Courseiva

CCNA File Sharing and Samba Questions

17 of 92 questions · Page 2/2 · File Sharing and Samba · Answers revealed

Practice these questionsDomain overviewAll questions
76
Multi-Selecthard

Which THREE statements about Samba's 'net' command are true? (Choose three.)

Select 3 answers
A.net ads join joins the server to an Active Directory domain
B.net conf drop drops all database connections
C.net usershare add creates a user-defined share
D.net rpc info displays domain information from a Windows NT4-style domain
E.net share lists shares on the local Samba server
AnswersA, C, D

Correct usage for AD join.

Why this answer

'net ads join' is the Samba command used to join a Linux server to an Active Directory domain, leveraging the Kerberos and LDAP protocols to authenticate and register the server as a domain member. This is a core function for integrating Samba with modern Windows domains.

Exam trap

LPI often tests the distinction between 'net share' (remote share listing via RPC) and 'net usershare list' (local user-defined shares), leading candidates to incorrectly assume 'net share' works locally.

Practice this question →
77
MCQhard

A Samba server is configured as a print server. Clients running Windows 10 report that printer drivers cannot be uploaded. The relevant smb.conf section is: [printers] comment = All Printers path = /var/spool/samba browseable = no printable = yes What is the most likely cause?

A.The 'printable = yes' directive is missing
B.The 'path' is incorrectly set to /var/spool/samba
C.The 'guest ok = yes' directive is missing
D.The 'browseable = no' directive prevents driver discovery
AnswerC

Needed for driver upload

Why this answer

The 'printable = yes' directive is present, so option A is not the issue. The 'path' /var/spool/samba is the standard spool directory for Samba print jobs, so option B is incorrect. The 'browseable = no' only hides the share from browsing, but does not prevent driver uploads; Windows clients can still connect directly.

The most likely cause is that 'guest ok = yes' is missing, because by default Samba requires authentication for printer shares, and Windows 10 clients attempting to upload drivers often do so under the guest account (or without valid credentials) unless the share explicitly allows guest access. Without 'guest ok = yes', the upload is denied.

Exam trap

The trap here is that candidates mistakenly think 'browseable = no' prevents driver discovery, when in fact Windows driver uploads rely on direct UNC connections (e.g., \\server\printername) and are independent of browseability.

How to eliminate wrong answers

Option A is wrong because 'printable = yes' is already present in the configuration, and it is required for a print share; its absence would prevent printing, not driver uploads. Option B is wrong because /var/spool/samba is the correct default spool directory for Samba print jobs; changing it would not affect driver uploads. Option D is wrong because 'browseable = no' only hides the share from network browsing (e.g., in Windows Explorer), but does not prevent Windows clients from connecting directly via the printer path or uploading drivers; driver discovery and upload use the printer's UNC path, not browsing.

Practice this question →
78
MCQmedium

An administrator wants to restrict access to a Samba share based on client IP addresses. Which parameter in the [share] section of smb.conf should be used?

A.hosts allow
B.allow hosts
C.browseable
D.valid users
AnswerA

'hosts allow' defines IP-based access control per share.

Why this answer

The `hosts allow` parameter in the `[share]` section of `smb.conf` restricts access to the Samba share based on client IP addresses or subnets. It is the correct directive for IP-based access control, allowing the administrator to specify which hosts are permitted to connect. This parameter is evaluated before authentication, blocking unauthorized IPs at the connection level.

Exam trap

The trap here is that candidates confuse the parameter order (`allow hosts` vs `hosts allow`) or mistakenly think `valid users` can filter by IP, when it only filters by authenticated user identity.

How to eliminate wrong answers

Option B is wrong because `allow hosts` is not a valid Samba parameter; the correct syntax is `hosts allow` (with the keyword order reversed). Option C is wrong because `browseable` controls whether the share appears in network browse lists, not IP-based access restrictions. Option D is wrong because `valid users` restricts access based on usernames or groups, not client IP addresses.

Practice this question →
79
MCQhard

An enterprise environment uses Samba as an Active Directory domain controller using Samba 4.11. The administrator needs to configure a read-only domain controller (RODC) for a remote branch office. Which of the following steps is correct?

A.On the RODC server, run 'samba-tool domain join EXAMPLE.COM member' and then promote to RODC.
B.Install Samba on the RODC server, then run 'samba-tool domain provision --domain=EXAMPLE --adminpass=Pa$$w0rd' on the RODC.
C.On the existing DC, run 'samba-tool domain rodc create rodc-name' and then on the RODC server join with 'samba-tool domain join EXAMPLE.COM RODC'.
D.Install Samba on the RODC server, then run 'samba-tool domain join EXAMPLE.COM RODC -UAdministrator'.
AnswerC

This correctly pre-creates the RODC account and then joins.

Why this answer

Samba 4.11 requires the RODC computer account to be pre-created on the existing DC using 'samba-tool domain rodc create', which sets up the necessary krbtgt account and replication metadata. The RODC server then joins the domain as a read-only domain controller with 'samba-tool domain join EXAMPLE.COM RODC', which authenticates against the pre-created account and configures the local Samba instance as a read-only replica.

