LPIC-2 File Sharing and Samba Practice Test 7 — 15 Questions

Question 1

An administrator has configured Samba as a domain member for an Active Directory environment. For user authentication via winbind, which daemon must be running?

Accepted Answer

winbindd. In a Samba domain member configuration for Active Directory, the winbindd daemon is responsible for resolving user and group information from the Windows domain and providing authentication services via the Winbind protocol. It communicates with the Active Directory domain controller using DCE/RPC and LDAP to map Windows SIDs to Unix UIDs/GIDs, enabling seamless user authentication. Without winbindd running, winbind-based authentication (e.g., via PAM or nsswitch) will fail, even if smbd and nmbd are active.

Answer

smbd

Answer

samba

Answer

nmbd

Question 2

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

Accepted Answer

printing = cups. The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients. Together, these three parameters are essential for seamless CUPS integration.

Answer

cups server = localhost

Answer

cups options = "raw"

Question 3

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 4

Windows clients cannot see the Samba server in Network Neighborhood, but they can access shares by typing the UNC path. Which Samba daemon must be running?

Accepted Answer

nmbd. The nmbd daemon is responsible for NetBIOS name resolution and browsing, which enables Windows clients to discover Samba servers in Network Neighborhood. When nmbd is not running, clients can still connect via UNC paths because smbd handles file sharing directly, but browsing and name resolution fail.

Answer

smbd

Answer

samba

Answer

winbindd

Question 5

Which TWO conditions are most likely to cause 'NT_STATUS_ACCESS_DENIED' when accessing a Samba share?

Accepted Answer

Linux filesystem permissions disallow write. Option C is correct because Samba enforces the underlying Linux filesystem permissions (POSIX mode bits and ownership) in addition to its own share-level checks, so if the mapped Unix user lacks write access to the directory or file, the client receives NT_STATUS_ACCESS_DENIED. Option D is correct because a share defined with read-only = yes (or valid users/read list restricting write) causes Samba to reject write operations with NT_STATUS_ACCESS_DENIED even when the Unix permissions would otherwise allow them. Option A is wrong because an lmhosts misconfiguration affects NetBIOS name resolution, typically producing name-not-found or connection timeouts rather than an access-denied status. Option B is wrong because an SMB dialect mismatch usually results in protocol negotiation failures or connection resets, not NT_STATUS_ACCESS_DENIED. Option E is wrong because a firewall blocking TCP 445 prevents the SMB session from being established at all, yielding a connection timeout or refused error instead of an access-denied response.

Answer

Lmhosts file misconfiguration

Answer

SMB protocol version mismatch

Answer

Windows firewall blocking port 445

Question 6

Which THREE commands are specifically used to diagnose Samba issues?

Accepted Answer

smbstatus. smbstatus (A) is correct because it is a Samba-specific tool that reports current SMB/CIFS connections, open shares, locked files, and the Samba version, making it ideal for diagnosing active Samba sessions. testparm (B) is correct because it validates the smb.conf configuration file for syntax errors and prints the resulting parameter set, which is essential when troubleshooting Samba startup or share-access problems. smbtree (C) is correct because it is a Samba client utility that enumerates the SMB/CIFS network neighborhood by querying browse masters and workgroups, helping diagnose name resolution and browsing issues. netstat (D) is not Samba-specific; it is a general network tool that lists sockets and routing information for any service. ping (E) is a generic ICMP reachability test and does not inspect Samba configuration, sessions, or SMB shares.

Answer

netstat

Answer

ping

Question 7

A user alice is connected to the 'data' share via smbd, but a file is locked. Which command can forcibly close the file?

Accepted Answer

smbcontrol smbd close-share data. `smbcontrol smbd close-share data` sends a message to the smbd process to forcibly close all open files on the 'data' share, releasing any locks held by users like alice. This command directly targets the Samba daemon's internal state without disrupting the entire service or other shares.

Answer

smbpasswd -L -e alice

Answer

systemctl restart nmbd

Answer

kill -9 $(pgrep smbd)

Question 8

After modifying /etc/samba/smb.conf, which command should be used to verify the syntax before restarting the Samba service?

Accepted Answer

testparm. The `testparm` command is specifically designed to parse and validate the syntax of the Samba configuration file `/etc/samba/smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be running. This makes it the correct tool to verify syntax before restarting Samba.

