LPIC-2 File Sharing and Samba — Timed 15 Questions

Question 1

A Samba administrator notices that Windows clients cannot access a shared directory. The share is defined in smb.conf as follows:

[shared]
path = /srv/samba/shared
valid users = @staff
browseable = yes
read only = no

The /srv/samba/shared directory has permissions 755 and is owned by root:staff. Which is the most likely cause of the access issue?

Accepted Answer

The 'staff' group lacks write permission on the directory. The 'staff' group lacks write permission on the directory because the directory has permissions 755, which grants write access only to the owner (root). Even though the share is defined as 'read only = no', Samba enforces filesystem-level permissions. Since the 'valid users = @staff' restricts access to members of the staff group, they need write permission on the directory to create or modify files. The group 'staff' has only read and execute permissions (r-x), so write operations fail.

Answer

The 'valid users' parameter is misspelled

Answer

The share is defined as browseable but not listed

Answer

SELinux is blocking access and must be disabled

Question 2

A Samba server is configured as a domain member in an Active Directory environment. Users report that after changing their password on a Windows client, they cannot authenticate to Samba shares. The Samba server is using winbind and the 'idmap_ad' backend. What is the most likely cause?

Accepted Answer

Password changes are not replicated to the domain controller that Samba authenticates against. In an Active Directory domain member configuration, Samba authenticates against a specific domain controller (DC). When a user changes their password on a Windows client, the new password is initially written to the DC that processed the change. If the Samba server's winbind service is authenticating against a different DC that has not yet received the replicated password update, authentication will fail. This is the most likely cause because password replication in AD is not instantaneous and depends on replication latency.

Answer

The 'winbind offline logon' option is not enabled

Answer

The winbind cache is outdated and needs to be cleared

Answer

The 'idmap backend' must be set to 'rid' instead of 'ad'

Question 3

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

Accepted Answer

The 'valid users' parameter uses domain prefix while default domain is set. When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Answer

The 'winbind use default domain' option should be 'no'

Answer

The 'idmap backend' is not configured

Answer

The Samba server's time is not synchronized with the domain controller

Question 4

An administrator needs to configure Samba to allow guest access to a share. Which two parameters must be set?

Accepted Answer

guest ok = yes in the share definition. Option C is correct because placing 'guest ok = yes' inside the share definition is what actually permits unauthenticated (guest) connections to that specific share, allowing users to access it without valid credentials. Option D is correct because 'map to guest = Bad User' in the [global] section tells Samba to treat logins with an invalid username as guest access, which is the standard way to let unknown users fall through to the guest account rather than being rejected. Together these two parameters enable guest access: the global mapping decides when a connection becomes a guest, and the share-level setting authorizes that guest access on the share. Option A is not required because 'security = share' is a deprecated/removed mode in modern Samba (Samba 4.x uses 'security = user' with guest mapping instead). Option B is not required because 'guest account = nobody' only specifies which Unix account guest sessions run as; it is a default value and does not by itself enable guest access to a share.

Answer

security = share

Answer

guest account = nobody

Question 5

Which TWO parameters are used to control Samba's printer sharing? (Choose two.)

Accepted Answer

printable. Option B, printable, is correct because in smb.conf it is the per-share boolean that marks a share as a printer share, allowing clients to submit print jobs to it (printable = yes). Option D, load printers, is correct because it is the global parameter that tells Samba whether to automatically create printer shares for all printers defined in the system's printcap/print service (load printers = yes). The other options do not serve these roles: 'printer name' is not a valid smb.conf parameter (the actual parameter is 'printer' or 'print command' contexts), 'printing' is the global parameter selecting the print system backend (e.g., cups, bsd) rather than controlling printer sharing, and 'use client driver' is a per-printer share parameter controlling whether the client supplies its own driver, not whether printers are shared.

Answer

printer name

Answer

printing

Answer

use client driver

Question 6

Which THREE statements about Samba's 'net' command are true? (Choose three.)

Accepted Answer

net ads join joins the server to an Active Directory domain. Option A is correct because 'net ads join' is the Samba command used to join a Samba server to an Active Directory domain, performing the necessary machine account creation and Kerberos keytab setup. Option C is correct because 'net usershare add' creates a user-defined share in the usershare system, allowing non-root users to publish shares without editing smb.conf. Option D is correct because 'net rpc info' queries a Windows NT4-style (or compatible) domain controller via MS-RPC to display domain information such as the domain name and SID. Option B is not correct because 'net conf drop' does not drop all database connections; it removes a stored configuration from the registry-based configuration database. Option E is not correct because 'net share' is not the standard Samba command for listing local shares; that is done with 'net share' only in specific contexts, whereas Samba typically uses 'smbclient -L' or 'net rpc share' to enumerate shares.

