LPIC-2 File Sharing and Samba Practice Test 5 — 15 Questions

Question 1

A Samba server on Ubuntu 22.04 is configured with a share named [documents] that uses the acl_xattr VFS module. Users report that when they create a new file via SMB, the file's permissions are not inherited from the parent directory's default ACL. The Linux filesystem is ext4 with ACL support enabled. Which smb.conf parameter should be set to ensure that created files inherit the parent directory's permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

inherit acls = yes. The inherit acls parameter in smb.conf makes Samba consider the parent directory's default ACLs when creating new files and directories. Without it, Samba applies only the create mask and directory mask, ignoring default ACL entries. In this scenario, enabling inherit acls ensures that new files inherit the ACLs from the parent directory, satisfying the requirement for permission inheritance.

Answer

map acl inherit = yes

Answer

acl allow execute always = yes

Answer

nt acl support = yes

Question 2

A Linux server runs Samba 4.15 as a standalone file server. The administrator needs macOS clients to access shares using the native SMB protocol, but macOS is currently falling back to SMB1 and performance is poor. Which smb.conf global parameter should be set to allow macOS to negotiate the modern SMB2/3 protocol?

Accepted Answer

vfs objects = fruit. The fruit VFS module is specifically designed to improve interoperability with macOS clients by providing support for Apple-specific SMB extensions. When enabled, macOS clients can negotiate SMB2/3 more effectively, leading to better performance and access to macOS-specific features. The other parameters either affect client-side behavior, enforce encryption, or set protocol minimums without addressing macOS compatibility.

Answer

smb encrypt = required

Answer

server min protocol = SMB2_02

Answer

client min protocol = SMB2_02

Question 3

A Samba server is being tuned for a branch office where Windows clients frequently open and close the same shared documents. The administrator wants to reduce the latency caused by Samba repeatedly stat-ing and re-opening the same files. Which two smb.conf parameters should the administrator consider? (Choose two.)

Accepted Answer

getwd cache = yes. Reducing latency for repeated file access involves caching path resolution and accelerating data transfer. The getwd cache parameter avoids redundant directory resolution work on the server, while use sendfile lets the kernel move file data without user-space copies, lowering CPU load and improving throughput. Allocation and locking parameters change disk or lock behaviour but do not deliver the caching and transfer benefits sought here.

Answer

strict allocate = yes

Answer

kernel oplocks = no

Answer

max smbd processes = 1

Question 4

A Samba server is configured with a share that uses the recycle VFS module to retain deleted files. The administrator notices that files deleted by users are not appearing in the recycle directory. The share definition includes 'vfs objects = recycle' and 'recycle:repository = .recycle'. What is the most likely cause of the problem?

Accepted Answer

The .recycle directory does not exist and Samba does not create it automatically.. The recycle VFS module relies on the existence of the repository directory. If the directory specified by recycle:repository does not exist, the module cannot move deleted files there. Unlike some other modules, it does not create the directory automatically. The administrator must create it manually and set proper permissions. The other options are either incorrect or relate to optional features that do not prevent basic recycling.

Answer

The recycle:repository path must be an absolute path, not a relative one.

Answer

The recycle:keeptree parameter is not set, so the module cannot create the recycle directory structure.

Answer

The recycle module requires the 'recycle:versions' parameter to be set to yes to track deletions.

Question 5

A Samba server hosts a share that only members of the 'finance' group should be able to access, and the administrator wants to be certain that no other authenticated user can even see the share listed when browsing the server. Which smb.conf share parameter should the administrator set to 'valid users = @finance' to enforce this, while also ensuring the share is hidden from other users?

Accepted Answer

browseable = no. The browseable parameter controls whether a share appears in the list returned when a client enumerates shares on the server. Setting browseable = no keeps the finance share out of that enumeration, so non-members never see it, while valid users = @finance still restricts connection attempts to group members. Guest-related and file-level hiding parameters do not suppress the share's own visibility.

Answer

hide unreadable = yes

Answer

guest ok = no

Answer

access based share enum = yes

Question 6

A Linux server is running Samba 4.13 as a standalone file server. A Windows 10 client attempts to connect to a share but receives the error "The account is not authorized to log in from this station." The Samba logs show the message "ntlmssp_server_check_password: Bad password for user jdoe". Which Samba parameter should the administrator check first to resolve this issue?

Accepted Answer

ntlm auth. In Samba 4.13, the default for ntlm auth changed to ntlmv2-only, disabling NTLMv1 by default. If a client attempts NTLMv1 authentication, it will fail with a bad password error. The administrator should check the ntlm auth parameter and, if necessary, set it to ntlmv1-permitted to allow NTLMv1. This directly addresses the authentication failure shown in the logs.

Answer

server signing

Answer

client ntlmv2 auth

Answer

lanman auth

Question 7

A Samba server is configured as a standalone server with a share that uses the 'acl_xattr' VFS module to store Windows ACLs. Users report that they can see files but cannot modify permissions from Windows Explorer. The administrator verifies that the underlying filesystem is ext4 and has the 'user_xattr' mount option. Which additional smb.conf parameter is required on the share to enable Windows ACL support?

