LPIC-2 File Sharing and Samba Practice Test 4 — 15 Questions

Question 1

An administrator is setting up a Samba share for a project team. The team members are in different UNIX groups. Which three options can be used to restrict access to specific users or groups? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

read list. Option A, read list, is correct because in smb.conf it names users or groups that are granted read-only access to the share, letting the administrator explicitly include specific team members or groups while others are denied. Option D, invalid users, is correct because it explicitly denies the listed users or groups from accessing the share, which is a direct way to restrict access for specific accounts. Option E, valid users, is correct because it defines the only users or groups allowed to connect to the share, so anyone not listed is denied access. Option B, write list, only grants write permission to listed users or groups and does not by itself restrict who may access the share, so it is not a valid access-restriction answer here. Option C, force group, merely overrides the primary group used for file operations on the share and does not restrict which users or groups can access it.

Answer

write list

Answer

force group

Question 2

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

Accepted Answer

idmap config * : backend = rid. The `rid` backend (option D) is recommended because it generates UNIX UIDs/GIDs deterministically from the Windows RID (Relative Identifier) portion of the user's SID, ensuring that files created by domain users on the Samba server are consistently owned by the same UNIX user accounts derived from the domain. This backend does not require an RFC 2307 schema or LDAP attributes, making it ideal for simple domain member setups where automatic UID/GID mapping is needed.

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = autorid

Question 3

A Samba administrator needs to configure a share that allows only the user 'alice' and the group 'developers' to read and write files. Others should have no access. Which two parameters should be set in the share definition? (Choose two.)

Accepted Answer

valid users = alice, @developers. The 'valid users' parameter restricts access to only the specified users and groups, so setting 'valid users = alice, @developers' ensures only alice and members of the developers group can connect to the share. The 'write list' parameter grants write access to the listed users and groups, overriding any read-only setting; combining it with 'valid users' ensures that alice and the developers group have both read and write permissions, while all others are denied access entirely.

Answer

invalid users = alice, @developers

Answer

force user = alice

Answer

read list = alice, @developers

Question 4

Refer to the exhibit. A user in the group 'staff' attempts to access the share 'share' from a Windows client. The user is prompted for credentials and authenticates successfully, but cannot write any files. What is the most likely reason?

Accepted Answer

The share has read only = Yes, which prevents writes even for authenticated users.. The `read only = Yes` parameter in a Samba share definition explicitly prevents all write operations, even for authenticated users. When this parameter is set, Samba enforces read-only access at the share level, overriding any user or group permissions that might otherwise allow writes. Since the user authenticates successfully but cannot write, the most direct cause is this share-level restriction.

Answer

The passdb backend is set to tdbsam, which does not support write operations.

Answer

The share has guest ok = No, which prevents guest access.

Answer

The valid users parameter does not include the user.

Question 5

A small office uses a Samba server for file sharing. The server is running Samba 4.9 on Ubuntu 18.04. Recently, the administrator added a new user 'john' to the system and added him to the 'staff' group. However, when John tries to access the share 'docs' from his Windows laptop, he gets an 'Access Denied' error. The share configuration is:
[docs]
    path = /srv/docs
    valid users = @staff
    read only = No
    create mask = 0644
    directory mask = 0755

The administrator verifies that John is a member of the staff group by running 'groups john' which shows staff. Other users in staff can access the share. What is the most likely cause?

Accepted Answer

John's Windows credentials are cached from a previous failed attempt.. Samba caches user credentials and group memberships at the time of the initial connection. When John first attempted to access the share, Samba cached his credentials (including group membership) before he was added to the staff group. Even though the system now shows John as a member of staff, Samba continues to use the cached credentials, resulting in 'Access Denied'. Clearing the cached credentials on the Windows client (e.g., via 'net use * /delete' or Credential Manager) forces a fresh authentication and group lookup.

Answer

The create mask is too restrictive for John's files.

Answer

The valid users parameter requires the group to be listed with a plus sign for domain groups.

Answer

The Samba service needs to be restarted to reload the group membership.

Question 6

A company runs a mixed environment with Linux and Windows clients. The Samba server is configured as a domain member for authentication. Users authenticate via Active Directory using winbind. Recently, the IT department implemented a new password policy that requires all users to change passwords every 90 days. After the policy took effect, several users report that they cannot access Samba shares from their Linux clients (using smbclient) even though they can log into their Windows desktops with the same credentials. The error message on Linux is 'session setup failed: NT_STATUS_LOGON_FAILURE'. The administrator runs 'wbinfo -a username%password' and it succeeds. What is the most likely cause?