Exam trap

The trap here is that candidates often assume a simple domain join with the RODC role flag is sufficient, overlooking the mandatory pre-creation step on the existing DC that Samba requires to establish the RODC's unique security context.

How to eliminate wrong answers

Option A is wrong because joining as a 'member' creates a domain member server, not a domain controller; promoting it to RODC afterward is not a supported workflow in Samba 4.11 and would lack the pre-created RODC account. Option B is wrong because 'samba-tool domain provision' creates a new domain, which is incorrect for adding a RODC to an existing domain; it would overwrite the domain configuration and cause a conflict. Option D is wrong because while the join command syntax is close, it omits the critical prerequisite step of pre-creating the RODC account on the existing DC; without this, the join will fail as Samba requires the RODC computer object and associated krbtgt account to exist beforehand.

Practice this question →
80
MCQmedium

A Samba server is configured as above. Users alice and bob have local system accounts but neither can connect to the share. What is the most likely cause?

A.The share path /srv/share does not exist or has incorrect permissions.
B.The parameter 'read only = no' is misspelled; it should be 'writable = yes'.
C.The users have not been added to the Samba password database.
D.The valid users list must use group names with '@' prefix, not individual names.
AnswerC

Users must be added with smbpasswd -a or pdbedit -a to enable Samba authentication.

Why this answer

Samba maintains its own password database separate from the local system accounts. Even though alice and bob have valid local UNIX accounts, they must also be added to the Samba password database using `smbpasswd -a` or `pdbedit -a` before they can authenticate to any Samba share. Without this step, Samba will reject their connection attempts regardless of share permissions or path validity.

Exam trap

The trap here is that candidates assume local system accounts automatically grant Samba access, but Samba requires explicit registration in its own password database before authentication can succeed.

How to eliminate wrong answers

Option A is wrong because even if the path does not exist or has incorrect permissions, the error would typically occur after authentication succeeds, not prevent the users from connecting at all. Option B is wrong because 'read only = no' is a valid and correctly spelled parameter in smb.conf; 'writable = yes' is an alias, not a required replacement. Option D is wrong because the 'valid users' parameter can list individual usernames directly without any prefix; the '@' prefix is only needed when specifying group names.

Practice this question →
81
MCQhard

A Samba server is configured to store NT ACLs on a Linux filesystem that does not support them natively. Which VFS module should be used to map NT ACLs to POSIX ACLs?

A.vfs objects = recycle
B.vfs objects = full_audit
C.vfs objects = streams_xattr
D.vfs objects = acl_xattr
AnswerD

acl_xattr stores NT ACLs in xattr and maps them to POSIX ACLs.

Why this answer

The `acl_xattr` VFS module is specifically designed to store NT ACLs in extended attributes on a Linux filesystem that lacks native NT ACL support. When Samba is configured with `vfs objects = acl_xattr`, it maps Windows NT ACLs to POSIX ACLs by serializing the NT ACL into the `user.NTACL` extended attribute, allowing Samba to enforce Windows-style permissions even on filesystems like ext4 or XFS that only support POSIX ACLs natively.

Exam trap

The trap here is that candidates often confuse the `streams_xattr` module (which handles alternate data streams) with the `acl_xattr` module, because both use extended attributes, but only `acl_xattr` maps NT ACLs to POSIX ACLs.

How to eliminate wrong answers

Option A is wrong because the `recycle` VFS module is used to implement a recycle bin for deleted files, not for ACL mapping. Option B is wrong because the `full_audit` VFS module is used for logging Samba operations, not for storing or mapping NT ACLs. Option C is wrong because the `streams_xattr` VFS module is used to support NTFS alternate data streams by storing them in extended attributes, but it does not handle NT ACL to POSIX ACL mapping.

Practice this question →
82
MCQmedium

A company runs a mixed Linux/Windows environment. The Samba server (version 4.15) is configured as a domain member using 'security = ADS'. Recently, the IT team enabled 'winbind use default domain = yes' to simplify logins. After the change, users report that they can no longer access Samba shares when authenticating with just their username (e.g., 'jdoe') instead of 'DOMAIN\jdoe'. However, authentication using the full domain-qualified name still works. The smb.conf includes: [global] security = ADS workgroup = MYDOM realm = MYDOM.LOCAL winbind use default domain = yes winbind separator = / Users are in the 'Domain Users' group and the share configuration is: [share] path = /srv/share valid users = @"MYDOM\domain users" Which of the following is the most likely cause and solution?

A.Change 'winbind separator' to backslash or remove it to default to backslash
B.Disable 'winbind use default domain' to force full domain qualification
C.The valid users line uses quotes around the group name; remove the quotes
D.Enable 'winbind offline logon' to allow cached credentials
AnswerA

The separator mismatch causes authentication failures

Why this answer

When 'winbind use default domain = yes' is set, Samba expects the winbind separator to be a backslash (\), not a forward slash (/). With a forward slash separator, the username 'jdoe' is not correctly mapped to 'MYDOM\jdoe' during authentication, causing access failures. Changing the separator to backslash (or removing it to default to backslash) resolves the issue by aligning with Samba's internal handling of default domain usernames.

