LPIC-2 File Sharing and Samba Practice Test 4 — 15 Questions

Question 1

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. It uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 2

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 3

A new user needs access to a Samba share. The administrator adds the user to the system with `adduser alice` and then sets up a Samba password. Which command is used to set the Samba password?

Accepted Answer

smbpasswd -a alice. The correct command is `smbpasswd -a alice`. This command adds a new user to the Samba password database and sets their initial Samba password. The `-a` flag specifically indicates that the user should be added to the local Samba user database (smbpasswd file or tdbsam), which is required before the user can authenticate to Samba shares.

Answer

passwd -a alice

Answer

pdbedit -a -u alice

Answer

net ads user add alice

Question 4

An organization runs a Samba server in standalone mode. They want to allow anonymous (guest) access to a public share. Which configuration option enables guest access for a share?

Accepted Answer

map to guest = Bad User and guest ok = yes. Samba requires both `map to guest = Bad User` (which tells Samba to treat any connection attempt with an invalid username as a guest connection) and `guest ok = yes` (which explicitly permits guest access to the share). Without both, anonymous access will be denied. The `map to guest` directive can also be set to `Bad Password` or `Never`, but `Bad User` is the typical choice for public shares.

Answer

anonymous = yes

Answer

security = share

Answer

guest account = nobody

Question 5

A Samba server is configured as a classic PDC (Primary Domain Controller) for a legacy network. The administrator needs to add a new machine account for a client joining the domain. Which command accomplishes this?

Accepted Answer

smbpasswd -a -m MACHINENAME. In a classic Samba PDC (Primary Domain Controller) setup, machine accounts are stored in the `smbpasswd` file (or tdbsam) and are added using `smbpasswd -a -m MACHINENAME`. The `-m` flag specifically indicates a machine account, which appends a `$` to the name and sets the appropriate flags for domain membership. This command creates the machine trust account that the client uses to join the domain.

Answer

samba-tool domain add machinename

Answer

net rpc join machinename

Answer

pdbedit -a -m MACHINENAME

Question 6

In Samba 4, what is the default security mode when no 'security' parameter is set in the [global] section?

Accepted Answer

user. In Samba 4, when no 'security' parameter is explicitly set in the [global] section, the default security mode is 'user'. This means clients must authenticate with a valid username and password, and Samba validates credentials against the local passdb backend (e.g., tdbsam or LDAP). This default has been consistent since Samba 3.x and ensures that each connection is tied to a specific user identity.

Answer

ads

Answer

share

Answer

domain

Question 7

Which TWO of the following are common symptoms of a misconfigured winbind service when Samba is joined to an Active Directory domain?

Accepted Answer

`getent passwd` does not list domain users.. When winbind is misconfigured, the Name Service Switch (NSS) module may not be properly set up to query winbind for domain users. This means `getent passwd` will not return domain users even if winbind itself can enumerate them via `wbinfo -u`. The core issue is that NSS is not configured to use the `winbind` source in `/etc/nsswitch.conf`, or the winbind service is not correctly communicating with the NSS subsystem.

Answer

`net ads join` fails with 'access denied'.

Answer

Domain users cannot authenticate via SSH.

Question 8

Which THREE of the following parameters can improve Samba file transfer performance under heavy load?

Accepted Answer

write raw = Yes. Enabling 'write raw = Yes' allows Samba to use the raw write SMB protocol, which sends larger write requests without waiting for intermediate acknowledgments, reducing protocol overhead and improving throughput under heavy load. This setting is particularly effective when combined with other performance tuning parameters.

Answer

strict allocate = Yes

Answer

oplocks = Yes

Question 9

Which TWO of the following are valid methods to join a Samba server to an Active Directory domain using Samba 4?

Accepted Answer

`net ads join`. `net ads join` is the traditional Samba tool for joining an Active Directory domain using the LDAP and Kerberos protocols over TCP/IP, which is the standard method for Samba 3 and later versions. Option D is correct because `samba-tool domain join` is the native Samba 4 command that directly integrates with the built-in AD domain controller functionality, allowing a Samba server to join an existing AD domain as a member server.

Answer

`smbpasswd -j`

Answer

`winbindd -j`

Answer

`net rpc join`

Question 10

A client reports that the [public] share is visible but all files appear read-only. What is the cause?

Accepted Answer

The read only = yes parameter forces read-only access.. The `read only = yes` parameter in a Samba share definition explicitly forces all files to appear read-only to clients, regardless of underlying filesystem permissions. This overrides any other permission settings and is the direct cause of the reported behavior where the share is visible but all files are read-only.

Answer

The create mask = 0755 denies write permissions.

Answer

The guest account nobody has no write permission on the file system.

Answer

The map to guest = Bad User is causing all users to be treated as guest.

Question 11

A user 'bob' is unable to save changes to report.doc. Based on the exhibit, what is the most likely reason?

Accepted Answer

Alice has the file open with a deny-write lock.. The exhibit shows that Alice has the file open with a deny-write lock, which prevents any other user (including Bob) from writing to the file. In Samba, this is enforced by the share mode locking mechanism, where a deny-write share access request from Alice blocks subsequent write attempts by Bob until Alice closes the file.

Answer

The oplock is set to NONE causing conflicts.

Answer

Bob does not have permission on the filesystem.

Answer

The share is configured as read-only.

Question 12

What is the purpose of the 'idmap config * : backend = tdb2' line?

Accepted Answer

It sets the default identity mapping backend to tdb2.. The 'idmap config * : backend = tdb2' line in Samba's smb.conf configures the default identity mapping backend for all domains not explicitly specified. The asterisk (*) acts as a wildcard representing any domain, and 'tdb2' is a high-performance, clustered-aware database backend that stores mappings between Windows SIDs and Unix UIDs/GIDs. This ensures that when a user or group from an unspecified domain is encountered, Samba uses tdb2 to manage the ID mapping, making option A correct.

Answer

It specifies the security mode as user.

Answer

It defines the default domain for Samba.

Answer

It enables the winbind cache.

Question 13

An administrator has configured Samba as a domain member for an Active Directory environment. For user authentication via winbind, which daemon must be running?

Accepted Answer

winbindd. In a Samba domain member configuration for Active Directory, the winbindd daemon is responsible for resolving user and group information from the Windows domain and providing authentication services via the Winbind protocol. It communicates with the Active Directory domain controller using DCE/RPC and LDAP to map Windows SIDs to Unix UIDs/GIDs, enabling seamless user authentication. Without winbindd running, winbind-based authentication (e.g., via PAM or nsswitch) will fail, even if smbd and nmbd are active.

Answer

smbd

Answer

samba

Answer

nmbd

Question 14

A Samba server is configured to store NT ACLs on a Linux filesystem that does not support them natively. Which VFS module should be used to map NT ACLs to POSIX ACLs?

Accepted Answer

vfs objects = acl_xattr. The `acl_xattr` VFS module is specifically designed to store NT ACLs in extended attributes on a Linux filesystem that lacks native NT ACL support. When Samba is configured with `vfs objects = acl_xattr`, it maps Windows NT ACLs to POSIX ACLs by serializing the NT ACL into the `user.NTACL` extended attribute, allowing Samba to enforce Windows-style permissions even on filesystems like ext4 or XFS that only support POSIX ACLs natively.

Answer

vfs objects = recycle

Answer

vfs objects = full_audit

Answer

vfs objects = streams_xattr

Question 15

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

Accepted Answer

printing = cups. The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients. Together, these three parameters are essential for seamless CUPS integration.

Answer

cups server = localhost

Answer

cups options = "raw"