LPIC-2 File Sharing and Samba Practice Test 5 — 15 Questions

Question 1

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 2

An organization is using Samba as a PDC with an LDAP backend for user accounts. Which idmap backend configuration is appropriate for RFC 2307?

Accepted Answer

idmap config * : backend = ldap. When Samba is configured as a PDC with an LDAP backend for user accounts and RFC 2307 is used, the idmap backend must be set to `ldap` to store and retrieve Unix UID/GID mappings directly from the LDAP directory. This ensures that the POSIX attributes (uidNumber, gidNumber) defined in LDAP are used consistently across all Samba clients, which is the core requirement of RFC 2307.

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = rid

Question 3

Windows clients cannot see the Samba server in Network Neighborhood, but they can access shares by typing the UNC path. Which Samba daemon must be running?

Accepted Answer

nmbd. The nmbd daemon is responsible for NetBIOS name resolution and browsing, which enables Windows clients to discover Samba servers in Network Neighborhood. When nmbd is not running, clients can still connect via UNC paths because smbd handles file sharing directly, but browsing and name resolution fail.

Answer

smbd

Answer

samba

Answer

winbindd

Question 4

A Samba share is intended for guest (anonymous) access. Which global parameter must be set to allow this?

Accepted Answer

map to guest = Bad User. The `map to guest = Bad User` parameter in Samba's global configuration forces any connection attempt with an invalid or non-existent username to be treated as a guest (anonymous) login. This is the standard way to allow anonymous access to shares while still using `security = user` (the default in modern Samba), as it maps failed authentication to the guest account.

Answer

guest account = nobody

Answer

security = share

Answer

security = user

Question 5

Samba is integrated with Active Directory using security = ads. Which service is required for Kerberos authentication?

Accepted Answer

smbd. When Samba is integrated with Active Directory using `security = ads`, Kerberos authentication is handled by the `smbd` daemon. `smbd` is responsible for authenticating incoming SMB connections, and in an AD domain it uses the Kerberos protocol (via the GSSAPI) to validate tickets presented by clients. Without `smbd`, no Kerberos-based authentication can occur for SMB/CIFS services.

Answer

winbindd

Answer

samba

Answer

nmbd

Question 6

Which TWO global parameters can be used to control the security mode of a Samba server?

Accepted Answer

security. The `security` parameter is the primary global setting that defines the Samba server's security mode (e.g., user, domain, ads, server). The `map to guest` parameter controls how Samba handles authentication failures by optionally mapping invalid users to the guest account, effectively modifying the security behavior. Both are global parameters that directly influence the security mode of the Samba server.

Answer

netbios name

Answer

workgroup

Answer

server string

Question 7

Which TWO conditions are most likely to cause 'NT_STATUS_ACCESS_DENIED' when accessing a Samba share?

Accepted Answer

Linux filesystem permissions disallow write. Samba ultimately relies on the underlying Linux filesystem permissions to enforce write access. Even if Samba share permissions allow writing, if the Linux user or group mapped to the Samba session lacks write permission on the file or directory (e.g., due to chmod or ACL settings), the kernel will deny the write operation, resulting in NT_STATUS_ACCESS_DENIED. This is a common misconfiguration where administrators set share-level permissions correctly but forget to adjust the filesystem ACLs.

Answer

Lmhosts file misconfiguration

Answer

SMB protocol version mismatch

Answer

Windows firewall blocking port 445

Question 8

Which THREE commands are specifically used to diagnose Samba issues?

Accepted Answer

smbstatus. smbstatus is correct because it displays the current Samba connections, including active SMB sessions, open files, and locked files, which is essential for diagnosing who is accessing Samba shares and what resources are in use. It queries the Samba internal state via the smbd daemon, providing real-time diagnostic information about connected clients.

Answer

netstat

Answer

ping

Question 9

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Accepted Answer

Connection successful but cannot write. The user is in group 'staff' but not 'admin', and the Samba share configuration likely has 'write list = @admin' or similar, restricting write access to the admin group. The connection succeeds (the share is visible and readable), but the write operation fails silently or returns a permission error at the filesystem level, not a network-level error. This matches the scenario where authentication passes but authorization for writing fails.

