LPIC-2 File Sharing and Samba Practice Test 6 — 15 Questions

Question 1

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

Accepted Answer

security = user. The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Answer

security = domain

Answer

security = server

Answer

security = share

Question 2

An administrator is setting up a Samba share for a project team. The team members are in different UNIX groups. Which three options can be used to restrict access to specific users or groups? (Choose three.)

Accepted Answer

read list. (read list) is correct because it explicitly restricts read-only access to a list of users or groups, allowing the administrator to control which users can only read files in the Samba share. This is a direct Samba parameter that limits access to specific users or groups, even if they are in different UNIX groups.

Answer

write list

Answer

force group

Question 3

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

Accepted Answer

idmap config * : backend = rid. The `rid` backend (option D) is recommended because it generates UNIX UIDs/GIDs deterministically from the Windows RID (Relative Identifier) portion of the user's SID, ensuring that files created by domain users on the Samba server are consistently owned by the same UNIX user accounts derived from the domain. This backend does not require an RFC 2307 schema or LDAP attributes, making it ideal for simple domain member setups where automatic UID/GID mapping is needed.

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = autorid

Question 4

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 5

A Samba administrator needs to configure a share that allows only the user 'alice' and the group 'developers' to read and write files. Others should have no access. Which two parameters should be set in the share definition? (Choose two.)

Accepted Answer

valid users = alice, @developers. The 'valid users' parameter restricts access to only the specified users and groups, so setting 'valid users = alice, @developers' ensures only alice and members of the developers group can connect to the share. The 'write list' parameter grants write access to the listed users and groups, overriding any read-only setting; combining it with 'valid users' ensures that alice and the developers group have both read and write permissions, while all others are denied access entirely.

Answer

invalid users = alice, @developers

Answer

force user = alice

Answer

read list = alice, @developers

Question 6

Refer to the exhibit. A user in the group 'staff' attempts to access the share 'share' from a Windows client. The user is prompted for credentials and authenticates successfully, but cannot write any files. What is the most likely reason?

Accepted Answer

The share has read only = Yes, which prevents writes even for authenticated users.. The `read only = Yes` parameter in a Samba share definition explicitly prevents all write operations, even for authenticated users. When this parameter is set, Samba enforces read-only access at the share level, overriding any user or group permissions that might otherwise allow writes. Since the user authenticates successfully but cannot write, the most direct cause is this share-level restriction.

Answer

The passdb backend is set to tdbsam, which does not support write operations.

Answer

The share has guest ok = No, which prevents guest access.

Answer

The valid users parameter does not include the user.

Question 7

A small office uses a Samba server for file sharing. The server is running Samba 4.9 on Ubuntu 18.04. Recently, the administrator added a new user 'john' to the system and added him to the 'staff' group. However, when John tries to access the share 'docs' from his Windows laptop, he gets an 'Access Denied' error. The share configuration is:
[docs]
    path = /srv/docs
    valid users = @staff
    read only = No
    create mask = 0644
    directory mask = 0755

The administrator verifies that John is a member of the staff group by running 'groups john' which shows staff. Other users in staff can access the share. What is the most likely cause?

Accepted Answer

John's Windows credentials are cached from a previous failed attempt.. Samba caches user credentials and group memberships at the time of the initial connection. When John first attempted to access the share, Samba cached his credentials (including group membership) before he was added to the staff group. Even though the system now shows John as a member of staff, Samba continues to use the cached credentials, resulting in 'Access Denied'. Clearing the cached credentials on the Windows client (e.g., via 'net use * /delete' or Credential Manager) forces a fresh authentication and group lookup.

Answer

The create mask is too restrictive for John's files.

Answer

The valid users parameter requires the group to be listed with a plus sign for domain groups.

Answer

The Samba service needs to be restarted to reload the group membership.

Question 8

A company runs a mixed environment with Linux and Windows clients. The Samba server is configured as a domain member for authentication. Users authenticate via Active Directory using winbind. Recently, the IT department implemented a new password policy that requires all users to change passwords every 90 days. After the policy took effect, several users report that they cannot access Samba shares from their Linux clients (using smbclient) even though they can log into their Windows desktops with the same credentials. The error message on Linux is 'session setup failed: NT_STATUS_LOGON_FAILURE'. The administrator runs 'wbinfo -a username%password' and it succeeds. What is the most likely cause?

Accepted Answer

The Samba server's cached credentials for these users have expired and not been refreshed.. When a Samba server is a domain member using winbind, it caches user credentials to reduce authentication traffic to the domain controller. After the new 90-day password policy, users changed their passwords on Windows, but the cached credentials on the Samba server were not refreshed. The `wbinfo -a` command succeeds because it contacts the domain controller directly, bypassing the cache, while `smbclient` fails because it uses the stale cached credentials, resulting in NT_STATUS_LOGON_FAILURE.

Answer

The Samba server's krb5.conf is misconfigured for the new password policy.

Answer

The users' passwords contain characters that are not being encoded correctly by smbclient.

Answer

The Linux clients are using an older version of Samba that does not support the new password policy.

Question 9

A Samba share is configured with 'browseable = yes' but Windows clients cannot see it in the network list. However, they can access it by typing the UNC path directly. Which parameter is most likely misconfigured?

