LPIC-2 File Sharing and Samba — Timed 15 Questions

Question 1

A company wants to use Samba to share files with Windows clients. Which service must be enabled in Samba to support Windows Active Directory domain membership?

Accepted Answer

winbind. Winbind (winbindd) is the Samba service that integrates with Windows Active Directory by resolving user and group information from the domain controller. It uses the Microsoft Active Directory authentication protocol (Kerberos) and LDAP to map Windows domain users to local Unix accounts, enabling domain membership and single sign-on.

Answer

nmbd

Answer

smbd

Answer

swat

Question 2

A Samba administrator notices that Windows clients cannot access a shared directory. The share is defined in smb.conf as follows:

[shared]
path = /srv/samba/shared
valid users = @staff
browseable = yes
read only = no

The /srv/samba/shared directory has permissions 755 and is owned by root:staff. Which is the most likely cause of the access issue?

Accepted Answer

The 'staff' group lacks write permission on the directory. The 'staff' group lacks write permission on the directory because the directory has permissions 755, which grants write access only to the owner (root). Even though the share is defined as 'read only = no', Samba enforces filesystem-level permissions. Since the 'valid users = @staff' restricts access to members of the staff group, they need write permission on the directory to create or modify files. The group 'staff' has only read and execute permissions (r-x), so write operations fail.

Answer

The 'valid users' parameter is misspelled

Answer

The share is defined as browseable but not listed

Answer

SELinux is blocking access and must be disabled

Question 3

A Samba server is configured as a domain member in an Active Directory environment. Users report that after changing their password on a Windows client, they cannot authenticate to Samba shares. The Samba server is using winbind and the 'idmap_ad' backend. What is the most likely cause?

Accepted Answer

Password changes are not replicated to the domain controller that Samba authenticates against. In an Active Directory domain member configuration, Samba authenticates against a specific domain controller (DC). When a user changes their password on a Windows client, the new password is initially written to the DC that processed the change. If the Samba server's winbind service is authenticating against a different DC that has not yet received the replicated password update, authentication will fail. This is the most likely cause because password replication in AD is not instantaneous and depends on replication latency.

Answer

The 'winbind offline logon' option is not enabled

Answer

The winbind cache is outdated and needs to be cleared

Answer

The 'idmap backend' must be set to 'rid' instead of 'ad'

Question 4

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 5

Which Samba component provides NetBIOS name resolution and browsing services?

Accepted Answer

nmbd. The nmbd daemon is the Samba component responsible for NetBIOS name resolution and browsing services. It listens for NetBIOS name service requests (port 137/UDP) and datagram distribution (port 138/UDP), enabling Windows clients to resolve NetBIOS names to IP addresses and participate in network browsing (e.g., listing shares in Network Neighborhood). Without nmbd, Samba cannot provide legacy NetBIOS-based name resolution or browse lists, though modern Samba can also use DNS-based discovery.

Answer

swat

Answer

smbd

Answer

winbind

Question 6

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

Accepted Answer

The 'valid users' parameter uses domain prefix while default domain is set. When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Answer

The 'winbind use default domain' option should be 'no'

Answer

The 'idmap backend' is not configured

Answer

The Samba server's time is not synchronized with the domain controller

Question 7

An administrator needs to configure Samba to allow guest access to a share. Which two parameters must be set?

Accepted Answer

guest ok = yes in the share definition. Option C is correct because setting `guest ok = yes` in the share definition explicitly allows guest (anonymous) access to that specific Samba share. Without this parameter, the share will require authentication even if other guest-related settings are configured globally.

Answer

security = share

Answer

guest account = nobody

Question 8

After modifying smb.conf, which command should be used to verify the configuration syntax before restarting Samba?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to parse and validate the syntax of the Samba configuration file `smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be restarted. This ensures that any syntax problems are caught before applying changes to the running Samba daemons (smbd, nmbd, winbindd).

Answer

net conf

Answer

smbpasswd

Answer

smbcontrol

Question 9

Which TWO parameters are used to control Samba's printer sharing? (Choose two.)

Accepted Answer

printable. The `printable` parameter in Samba's smb.conf marks a share as a printer, enabling clients to send print jobs to it. The `load printers` parameter, when set to 'yes', automatically loads all printers from the system's printcap file into Samba's browse list, making them available for sharing without manual configuration.

