement a recycle bin. After some time, users notice that deleted files are not appearing in the recycle bin. Which parameter is likely misconfigured?

Accepted Answer

recycle:repository. The `vfs objects = recycle` module requires the `recycle:repository` parameter to specify the directory where deleted files should be moved. If this parameter is missing or misconfigured, the recycle bin will not function, and deleted files will be permanently removed instead of being stored in the recycle repository.

Answer

recycle:maxsize

Answer

recycle:keeptree

Answer

recycle:versions

Question 5

Which TWO commands can be used to list Samba shares on a remote server?

Accepted Answer

findsmb. Option D is correct because `findsmb` is a utility that scans the local subnet for Samba/CIFS servers and lists their shares. Option E is correct because `smbclient -L //server` queries the specified remote server for its available shares using the SMB protocol, making it a direct and reliable method for listing shares.

Answer

smbstatus

Answer

nmblookup -S server

Answer

net view \server

Question 6

Which TWO parameters in the [global] section are REQUIRED for a Samba server to act as a standalone server (not a member of a domain)?

Accepted Answer

workgroup. For a Samba standalone server, the `workgroup` parameter defines the NetBIOS workgroup name that the server will appear in, which is essential for browsing and identification on the local network. The `security = user` parameter is required because it sets the server to authenticate users locally against its own passdb backend, rather than relying on an external domain controller. Without these two, the server cannot function as a standalone unit.

Answer

server string

Answer

netbios name

Answer

passdb backend = tdbsam

Question 7

Which THREE configuration directives are necessary to enable Winbind for Active Directory authentication on a Samba domain member?

Accepted Answer

security = ads. Option A is correct because setting 'security = ads' tells Samba to operate as an Active Directory domain member, using Kerberos for authentication and LDAP for identity lookups. This directive is mandatory for Winbind to communicate with an AD domain controller.

Answer

winbind use default domain = yes

Answer

workgroup = EXAMPLE

Question 8

Refer to the exhibit. A user attempts to access the 'public' share without authentication. What will be the outcome?

Accepted Answer

Access granted as guest because map to guest = Bad User and guest ok = yes. Option B is correct because the Samba configuration combines `map to guest = Bad User` with `guest ok = yes`. When a user attempts to access the 'public' share without authentication, Samba treats the connection as a guest due to the 'Bad User' mapping (since no valid credentials were provided). The `guest ok = yes` directive then explicitly grants access to the share, allowing the user to connect as the guest account (typically 'nobody').

Answer

Access denied because security = user

Answer

Access denied because read only = yes

Answer

Access granted with full read/write because guest ok = yes

Question 9

Refer to the exhibit. What does the output indicate about the user John Doe's access to the file report.txt?

Accepted Answer

The user has a read lock with no deny mode.. The output shows that John Doe has a read lock on report.txt with no deny mode, meaning other processes can still read the file while he holds the lock. This is indicated by the lock type 'R' (read) and the absence of a deny mode (deny mode 'NONE'). In Samba, a read lock with no deny mode allows concurrent read access but prevents write access from other clients.

Answer

The user has a lease lock.

Answer

The file is opened for writing.

Answer

The user has an exclusive write lock.

Question 10

Refer to the exhibit. A user cannot connect to the 'share2' Samba share. What is the most likely cause?

Accepted Answer

The share path does not exist or is not accessible.. Option D is correct because the most common cause of a user being unable to connect to a Samba share is that the share path specified in the smb.conf file does not exist or is not accessible by the Samba service. Samba does not create the underlying directory; it only maps the share name to a path. If the path is missing, permissions are wrong, or the filesystem is not mounted, the connection will fail with an error like 'NT_STATUS_OBJECT_PATH_NOT_FOUND'.

Answer

The Samba service is not running.

Answer

The user does not have permission to read the share.

Answer

The share name is too long.

Question 11

An administrator wants to restrict access to a Samba share based on client IP addresses. Which parameter in the [share] section of smb.conf should be used?

Accepted Answer

hosts allow. The `hosts allow` parameter in the `[share]` section of `smb.conf` restricts access to the Samba share based on client IP addresses or subnets. It is the correct directive for IP-based access control, allowing the administrator to specify which hosts are permitted to connect. This parameter is evaluated before authentication, blocking unauthorized IPs at the connection level.

Answer

allow hosts

Answer

browseable

Answer

valid users

Question 12

After modifying /etc/samba/smb.conf, an administrator runs a command to validate the configuration. Which command is correct?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to validate the syntax and configuration of the `/etc/samba/smb.conf` file. It checks for errors in parameters, missing sections, and logical inconsistencies without restarting the Samba services, making it the standard tool for configuration verification.

Answer

smbpasswd

Answer

smbcontrol

Answer

samba-tool

Question 13

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

Accepted Answer

The winbind service is not running.. The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Answer

The smb.conf file is missing the 'idmap config' lines.

Answer

The Kerberos ticket is expired.

Answer

The system clock is not synchronized with the domain controller.

Question 14

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. Option B is correct because it uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 15

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Option D is correct because disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no