LPIC-2 File Sharing and Samba Practice Test 3 — 15 Questions

Question 1

A Samba server is configured as a classic PDC (Primary Domain Controller) for a legacy network. The administrator needs to add a new machine account for a client joining the domain. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

smbpasswd -a -m MACHINENAME. In a classic Samba PDC (Primary Domain Controller) setup, machine accounts are stored in the `smbpasswd` file (or tdbsam) and are added using `smbpasswd -a -m MACHINENAME`. The `-m` flag specifically indicates a machine account, which appends a `$` to the name and sets the appropriate flags for domain membership. This command creates the machine trust account that the client uses to join the domain.

Answer

samba-tool domain add machinename

Answer

net rpc join machinename

Answer

pdbedit -a -m MACHINENAME

Question 2

Which TWO of the following are common symptoms of a misconfigured winbind service when Samba is joined to an Active Directory domain?

Accepted Answer

`getent passwd` does not list domain users.. When winbind is misconfigured, the Name Service Switch (NSS) module may not be properly set up to query winbind for domain users. This means `getent passwd` will not return domain users even if winbind itself can enumerate them via `wbinfo -u`. The core issue is that NSS is not configured to use the `winbind` source in `/etc/nsswitch.conf`, or the winbind service is not correctly communicating with the NSS subsystem.

Answer

`net ads join` fails with 'access denied'.

Answer

Domain users cannot authenticate via SSH.

Question 3

Which THREE of the following parameters can improve Samba file transfer performance under heavy load?

Accepted Answer

write raw = Yes. Option C (write raw = Yes) is correct because it enables Samba's raw write SMB requests, allowing larger block writes that bypass some protocol overhead and improve throughput under heavy load. Option D (socket options = TCP_NODELAY IPTOS_LOWDELAY) is correct because TCP_NODELAY disables Nagle's algorithm to reduce latency for small packets, and IPTOS_LOWDELAY sets the IP TOS bits to prioritize low delay, both benefiting transfer responsiveness under load. Option E (read raw = Yes) is correct because it enables raw read SMB requests, permitting larger read blocks and reducing per-request overhead, which boosts read performance. Option A (strict allocate = Yes) is not among the marked answers; it controls whether Samba preallocates the full file size on disk to avoid fragmentation, which affects disk usage behavior rather than directly improving transfer throughput. Option B (oplocks = Yes) is also unmarked; opportunistic locks improve client-side caching and reduce network round-trips in many workloads, but it is not one of the three parameters specified as correct here.

Answer

strict allocate = Yes

Answer

oplocks = Yes

Question 4

A client reports that the [public] share is visible but all files appear read-only. What is the cause?

Accepted Answer

The read only = yes parameter forces read-only access.. The `read only = yes` parameter in a Samba share definition explicitly forces all files to appear read-only to clients, regardless of underlying filesystem permissions. This overrides any other permission settings and is the direct cause of the reported behavior where the share is visible but all files are read-only.

Answer

The create mask = 0755 denies write permissions.

Answer

The guest account nobody has no write permission on the file system.

Answer

The map to guest = Bad User is causing all users to be treated as guest.

Question 5

A company recently upgraded their Samba server from version 4.8 to 4.13. Users report that they can connect to shares but cannot write files. The Samba team verified that the share configuration has 'writable = yes' and the Linux filesystem permissions are correct (777). Which global parameter is most likely causing the issue?

Accepted Answer

server min protocol = SMB2_02. Samba 4.13 defaults to requiring SMB3_11 as the minimum protocol, which provides features like persistent handles and leases. If the administrator sets 'server min protocol = SMB2_02', the server allows SMB2 connections, but SMB2 does not support these features. Consequently, clients can connect but may fail to write files if the share configuration relies on persistent handles or if the client expects SMB3 features. The upgrade from 4.8 to 4.13 changed the default minimum protocol from SMB2_02 to SMB3_11, and explicitly overriding it to SMB2_02 can lead to write failures.

Answer

security = user

Answer

map to guest = Bad User

Answer

workgroup = EXAMPLE

Question 6

A Samba server is configured to store NT ACLs on a Linux filesystem that does not support them natively. Which VFS module should be used to map NT ACLs to POSIX ACLs?

Accepted Answer

vfs objects = acl_xattr. The `acl_xattr` VFS module is specifically designed to store NT ACLs in extended attributes on a Linux filesystem that lacks native NT ACL support. When Samba is configured with `vfs objects = acl_xattr`, it maps Windows NT ACLs to POSIX ACLs by serializing the NT ACL into the `user.NTACL` extended attribute, allowing Samba to enforce Windows-style permissions even on filesystems like ext4 or XFS that only support POSIX ACLs natively.

Answer

vfs objects = recycle

Answer

vfs objects = full_audit

Answer

vfs objects = streams_xattr

Question 7

An organization is using Samba as a PDC with an LDAP backend for user accounts. Which idmap backend configuration is appropriate for RFC 2307?

Accepted Answer

idmap config * : backend = ldap. When Samba is configured as a PDC with an LDAP backend for user accounts and RFC 2307 is used, the idmap backend must be set to `ldap` to store and retrieve Unix UID/GID mappings directly from the LDAP directory. This ensures that the POSIX attributes (uidNumber, gidNumber) defined in LDAP are used consistently across all Samba clients, which is the core requirement of RFC 2307.