Accepted Answer

nt acl support = yes. For Windows clients to modify permissions on a Samba share, Samba must be configured to support NT ACLs. The 'nt acl support' parameter enables this functionality. While acl_xattr provides the storage mechanism, nt acl support is the switch that allows Samba to interpret and apply Windows ACL requests. Without it, clients can view but not change permissions. The other parameters are either unrelated or only affect inheritance and attribute storage.

Answer

inherit acls = yes

Answer

store dos attributes = yes

Answer

map acl inherit = yes

Question 8

A Samba server is configured with the following global parameters:

[global]
idmap config * : backend = tdb
idmap config * : range = 10000-19999
idmap config AD : backend = ad
idmap config AD : range = 20000-29999
idmap config AD : schema_mode = rfc2307

The server is joined to an Active Directory domain named AD. A domain user 'jdoe' has the POSIX attributes uidNumber=30000 and gidNumber=30000 set in AD. When jdoe accesses a Samba share, what will be the resulting UID and GID as seen by the Linux system?

Accepted Answer

UID and GID allocated from the range 20000-29999. The idmap ad backend with schema_mode = rfc2307 uses the uidNumber and gidNumber attributes from AD, but only if they fall within the configured range for the domain. Here, the range for AD is 20000-29999, and jdoe's attributes are 30000, which is outside. Therefore, Samba will allocate new UID and GID from the AD range, ignoring the AD-provided values. The resulting IDs will be within 20000-29999.

Answer

UID and GID allocated from the default range 10000-19999

Answer

UID=30000, GID allocated from the range 20000-29999

Answer

UID=30000, GID=30000

Question 9

A Samba server is configured as a domain member of an Active Directory domain. Users complain that they cannot access a share that should be available to all domain users. The share is defined with 'valid users = @"DOMAIN\Domain Users"'. The administrator runs 'net ads testjoin' and it succeeds. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Accepted Answer

Check the share's 'valid users' parameter for correct syntax and escaping of the domain and space.. The most likely causes are that winbind cannot resolve the 'Domain Users' group or that the 'valid users' syntax is incorrect. Verifying group resolution with wbinfo -g ensures that the group is known to Samba, and checking the syntax confirms that Samba interprets the group name correctly. The other options are either not required or not directly related to troubleshooting the access denial.

Answer

Ensure that the 'winbind use default domain' parameter is set to yes.

Answer

Run 'smbcontrol all reload-config' to apply any recent configuration changes.

Answer

Check that the 'idmap config' backend is set to 'ad' for the domain.

Question 10

A company wants to use Samba to share files with Windows clients. Which service must be enabled in Samba to support Windows Active Directory domain membership?

Accepted Answer

winbind. Winbind (winbindd) is the Samba service that integrates with Windows Active Directory by resolving user and group information from the domain controller. It uses the Microsoft Active Directory authentication protocol (Kerberos) and LDAP to map Windows domain users to local Unix accounts, enabling domain membership and single sign-on.

Answer

nmbd

Answer

smbd

Answer

swat

Question 11

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 12

Which Samba component provides NetBIOS name resolution and browsing services?

Accepted Answer

nmbd. The nmbd daemon is the Samba component responsible for NetBIOS name resolution and browsing services. It listens for NetBIOS name service requests (port 137/UDP) and datagram distribution (port 138/UDP), enabling Windows clients to resolve NetBIOS names to IP addresses and participate in network browsing (e.g., listing shares in Network Neighborhood). Without nmbd, Samba cannot provide legacy NetBIOS-based name resolution or browse lists, though modern Samba can also use DNS-based discovery.

Answer

swat

Answer

smbd

Answer

winbind

Question 13

After modifying smb.conf, which command should be used to verify the configuration syntax before restarting Samba?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to parse and validate the syntax of the Samba configuration file `smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be restarted. This ensures that any syntax problems are caught before applying changes to the running Samba daemons (smbd, nmbd, winbindd).

Answer

net conf

Answer

smbpasswd

Answer

smbcontrol

Question 14

Which TWO files are commonly used by Samba for configuration and user authentication? (Choose two.)

Accepted Answer

/etc/samba/smbpasswd. Option E, /etc/samba/smb.conf, is correct because it is Samba's primary configuration file, defining global server settings and per-share parameters such as workgroup, security mode, and share paths. Option C, /etc/samba/smbpasswd, is correct because it is the traditional Samba file storing SMB/CIFS user account credentials (NT/LM password hashes) used for authenticating clients, managed via smbpasswd. Option A, /etc/samba/smbusers, is not correct because it only maps local Linux usernames to SMB aliases and does not store authentication credentials or main configuration. Option B, /etc/passwd, is not correct because it is the system's local account database, not Samba's authentication store, though Samba may reference system accounts. Option D, /etc/hosts.allow, is not correct because it is a TCP wrapper access-control file, not a Samba configuration or authentication file.

Answer

/etc/samba/smbusers

Answer

/etc/passwd

Answer

/etc/hosts.allow

Question 15

Given the smb.conf exhibit, which share(s) allow write access to user 'alice' who is a member of the 'staff' group?

Accepted Answer

share1 only. In the smb.conf exhibit, share1 has 'write list = @staff' which grants write access to all members of the staff group, including user alice. share2 has 'read only = yes' and no write list, so it is read-only for everyone. share3 has 'valid users = bob' and 'write list = bob', so only bob can write; alice is not listed and is not in the bob group, so she has no write access.

Answer

share1 and share3

Answer

share3 only

Answer

share2 only