Answer

net conf drop drops all database connections

Answer

net share lists shares on the local Samba server

Question 7

Which THREE are valid values for the 'security' parameter in smb.conf? (Choose three.)

Accepted Answer

ads. In smb.conf, the 'security' parameter accepts three classic values: 'ads' (option B), which makes Samba act as a member of an Active Directory domain and use Kerberos authentication; 'domain' (option D), which delegates authentication to a Windows NT-style domain controller; and 'user' (option E), the default mode where Samba validates credentials against its own local account database. These three are the documented valid settings for the security parameter. Option A ('auto') is not a recognized value — Samba never auto-negotiates the security mode this way. Option C ('share') was a legacy share-level security mode that has been removed from modern Samba, so it is not a valid current value.

Answer

auto

Answer

share

Question 8

Based on the smbstatus output, which statement is true?

Accepted Answer

User 'alice' connected from IP 192.168.1.10 using SMB3 protocol. The smbstatus output shows that user 'alice' is connected from IP address 192.168.1.10 and the 'Protocol' column explicitly lists 'SMB3_11', which is a variant of the SMB3 protocol. This directly matches the statement in option A that alice is using SMB3 protocol.

Answer

Both users are using SMB2 protocol

Answer

User 'bob' is accessing share2 with write permissions

Answer

User 'alice' has an exclusive lock on report.pdf

Question 9

Your company runs a Samba file server (version 4.15) in a mixed environment with Windows 10 and Linux clients. The server is part of an Active Directory domain. Recently, a new security policy requires that all SMB connections use SMB3 encryption. You have configured 'smb encrypt = required' in the [global] section of smb.conf and restarted smbd. However, Windows clients report that they cannot connect to the server, while Linux clients can connect using mount.cifs with the 'seal' option. You check smb.conf and verify that 'server min protocol = SMB3' is set. What is the most likely cause of the Windows clients' inability to connect?

Accepted Answer

Windows clients do not have SMB encryption enabled by default, so they reject the required encryption. Windows 10 clients do not enable SMB encryption by default; they require the client to request encryption, but when the server sets 'smb encrypt = required', the server demands encryption on all connections. Windows clients without explicit encryption configuration (e.g., via Group Policy or registry) will fail to connect because they do not negotiate SMB3 encryption automatically. Linux clients succeed because mount.cifs with the 'seal' option explicitly requests encryption, matching the server's requirement.

Answer

The 'server min protocol = SMB3' should be 'SMB2' to allow Windows 10 to negotiate SMB3

Answer

The Samba server must be joined to the domain again after changing encryption settings

Answer

The 'smb encrypt' parameter is deprecated and should be replaced by 'server smb encrypt'

Question 10

A system administrator wants to configure a Samba share that grants read-only access to the 'staff' group and full control to the 'managers' group. Which share configuration achieves this?

Accepted Answer

[share]
path = /srv/share
valid users = +staff
write list = @managers. The `valid users = +staff` directive restricts access to members of the 'staff' group (the `+` prefix means a Unix group), while the `write list = @managers` directive grants write access to members of the 'managers' group (the `@` prefix also means a Unix group). This combination ensures that 'staff' members have read-only access by default, and 'managers' members have full control (read/write).

Answer

[share]
path = /srv/share
valid users = @managers
write list = @managers

Answer

[share]
path = /srv/share
valid users = +staff
write list = +managers

Answer

[share]
path = /srv/share
valid users = @staff
write list = @staff

Question 11

A Linux server running Samba as a domain member is experiencing slow authentication for users. Which two configuration changes are most likely to improve authentication performance?

Accepted Answer

Enable 'winbind offline logon = yes'. Option B is correct because enabling 'winbind offline logon = yes' allows winbind to cache domain credentials locally, so authentication can succeed from the cache without contacting the domain controller on every login, directly reducing authentication latency. Option C is correct because setting 'idmap config * : backend = tdb' uses a local TDB database to cache SID-to-UID/GID mappings, avoiding repeated LDAP/RPC lookups to the domain controller for identity resolution during authentication. Option A is not appropriate because disabling SMB signing weakens security and does not address the root cause of slow domain authentication. Option D is wrong because changing 'security = ADS' to 'security = user' would break domain membership and Active Directory authentication entirely. Option E is incorrect because the 'name resolve order' setting affects NetBIOS name resolution, not authentication performance, and listing 'wins' before 'host' can even slow resolution.