Answer

NT_STATUS_BAD_NETWORK_NAME

Answer

NT_STATUS_ACCESS_DENIED

Answer

NT_STATUS_OBJECT_NAME_NOT_FOUND

Question 10

A user alice is connected to the 'data' share via smbd, but a file is locked. Which command can forcibly close the file?

Accepted Answer

smbcontrol smbd close-share data. `smbcontrol smbd close-share data` sends a message to the smbd process to forcibly close all open files on the 'data' share, releasing any locks held by users like alice. This command directly targets the Samba daemon's internal state without disrupting the entire service or other shares.

Answer

smbpasswd -L -e alice

Answer

systemctl restart nmbd

Answer

kill -9 $(pgrep smbd)

Question 11

What is the most likely error in the configuration?

Accepted Answer

Parameter 'security mode' should be 'security'. The Samba configuration parameter for setting the security mode is simply 'security', not 'security mode'. The correct syntax is 'security = user' (or share, server, domain, ads). Using 'security mode' is an invalid parameter name that Samba will ignore or treat as an error, causing the configuration to fail or behave unexpectedly.

Answer

Section name '[share]' is invalid

Answer

Case sensitivity of parameter names

Answer

Missing quotation marks around comment

Question 12

A Samba share is configured with 'guest ok = yes'. What must also be configured to allow guest access?

Accepted Answer

map to guest = Bad User. When 'guest ok = yes' is set on a Samba share, the server still requires a mechanism to map unauthenticated or failed authentication attempts to the guest account. The 'map to guest = Bad User' directive tells Samba to treat any connection attempt with an invalid username as a guest connection, which is necessary for guest access to function. Without this mapping, clients presenting a non-existent or incorrect username will be rejected rather than being granted guest privileges.

Answer

security = share

Answer

force user = nobody

Answer

guest only = Yes

Question 13

After modifying /etc/samba/smb.conf, which command should be used to verify the syntax before restarting the Samba service?

Accepted Answer

testparm. The `testparm` command is specifically designed to parse and validate the syntax of the Samba configuration file `/etc/samba/smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be running. This makes it the correct tool to verify syntax before restarting Samba.

Answer

nmblookup

Answer

smbclient

Answer

smbstatus

Question 14

A Linux server provides file sharing to Windows clients via Samba. The administrator notices that Windows clients are unable to resolve the NetBIOS name of the server. Which two services are essential for NetBIOS name resolution? (Choose two.)

Accepted Answer

nmbd. NetBIOS name resolution is handled by the nmbd daemon, which listens for and responds to NetBIOS name queries on UDP ports 137 and 138. Without nmbd, Windows clients cannot resolve the server's NetBIOS name. The smbd daemon provides file sharing services but does not participate in NetBIOS name resolution.

Answer

DNS

Answer

DHCP

Answer

winbindd

Answer

smbd

Question 15

A Samba server is configured to authenticate users against an Active Directory domain using winbind. After joining the domain, some users report that they cannot access shares, while others can. The administrator runs 'wbinfo -u' and sees a list of domain users. However, 'getent passwd' does not show domain users. Which configuration parameter is most likely missing or misconfigured in /etc/samba/smb.conf?

Accepted Answer

winbind enum users = yes. The `wbinfo -u` command lists domain users because it queries the winbind daemon directly, which has successfully joined the AD domain. However, `getent passwd` does not show domain users because the Name Service Switch (NSS) module for winbind is not configured to enumerate users. The parameter `winbind enum users = yes` in smb.conf tells winbind to provide user enumeration to NSS, allowing commands like `getent passwd` to return domain users. Without this, the NSS winbind module will not list domain users, even though authentication may work for known users.

Answer

winbind use default domain = yes

Answer

winbind nested groups = yes

Answer

idmap config * : backend = tdb