Accepted Answer

local master. The 'local master' parameter controls whether the Samba server participates in the election for the local master browser on the subnet. If set to 'no', the Samba server will not become the master browser, and Windows clients rely on the master browser to populate the network list. Since clients can access the share via UNC path but not see it in the network list, the browsing service is failing, which is directly tied to the local master setting.

Answer

os level

Answer

netbios name

Answer

server string

Question 10

A Samba share uses the 'acl_xattr' VFS module to store NT ACLs in extended attributes. The administrator runs 'getfattr -d /srv/share/file.txt' and sees no system attributes related to NT ACLs. What is the most likely cause?

Accepted Answer

The filesystem is not mounted with the 'user_xattr' option.. The 'acl_xattr' VFS module stores NT ACLs in extended attributes within the 'system' namespace. If 'getfattr -d' shows no system attributes, the most likely cause is that the underlying filesystem is not mounted with the 'user_xattr' option, which is required to enable extended attribute support. Without this mount option, the filesystem cannot store or retrieve extended attributes, so the NT ACL data is not persisted.

Answer

The VFS module is not loaded globally.

Answer

The share does not have 'nt acl support = yes' set.

Answer

The file's extended attributes are stored in a different namespace.

Question 11

A company uses Samba to share files from a Linux server to Windows clients. After upgrading Samba from version 4.10 to 4.15, some users report they cannot access shares and receive 'Access denied' errors. The smb.conf has been verified and seems correct. What is the most likely cause?

Accepted Answer

The 'ntlm auth' parameter is set to 'no' in the new version.. Starting with Samba 4.11, the default value of the 'ntlm auth' parameter changed from 'yes' to 'no'. This disables NTLMv1 authentication, which many legacy Windows clients or configurations still rely on. Even though the smb.conf appears correct, the new default silently blocks NTLMv1, causing 'Access denied' errors after the upgrade.

Answer

The firewall is blocking SMB ports.

Answer

The users' passwords are too short.

Answer

The Samba service is not running after upgrade.

Question 12

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Accepted Answer

invalid users. (invalid users) is correct because it explicitly lists usernames that are denied access to a share, overriding any other access controls. Option D (valid users) is correct because it restricts access to only the specified usernames, denying all others. Both parameters operate at the Samba share level and directly filter based on usernames.

Answer

hosts allow

Answer

write list

Answer

read list

Question 13

A company has a Samba server configured as a domain member in an Active Directory domain. The server runs Samba 4.13. Recently, Windows clients have been unable to access shares, and the domain join seems broken. The administrator runs 'net ads testjoin' and gets 'Join to domain is not valid'. The smb.conf includes: security = ads, realm = EXAMPLE.COM, workgroup = EXAMPLE. The administrator can successfully resolve the domain controller via DNS. What should the administrator do to fix the issue?

Accepted Answer

Re-run 'net ads join -U administrator' to rejoin the domain.. The 'net ads testjoin' command returned 'Join to domain is not valid', which indicates the machine account password stored in the local secrets.tdb file no longer matches the one in Active Directory. Re-running 'net ads join -U administrator' re-establishes the secure channel by resetting the machine account password and updating the Kerberos keytab, restoring the domain membership.

Answer

Restart the winbind service and run 'wbinfo -t'.

Answer

Add 'kerberos method = secrets and keytab' to smb.conf.

Answer

Increase the 'log level' to 3 and restart smbd.

Question 14

A small office uses a Linux server running Samba to share documents. The share is accessible but very slow, especially when writing large files. The network is 1 Gbps, and disk performance is fine. The smb.conf has default settings. Which change is most likely to improve write performance?

Accepted Answer

Set 'write cache size = 262144'.. The 'write cache size' option enables a per-file write cache in Samba that buffers write operations before committing them to disk. With default settings, Samba may perform synchronous writes for each chunk, causing severe slowdowns on large file transfers. Setting a write cache size (e.g., 262144 bytes) allows Samba to aggregate writes, dramatically improving throughput on a fast network with adequate disk performance.

Answer

Set 'strict sync = yes'.

Answer

Set 'use sendfile = yes'.

Answer

Set 'socket options = TCP_NODELAY IPTOS_LOWDELAY'.

Question 15

An organization uses a Samba server as a standalone file server. The share 'Projects' is configured with browseable = yes and guest ok = no. Users authenticate with local Samba accounts. A new employee needs access but cannot authenticate. The administrator added the user with 'smbpasswd -a newuser' and set a password. When the user tries to connect, they get 'NT_STATUS_LOGON_FAILURE'. The administrator verifies the username and password are correct. smb.conf includes: security = user, passdb backend = tdbsam. What is the most likely cause?

Accepted Answer

The user account is not in the system's /etc/passwd.. Samba with `passdb backend = tdbsam` stores user credentials in its own TDB database, but it still requires the user to exist as a local system account in `/etc/passwd` (or equivalent) for authentication to succeed. The `smbpasswd -a` command only adds the user to the Samba password database; if the user is not present in `/etc/passwd`, the authentication attempt fails with `NT_STATUS_LOGON_FAILURE` because Samba cannot map the session to a valid Unix UID.

Answer

The 'null passwords' parameter is set to 'yes'.

Answer

The 'map to guest' parameter is set to 'Bad User'.

Answer

The 'encrypt passwords' parameter is set to 'no'.