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = rid

Question 8

A Samba share is intended for guest (anonymous) access. Which global parameter must be set to allow this?

Accepted Answer

map to guest = Bad User. The `map to guest = Bad User` parameter in Samba's global configuration forces any connection attempt with an invalid or non-existent username to be treated as a guest (anonymous) login. This is the standard way to allow anonymous access to shares while still using `security = user` (the default in modern Samba), as it maps failed authentication to the guest account.

Answer

guest account = nobody

Answer

security = share

Answer

security = user

Question 9

Samba is integrated with Active Directory using security = ads. Which service is required for Kerberos authentication?

Accepted Answer

smbd. When Samba is integrated with Active Directory using `security = ads`, Kerberos authentication is handled by the `smbd` daemon. `smbd` is responsible for authenticating incoming SMB connections, and in an AD domain it uses the Kerberos protocol (via the GSSAPI) to validate tickets presented by clients. Without `smbd`, no Kerberos-based authentication can occur for SMB/CIFS services.

Answer

winbindd

Answer

samba

Answer

nmbd

Question 10

Which TWO global parameters can be used to control the security mode of a Samba server?

Accepted Answer

security. Option A, the `security` parameter, is correct because it is the primary global smb.conf setting that selects the server's authentication mode, with valid values such as `user`, `share`, `server`, `domain`, and `ads`, directly determining how Samba authenticates clients. Option B, `map to guest`, is also correct because it controls how failed or invalid authentication attempts are handled by mapping them to the guest account, with values like `Never`, `Bad User`, `Bad Password`, and `Bad UID`, which effectively governs guest-level access behavior tied to the security mode. Option C, `netbios name`, is incorrect because it only sets the NetBIOS name by which the Samba server is known on the network, not its authentication mode. Option D, `workgroup`, is incorrect because it merely specifies the workgroup or domain name the server participates in. Option E, `server string`, is incorrect because it only defines the descriptive text shown in browse lists and has no effect on security.

Answer

netbios name

Answer

workgroup

Answer

server string

Question 11

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Accepted Answer

Connection successful but cannot write. The user is in group 'staff' but not 'admin', and the Samba share configuration likely has 'write list = @admin' or similar, restricting write access to the admin group. The connection succeeds (the share is visible and readable), but the write operation fails silently or returns a permission error at the filesystem level, not a network-level error. This matches the scenario where authentication passes but authorization for writing fails.

Answer

NT_STATUS_BAD_NETWORK_NAME

Answer

NT_STATUS_ACCESS_DENIED

Answer

NT_STATUS_OBJECT_NAME_NOT_FOUND

Question 12

What is the most likely error in the configuration?

Accepted Answer

Parameter 'security mode' should be 'security'. The Samba configuration parameter for setting the security mode is simply 'security', not 'security mode'. The correct syntax is 'security = user' (or share, server, domain, ads). Using 'security mode' is an invalid parameter name that Samba will ignore or treat as an error, causing the configuration to fail or behave unexpectedly.

Answer

Section name '[share]' is invalid

Answer

Case sensitivity of parameter names

Answer

Missing quotation marks around comment

Question 13

A Samba share is configured with 'guest ok = yes'. What must also be configured to allow guest access?

Accepted Answer

map to guest = Bad User. When 'guest ok = yes' is set on a Samba share, the server still requires a mechanism to map unauthenticated or failed authentication attempts to the guest account. The 'map to guest = Bad User' directive tells Samba to treat any connection attempt with an invalid username as a guest connection, which is necessary for guest access to function. Without this mapping, clients presenting a non-existent or incorrect username will be rejected rather than being granted guest privileges.

Answer

security = share

Answer

force user = nobody

Answer

guest only = Yes

Question 14

A Linux server provides file sharing to Windows clients via Samba. The administrator notices that Windows clients are unable to resolve the NetBIOS name of the server. Which two services are essential for NetBIOS name resolution? (Choose two.)

Accepted Answer

nmbd. NetBIOS name resolution is handled by the nmbd daemon, which listens for and responds to NetBIOS name queries on UDP ports 137 and 138. Without nmbd, Windows clients cannot resolve the server's NetBIOS name. The smbd daemon provides file sharing services but does not participate in NetBIOS name resolution.

Answer

DNS

Answer

DHCP

Answer

winbindd

Answer

smbd

Question 15

A Samba server is configured to authenticate users against an Active Directory domain using winbind. After joining the domain, some users report that they cannot access shares, while others can. The administrator runs 'wbinfo -u' and sees a list of domain users. However, 'getent passwd' does not show domain users. Which configuration parameter is most likely missing or misconfigured in /etc/samba/smb.conf?

Accepted Answer

winbind enum users = yes. The `wbinfo -u` command lists domain users because it queries the winbind daemon directly, which has successfully joined the AD domain. However, `getent passwd` does not show domain users because the Name Service Switch (NSS) module for winbind is not configured to enumerate users. The parameter `winbind enum users = yes` in smb.conf tells winbind to provide user enumeration to NSS, allowing commands like `getent passwd` to return domain users. Without this, the NSS winbind module will not list domain users, even though authentication may work for known users.

Answer

winbind use default domain = yes

Answer

winbind nested groups = yes

Answer

idmap config * : backend = tdb