LPIC-2 File Sharing and Samba Practice Test 6 — 15 Questions

Question 1

Arrange the steps to configure a Linux system as an Apache virtual host.

Accepted Answer

1. Create document root, 2. Create site configuration, 3. Enable the site, 4. Reload Apache, 5. Test. The correct order to configure an Apache virtual host is: first, create the document root directory with appropriate permissions; second, create a site configuration file in /etc/apache2/sites-available/; third, enable the site using a2ensite; fourth, reload Apache with systemctl reload apache2; fifth, test by accessing the site. Option A follows this sequence. Option B is incorrect because the site configuration must be created before enabling. Option C is incorrect because enabling occurs after configuration creation. Option D is incorrect because reloading must happen after enabling.

Answer

1. Create site configuration, 2. Create document root, 3. Enable the site, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Enable the site, 3. Create site configuration, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Create site configuration, 3. Reload Apache, 4. Enable the site, 5. Test

Question 2

A user wants to mount a Samba share on a Linux client using the command line. Which utility is used for that purpose?

Accepted Answer

mount.cifs. The correct utility is mount.cifs, which is part of the cifs-utils package. It mounts Samba (SMB/CIFS) shares on Linux clients by using the Common Internet File System (CIFS) protocol, the modern implementation of SMB. The mount command with -t cifs internally calls mount.cifs, making it the standard tool for this purpose.

Answer

mount.smb

Answer

mount -t smbfs

Answer

smbclient

Question 3

An administrator sets up a Samba server with 'security = user'. Users are stored in the local smbpasswd file. After changing a user's Unix password, the user cannot access Samba shares. What should the administrator do?

Accepted Answer

Run 'smbpasswd username' to set the SMB password.. When Samba is configured with 'security = user', each user must have a separate SMB password stored in the smbpasswd file (or the tdbsam backend). Changing the Unix password does not automatically update the SMB password. Running 'smbpasswd username' sets the SMB password for that user, allowing them to authenticate to Samba shares.

Answer

Add the user to the 'valid users' list.

Answer

Restart the smbd service.

Answer

Run 'pdbedit -u username' to modify the password.

Question 4

A Samba server uses 'security = domain' with an NT4-style domain. After a domain controller outage, users cannot authenticate. Which configuration change would allow fallback to local authentication?

Accepted Answer

Set 'security = user' and 'passdb backend = tdbsam'. When a Samba server is configured with 'security = domain', it relies on a remote NT4-style domain controller for authentication. If the domain controller is unavailable, users cannot authenticate because Samba has no local fallback. Changing to 'security = user' and setting 'passdb backend = tdbsam' switches Samba to authenticate users against its own local password database (tdbsam), allowing authentication even when the domain controller is down.

Answer

Set 'domain master = no'

Answer

Set 'local master = yes'

Answer

Set 'preferred master = no'

Question 5

In a Samba domain member server, which file contains the SID to Unix ID mappings?

Accepted Answer

/var/lib/samba/winbindd_idmap.tdb. B is correct because Samba domain member servers use the winbindd service to map Windows SIDs to Unix UIDs/GIDs, and these mappings are stored in the `winbindd_idmap.tdb` file located in `/var/lib/samba/`. This TDB (Trivial Database) file maintains the persistent ID mapping database, which is essential for translating between the two security identifier systems.

Answer

/etc/group

Answer

/var/lib/samba/private/secrets.tdb

Answer

/etc/passwd

Question 6

A Samba server is configured with 'vfs objects = recycle' to implement a recycle bin. After some time, users notice that deleted files are not appearing in the recycle bin. Which parameter is likely misconfigured?

Accepted Answer

recycle:repository. The `vfs objects = recycle` module requires the `recycle:repository` parameter to specify the directory where deleted files should be moved. If this parameter is missing or misconfigured, the recycle bin will not function, and deleted files will be permanently removed instead of being stored in the recycle repository.