Accepted Answer

The Samba server's cached credentials for these users have expired and not been refreshed.. When a Samba server is a domain member using winbind, it caches user credentials to reduce authentication traffic to the domain controller. After the new 90-day password policy, users changed their passwords on Windows, but the cached credentials on the Samba server were not refreshed. The `wbinfo -a` command succeeds because it contacts the domain controller directly, bypassing the cache, while `smbclient` fails because it uses the stale cached credentials, resulting in NT_STATUS_LOGON_FAILURE.

Answer

The Samba server's krb5.conf is misconfigured for the new password policy.

Answer

The users' passwords contain characters that are not being encoded correctly by smbclient.

Answer

The Linux clients are using an older version of Samba that does not support the new password policy.

Question 7

A Samba share is configured with 'browseable = yes' but Windows clients cannot see it in the network list. However, they can access it by typing the UNC path directly. Which parameter is most likely misconfigured?

Accepted Answer

local master. The 'local master' parameter controls whether the Samba server participates in the election for the local master browser on the subnet. If set to 'no', the Samba server will not become the master browser, and Windows clients rely on the master browser to populate the network list. Since clients can access the share via UNC path but not see it in the network list, the browsing service is failing, which is directly tied to the local master setting.

Answer

os level

Answer

netbios name

Answer

server string

Question 8

A Samba share uses the 'acl_xattr' VFS module to store NT ACLs in extended attributes. The administrator runs 'getfattr -d /srv/share/file.txt' and sees no system attributes related to NT ACLs. What is the most likely cause?

Accepted Answer

The filesystem is not mounted with the 'user_xattr' option.. The 'acl_xattr' VFS module stores NT ACLs in extended attributes within the 'system' namespace. If 'getfattr -d' shows no system attributes, the most likely cause is that the underlying filesystem is not mounted with the 'user_xattr' option, which is required to enable extended attribute support. Without this mount option, the filesystem cannot store or retrieve extended attributes, so the NT ACL data is not persisted.

Answer

The VFS module is not loaded globally.

Answer

The share does not have 'nt acl support = yes' set.

Answer

The file's extended attributes are stored in a different namespace.

Question 9

A small office uses a Linux server running Samba to share documents. The share is accessible but very slow, especially when writing large files. The network is 1 Gbps, and disk performance is fine. The smb.conf has default settings. Which change is most likely to improve write performance?

Accepted Answer

Set 'write cache size = 262144'.. The 'write cache size' option enables a per-file write cache in Samba that buffers write operations before committing them to disk. With default settings, Samba may perform synchronous writes for each chunk, causing severe slowdowns on large file transfers. Setting a write cache size (e.g., 262144 bytes) allows Samba to aggregate writes, dramatically improving throughput on a fast network with adequate disk performance.

Answer

Set 'strict sync = yes'.

Answer

Set 'use sendfile = yes'.

Answer

Set 'socket options = TCP_NODELAY IPTOS_LOWDELAY'.

Question 10

An organization uses a Samba server as a standalone file server. The share 'Projects' is configured with browseable = yes and guest ok = no. Users authenticate with local Samba accounts. A new employee needs access but cannot authenticate. The administrator added the user with 'smbpasswd -a newuser' and set a password. When the user tries to connect, they get 'NT_STATUS_LOGON_FAILURE'. The administrator verifies the username and password are correct. smb.conf includes: security = user, passdb backend = tdbsam. What is the most likely cause?

Accepted Answer

The user account is not in the system's /etc/passwd.. Samba with `passdb backend = tdbsam` stores user credentials in its own TDB database, but it still requires the user to exist as a local system account in `/etc/passwd` (or equivalent) for authentication to succeed. The `smbpasswd -a` command only adds the user to the Samba password database; if the user is not present in `/etc/passwd`, the authentication attempt fails with `NT_STATUS_LOGON_FAILURE` because Samba cannot map the session to a valid Unix UID.

Answer

The 'null passwords' parameter is set to 'yes'.

Answer

The 'map to guest' parameter is set to 'Bad User'.

Answer

The 'encrypt passwords' parameter is set to 'no'.

Question 11

An enterprise environment uses Samba as an Active Directory domain controller using Samba 4.11. The administrator needs to configure a read-only domain controller (RODC) for a remote branch office. Which of the following steps is correct?

Accepted Answer

On the existing DC, run 'samba-tool domain rodc create rodc-name' and then on the RODC server join with 'samba-tool domain join EXAMPLE.COM RODC'.. Samba 4.11 requires the RODC computer account to be pre-created on the existing DC using 'samba-tool domain rodc create', which sets up the necessary krbtgt account and replication metadata. The RODC server then joins the domain as a read-only domain controller with 'samba-tool domain join EXAMPLE.COM RODC', which authenticates against the pre-created account and configures the local Samba instance as a read-only replica.