Answer

nmblookup

Answer

smbclient

Answer

smbstatus

Question 9

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

Accepted Answer

security = user. The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Answer

security = domain

Answer

security = server

Answer

security = share

Question 10

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 11

An administrator needs to configure Samba to use encrypted passwords via LDAP backend. The LDAP server is already set up with the necessary schema. Which passdb backend should be specified in smb.conf?

Accepted Answer

passdb backend = ldapsam:ldap://ldap.example.com. The `ldapsam` passdb backend is the Samba module specifically designed to store and authenticate user accounts (including encrypted passwords) against an LDAP directory. The syntax `ldapsam:ldap://ldap.example.com` tells Samba to use the LDAP SAM (Security Account Manager) backend, which maps Samba's account attributes to LDAP entries using the standard Samba LDAP schema (e.g., sambaSamAccount).

Answer

passdb backend = ldap:ldap://ldap.example.com

Answer

passdb backend = secret:ldap://ldap.example.com

Answer

passdb backend = sam:ldap://ldap.example.com

Question 12

A company uses Samba to share files from a Linux server to Windows clients. After upgrading Samba from version 4.10 to 4.15, some users report they cannot access shares and receive 'Access denied' errors. The smb.conf has been verified and seems correct. What is the most likely cause?

Accepted Answer

The 'ntlm auth' parameter is set to 'no' in the new version.. Starting with Samba 4.11, the default value of the 'ntlm auth' parameter changed from 'yes' to 'no'. This disables NTLMv1 authentication, which many legacy Windows clients or configurations still rely on. Even though the smb.conf appears correct, the new default silently blocks NTLMv1, causing 'Access denied' errors after the upgrade.

Answer

The firewall is blocking SMB ports.

Answer

The users' passwords are too short.

Answer

The Samba service is not running after upgrade.

Question 13

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Accepted Answer

invalid users. Option B, invalid users, is correct because it explicitly denies the listed usernames from accessing the share, so any account named there is blocked regardless of other permissions. Option D, valid users, is correct because it defines an allow-list of usernames (or groups) that are permitted to log in and access the share, restricting access to only those accounts. Together they provide username-based access control in smb.conf. Option A, hosts allow, is incorrect because it filters by client IP address or network, not by username. Option C, write list, is incorrect because it grants write permission to listed users but does not restrict who may access the share. Option E, read list, is incorrect because it grants read-only access to listed users rather than limiting share access by username.

Answer

hosts allow

Answer

write list

Answer

read list

Question 14

A company has a Samba server configured as a domain member in an Active Directory domain. The server runs Samba 4.13. Recently, Windows clients have been unable to access shares, and the domain join seems broken. The administrator runs 'net ads testjoin' and gets 'Join to domain is not valid'. The smb.conf includes: security = ads, realm = EXAMPLE.COM, workgroup = EXAMPLE. The administrator can successfully resolve the domain controller via DNS. What should the administrator do to fix the issue?

Accepted Answer

Re-run 'net ads join -U administrator' to rejoin the domain.. The 'net ads testjoin' command returned 'Join to domain is not valid', which indicates the machine account password stored in the local secrets.tdb file no longer matches the one in Active Directory. Re-running 'net ads join -U administrator' re-establishes the secure channel by resetting the machine account password and updating the Kerberos keytab, restoring the domain membership.

Answer

Restart the winbind service and run 'wbinfo -t'.

Answer

Add 'kerberos method = secrets and keytab' to smb.conf.

Answer

Increase the 'log level' to 3 and restart smbd.

Question 15

A company runs Samba on a Linux server to provide file shares to Windows clients. The server is also a BIND DNS server. After a recent OS upgrade, the Samba service fails to start with the error: 'Failed to create a listening socket for port 445: Permission denied'. The administrator checks that no other service is using port 445. smbd is configured to start as root. What is the most likely cause?

Accepted Answer

SELinux is blocking the Samba port.. SELinux, when enforcing, can block Samba from binding to privileged ports like 445 even when the service runs as root. The error 'Permission denied' on port 445, despite no other service using it and the firewall being open, strongly indicates SELinux is denying the bind. The SELinux boolean 'samba_port_t' or the specific port context must be enabled or relabeled for Samba to bind to port 445.

Answer

The firewall is blocking the port even though it's internal.

Answer

The 'socket address' parameter is set to an invalid IP.

Answer

The Samba netbios name is too long.