Answer

printer name

Answer

printing

Answer

use client driver

Question 10

Which THREE statements about Samba's 'net' command are true? (Choose three.)

Accepted Answer

net ads join joins the server to an Active Directory domain. Option A is correct because 'net ads join' is the Samba command used to join a Linux server to an Active Directory domain, leveraging the Kerberos and LDAP protocols to authenticate and register the server as a domain member. This is a core function for integrating Samba with modern Windows domains.

Answer

net conf drop drops all database connections

Answer

net share lists shares on the local Samba server

Question 11

Which TWO files are commonly used by Samba for configuration and user authentication? (Choose two.)

Accepted Answer

/etc/samba/smbpasswd. Option C is correct because `/etc/samba/smbpasswd` is the traditional Samba password file used for user authentication in Samba's own encrypted password format (LM/NT hashes). Option E is correct because `/etc/samba/smb.conf` is the primary Samba configuration file that defines shares, global settings, and security parameters. Both files are essential for Samba's operation: `smb.conf` controls the server behavior, while `smbpasswd` stores user credentials for SMB/CIFS authentication.

Answer

/etc/samba/smbusers

Answer

/etc/passwd

Answer

/etc/hosts.allow

Question 12

Which THREE are valid values for the 'security' parameter in smb.conf? (Choose three.)

Accepted Answer

ads. Option B (ads) is correct because the 'security = ads' setting in smb.conf configures Samba to operate in Active Directory domain member mode, allowing it to join an Active Directory domain using Kerberos authentication and LDAP for identity resolution. This is a valid security mode for integrating Samba with Windows Active Directory environments.

Answer

auto

Answer

share

Question 13

Given the smb.conf exhibit, which share(s) allow write access to user 'alice' who is a member of the 'staff' group?

Accepted Answer

share1 only. Option C is correct because in the smb.conf exhibit, share1 has 'write list = @staff' which grants write access to all members of the staff group, including user alice. share2 has 'read only = yes' and no write list, so it is read-only for everyone. share3 has 'valid users = bob' and 'write list = bob', so only bob can write; alice is not listed and is not in the bob group, so she has no write access.

Answer

share1 and share3

Answer

share3 only

Answer

share2 only

Question 14

Based on the smbstatus output, which statement is true?

Accepted Answer

User 'alice' connected from IP 192.168.1.10 using SMB3 protocol. Option A is correct because the smbstatus output shows that user 'alice' is connected from IP address 192.168.1.10 and the 'Protocol' column explicitly lists 'SMB3_02', which is a variant of the SMB3 protocol. This directly matches the statement in option A.

Answer

Both users are using SMB2 protocol

Answer

User 'bob' is accessing share2 with write permissions

Answer

User 'alice' has an exclusive lock on report.pdf

Question 15

Your company runs a Samba file server (version 4.15) in a mixed environment with Windows 10 and Linux clients. The server is part of an Active Directory domain. Recently, a new security policy requires that all SMB connections use SMB3 encryption. You have configured 'smb encrypt = required' in the [global] section of smb.conf and restarted smbd. However, Windows clients report that they cannot connect to the server, while Linux clients can connect using mount.cifs with the 'seal' option. You check smb.conf and verify that 'server min protocol = SMB3' is set. What is the most likely cause of the Windows clients' inability to connect?

Accepted Answer

Windows clients do not have SMB encryption enabled by default, so they reject the required encryption. Windows 10 clients do not enable SMB encryption by default; they require the client to request encryption, but when the server sets 'smb encrypt = required', the server demands encryption on all connections. Windows clients without explicit encryption configuration (e.g., via Group Policy or registry) will fail to connect because they do not negotiate SMB3 encryption automatically. Linux clients succeed because mount.cifs with the 'seal' option explicitly requests encryption, matching the server's requirement.

Answer

The 'server min protocol = SMB3' should be 'SMB2' to allow Windows 10 to negotiate SMB3

Answer

The Samba server must be joined to the domain again after changing encryption settings

Answer

The 'smb encrypt' parameter is deprecated and should be replaced by 'server smb encrypt'