Answer

On the RODC server, run 'samba-tool domain join EXAMPLE.COM member' and then promote to RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain provision --domain=EXAMPLE --adminpass=Pa$$w0rd' on the RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain join EXAMPLE.COM RODC -UAdministrator'.

Question 12

Which TWO smb.conf parameters can be used to restrict access to a share based on client IP address or network?

Accepted Answer

hosts deny. In smb.conf, the hosts deny parameter (option A) is correct because it explicitly blocks the listed client IP addresses or networks from accessing a share, and it is evaluated before hosts allow, so a matching entry denies the connection. The hosts allow parameter (option E) is also correct because it permits only the specified IP addresses or networks to access the share, effectively restricting access to those clients. Together, hosts allow and hosts deny are the standard Samba access-control parameters for filtering by client IP address or subnet. Option B (valid users) is incorrect because it restricts access by SMB username, not by IP address. Option C (allow hosts) is incorrect because the actual smb.conf parameter name is hosts allow, not allow hosts. Option D (invalid users) is incorrect because it denies specific usernames, not client IP addresses or networks.

Answer

valid users

Answer

allow hosts

Answer

invalid users

Question 13

A company uses a Samba server (version 4.12) on Ubuntu 20.04 to provide file sharing for the engineering department. The server has a share [projects] defined in smb.conf with the following parameters: `path = /srv/projects`, `valid users = @engineers`, `read only = no`, `create mask = 0660`, `directory mask = 0770`. All users in the engineers group can authenticate and list the share contents but they report that they cannot create new files or modify existing ones. The command `ls -ld /srv/projects` shows `drwxrwxr-x`, and the directory is owned by root:engineers. The sysadmin has confirmed that the file system permissions on /srv/projects are set to 2775, but the setgid bit does not appear in the ls output. Additionally, users are able to create files in other shares on the same server that are configured similarly. Which of the following is the most likely cause and solution?

Accepted Answer

The directory lacks the setgid bit and new files do not inherit the engineers group. Add `force group = engineers` and `inherit permissions = yes` to the share configuration.. The directory /srv/projects lacks the setgid bit (shown as 2775 but ls output shows drwxrwxr-x, indicating the setgid bit is not effective), so new files and directories created by users in the @engineers group will be owned by the user's primary group (typically the user's default group) rather than the engineers group. Adding `force group = engineers` forces all new files to have the engineers group, and `inherit permissions = yes` ensures that the directory's permissions and setgid behavior are propagated to new subdirectories, resolving the permission mismatch that prevents writes.

Answer

The valid users parameter should be changed to include '%engineers' instead of '@engineers'.

Answer

The create mask is too restrictive. Change it to 0666 to allow more permissions.

Answer

The parameter `read only = no` is being overridden by a global setting. Add `writable = yes` to the share.

Question 14

A Samba file server on a Debian host must serve a share whose underlying directory is formatted with the XFS filesystem, and the administrator needs Windows clients to be able to store and retrieve NTFS-style ACLs on files in that share. Which smb.conf share parameter should the administrator add to enable this functionality?

Accepted Answer

vfs objects = acl_xattr. Storing Windows NT ACLs on a Linux filesystem that lacks native support requires a VFS module that serialises the ACL data into POSIX extended attributes. The acl_xattr module does exactly this, and XFS provides the necessary extended-attribute backing store. Merely toggling nt acl support or inheritance mapping parameters does not create a persistence layer, so the VFS module is the only choice that actually stores the ACLs on disk.

Answer

acl allow execute always = yes

Answer

map acl inherit = yes

Answer

nt acl support = yes

Question 15

A Samba server is configured as an AD domain member. After a domain rename, clients authenticate successfully but cannot access shares because Samba cannot map Windows SIDs to local Linux UIDs/GIDs. The smb.conf contains 'idmap config * : backend = tdb' and 'idmap config * : range = 10000-20000'. Which action will resolve the mapping failure?

Accepted Answer

Rejoin the Samba server to the domain and reset the idmap database.. After a domain rename, the domain SID changes, invalidating all existing SID-to-UID/GID mappings stored in the idmap database. The Samba server must be rejoined to the domain to obtain the new machine trust, and the idmap database must be reset so that winbind can generate correct mappings for the new SIDs. This restores the ability to resolve Windows SIDs to local Linux identities, allowing share access.

Answer

Set 'idmap config * : backend = ad' and specify the domain name.

Answer

Change the idmap range to 20000-30000 to avoid conflicts with the new domain SID.

Answer

Clear the idmap cache and restart the winbind service, then rejoin the domain.