Answer

recycle:maxsize

Answer

recycle:keeptree

Answer

recycle:versions

Question 7

An administrator wants to restrict access to a Samba share based on client IP addresses. Which parameter in the [share] section of smb.conf should be used?

Accepted Answer

hosts allow. The `hosts allow` parameter in the `[share]` section of `smb.conf` restricts access to the Samba share based on client IP addresses or subnets. It is the correct directive for IP-based access control, allowing the administrator to specify which hosts are permitted to connect. This parameter is evaluated before authentication, blocking unauthorized IPs at the connection level.

Answer

allow hosts

Answer

browseable

Answer

valid users

Question 8

After modifying /etc/samba/smb.conf, an administrator runs a command to validate the configuration. Which command is correct?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to validate the syntax and configuration of the `/etc/samba/smb.conf` file. It checks for errors in parameters, missing sections, and logical inconsistencies without restarting the Samba services, making it the standard tool for configuration verification.

Answer

smbpasswd

Answer

smbcontrol

Answer

samba-tool

Question 9

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

Accepted Answer

The winbind service is not running.. The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Answer

The smb.conf file is missing the 'idmap config' lines.

Answer

The Kerberos ticket is expired.

Answer

The system clock is not synchronized with the domain controller.

Question 10

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. It uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 11

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 12

In Samba 4, what is the default security mode when no 'security' parameter is set in the [global] section?

Accepted Answer

user. In Samba 4, when no 'security' parameter is explicitly set in the [global] section, the default security mode is 'user'. This means clients must authenticate with a valid username and password, and Samba validates credentials against the local passdb backend (e.g., tdbsam or LDAP). This default has been consistent since Samba 3.x and ensures that each connection is tied to a specific user identity.

Answer

ads

Answer

share

Answer

domain

Question 13

Which TWO of the following are valid methods to join a Samba server to an Active Directory domain using Samba 4?

Accepted Answer

`net ads join`. Option C, `net ads join`, is correct because the `net` utility's `ads` subcommand performs a Kerberos-based join of a Samba member server to an Active Directory domain, creating the machine account and keytab. Option D, `samba-tool domain join`, is correct because Samba 4's `samba-tool` provides the `domain join` subcommand to join a host to an AD domain (e.g., as a member server or DC), handling the machine account and secrets. Option A, `smbpasswd -j`, is not a valid AD join method; `smbpasswd` manages Samba passwords and its `-j` option relates to joining a domain in older NT4-style contexts, not AD. Option B, `winbindd -j`, is invalid because `winbindd` is the Winbind daemon and has no `-j` join option. Option E, `net rpc join`, while a real command, performs an NT4-style RPC join rather than an Active Directory join, so it is not the correct AD method here.

Answer

`smbpasswd -j`

Answer

`winbindd -j`

Answer

`net rpc join`

Question 14

A user 'bob' is unable to save changes to report.doc. Based on the exhibit, what is the most likely reason?

Accepted Answer

Alice has the file open with a deny-write lock.. The exhibit shows that Alice has the file open with a deny-write lock, which prevents any other user (including Bob) from writing to the file. In Samba, this is enforced by the share mode locking mechanism, where a deny-write share access request from Alice blocks subsequent write attempts by Bob until Alice closes the file.

Answer

The oplock is set to NONE causing conflicts.

Answer

Bob does not have permission on the filesystem.

Answer

The share is configured as read-only.

Question 15

What is the purpose of the 'idmap config * : backend = tdb2' line?

Accepted Answer

It sets the default identity mapping backend to tdb2.. The 'idmap config * : backend = tdb2' line in Samba's smb.conf configures the default identity mapping backend for all domains not explicitly specified. The asterisk (*) acts as a wildcard representing any domain, and 'tdb2' is a high-performance, clustered-aware database backend that stores mappings between Windows SIDs and Unix UIDs/GIDs. This ensures that when a user or group from an unspecified domain is encountered, Samba uses tdb2 to manage the ID mapping, making option A correct.

Answer

It specifies the security mode as user.

Answer

It defines the default domain for Samba.

Answer

It enables the winbind cache.