Answer

Disable SMB signing by setting 'server signing = disabled'

Answer

Change 'security = ADS' to 'security = user'

Answer

Set 'name resolve order = lmhosts host wins bcast'

Question 12

A Samba server is configured as a print server. Clients running Windows 10 report that printer drivers cannot be uploaded. The relevant smb.conf section is:

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
printable = yes

What is the most likely cause?

Accepted Answer

The 'guest ok = yes' directive is missing. The 'printable = yes' directive is present, so option A is not the issue. The 'path' /var/spool/samba is the standard spool directory for Samba print jobs, so option B is incorrect. The 'browseable = no' only hides the share from browsing, but does not prevent driver uploads; Windows clients can still connect directly. The most likely cause is that 'guest ok = yes' is missing, because by default Samba requires authentication for printer shares, and Windows 10 clients attempting to upload drivers often do so under the guest account (or without valid credentials) unless the share explicitly allows guest access. Without 'guest ok = yes', the upload is denied.

Answer

The 'printable = yes' directive is missing

Answer

The 'path' is incorrectly set to /var/spool/samba

Answer

The 'browseable = no' directive prevents driver discovery

Question 13

Which TWO of the following are valid ways to map a Windows user to a Linux account in Samba?

Accepted Answer

Using a 'username map' file specified by the 'username map' parameter. Option A is correct because Samba's 'username map' parameter points to a file (e.g., /etc/samba/smbusers) where entries like 'linuxuser = winuser' explicitly map incoming Windows/SMB usernames to local Linux accounts, which is the canonical way to map users. Option B is correct because 'force user' in a share definition makes all connections to that share operate as the specified Linux account, effectively mapping any Windows user accessing the share to that Linux user. Option C is wrong because smbpasswd has no 'map user' command; user mapping is not done through smbpasswd. Option D is wrong because 'winbind use default domain' only affects how Winbind qualifies domain usernames, not mapping a Windows user to a specific Linux account. Option E is wrong because 'valid users' merely restricts which users may access a share; it does not map a Windows user to a Linux account.

Answer

Using the 'map user' command in smbpasswd

Answer

Setting 'winbind use default domain = yes'

Answer

Using the 'valid users' directive in smb.conf

Question 14

A company runs a mixed Linux/Windows environment. The Samba server (version 4.15) is configured as a domain member using 'security = ADS'. Recently, the IT team enabled 'winbind use default domain = yes' to simplify logins. After the change, users report that they can no longer access Samba shares when authenticating with just their username (e.g., 'jdoe') instead of 'DOMAIN\jdoe'. However, authentication using the full domain-qualified name still works. The smb.conf includes:

[global]
security = ADS
workgroup = MYDOM
realm = MYDOM.LOCAL
winbind use default domain = yes
winbind separator = /

Users are in the 'Domain Users' group and the share configuration is:
[share]
path = /srv/share
valid users = @"MYDOM\domain users"

Which of the following is the most likely cause and solution?

Accepted Answer

Change 'winbind separator' to backslash or remove it to default to backslash. When 'winbind use default domain = yes' is set, Samba expects the winbind separator to be a backslash (\), not a forward slash (/). With a forward slash separator, the username 'jdoe' is not correctly mapped to 'MYDOM\jdoe' during authentication, causing access failures. Changing the separator to backslash (or removing it to default to backslash) resolves the issue by aligning with Samba's internal handling of default domain usernames.

Answer

Disable 'winbind use default domain' to force full domain qualification

Answer

The valid users line uses quotes around the group name; remove the quotes

Answer

Enable 'winbind offline logon' to allow cached credentials

Question 15

Which TWO commands can be used to query a Samba server for its available shares and workgroups?

Accepted Answer

smbclient -L. Only `smbclient -L` correctly lists both available shares and workgroups from a Samba server. `nmblookup` is used for NetBIOS name resolution and can query workgroup names but does not list shared resources. The other options either inspect local state or are not applicable.

Answer

net share

Answer

smbstatus

Answer

testparm

Answer

nmblookup