Exam trap

The trap here is that candidates often assume the forward slash separator is interchangeable with backslash in Samba, but in the context of 'winbind use default domain = yes', only backslash works correctly for default domain username resolution.

How to eliminate wrong answers

Option B is wrong because disabling 'winbind use default domain' would force users to always use full domain qualification (e.g., 'MYDOM\jdoe'), which contradicts the goal of simplifying logins and does not fix the separator mismatch. Option C is wrong because the quotes around the group name in the valid users line are syntactically correct in Samba; they do not cause authentication failures, and removing them would not resolve the separator issue. Option D is wrong because 'winbind offline logon' is used for caching credentials for offline access, not for fixing username mapping or separator problems in a domain member configuration.

Practice this question →
83
MCQmedium

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

A.security = domain
B.security = server
C.security = share
D.security = user
AnswerD

This requires valid credentials for each connection.

Why this answer

The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Exam trap

The trap here is that candidates confuse 'authentication' with 'authorization' and assume `security = share` is correct because it sounds like 'sharing without restrictions,' but `security = share` actually bypasses user-level authentication entirely.

How to eliminate wrong answers

Option A is wrong because `security = domain` requires the Samba server to be a member of a Windows domain and relies on a domain controller for authentication, which is overkill and not necessary for a simple authenticated share without further restrictions. Option B is wrong because `security = server` is deprecated and delegates authentication to another SMB server, which adds complexity and is not the standard way to require user credentials for a local share. Option C is wrong because `security = share` allows access without per-user authentication (often using a guest or anonymous connection), which directly contradicts the requirement that users must provide valid credentials.

Practice this question →
84
Multi-Selectmedium

An administrator is setting up a Samba share for a project team. The team members are in different UNIX groups. Which three options can be used to restrict access to specific users or groups? (Choose three.)

Select 3 answers
A.read list
B.write list
C.force group
D.invalid users
E.valid users
AnswersA, D, E

Specifies users and groups that have read-only access.

Why this answer

(read list) is correct because it explicitly restricts read-only access to a list of users or groups, allowing the administrator to control which users can only read files in the Samba share. This is a direct Samba parameter that limits access to specific users or groups, even if they are in different UNIX groups.

Exam trap

The trap here is that candidates often confuse 'write list' as a restriction mechanism, but it actually grants write access, not restricts it, while 'force group' is a red herring that deals with ownership, not access control.

Practice this question →
85
Multi-Selecteasy

Which THREE commands are specifically used to diagnose Samba issues?

Select 3 answers
A.smbstatus
B.testparm
C.smbtree
D.netstat
E.ping
AnswersA, B, C

Shows current Samba connections and locked files.

Why this answer

smbstatus is correct because it displays the current Samba connections, including active SMB sessions, open files, and locked files, which is essential for diagnosing who is accessing Samba shares and what resources are in use. It queries the Samba internal state via the smbd daemon, providing real-time diagnostic information about connected clients.

Exam trap

The trap here is that candidates may confuse general network troubleshooting tools (like netstat or ping) with Samba-specific diagnostic commands, assuming any network tool can diagnose Samba issues, but only commands that directly interact with Samba daemons or its configuration are valid for this purpose.

Practice this question →
86
MCQhard

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

A.The smb.conf file is missing the 'idmap config' lines.
B.The winbind service is not running.
C.The Kerberos ticket is expired.
D.The system clock is not synchronized with the domain controller.
AnswerB

If winbind is not running, `wbinfo -u` cannot retrieve domain users.

Why this answer

The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Exam trap

The trap here is that candidates assume DNS or Kerberos issues are the root cause because they are common in domain authentication problems, but the specific symptom of `wbinfo -u` returning no output directly points to the winbind service not running, not to higher-layer protocol failures.

How to eliminate wrong answers

Option A is wrong because missing 'idmap config' lines in smb.conf would cause issues with mapping domain users to UIDs/GIDs, but `wbinfo -u` would still return usernames if winbind is running and can contact the domain controller. Option C is wrong because an expired Kerberos ticket would cause authentication failures (e.g., 'kinit' errors), but `wbinfo -u` does not rely on a cached TGT; it uses the machine account credentials via winbind. Option D is wrong because clock skew with the domain controller would cause Kerberos authentication failures, but `wbinfo -u` would still work if winbind is running and the clock difference is within default tolerances (typically 5 minutes).

Practice this question →
87
MCQmedium

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

A.NT_STATUS_BAD_NETWORK_NAME
B.NT_STATUS_ACCESS_DENIED
C.Connection successful but cannot write
D.NT_STATUS_OBJECT_NAME_NOT_FOUND
AnswerC

The user can connect (valid includes staff) but write fails due to read only and no write list.

Why this answer

The user is in group 'staff' but not 'admin', and the Samba share configuration likely has 'write list = @admin' or similar, restricting write access to the admin group. The connection succeeds (the share is visible and readable), but the write operation fails silently or returns a permission error at the filesystem level, not a network-level error. This matches the scenario where authentication passes but authorization for writing fails.

Exam trap

The trap here is that candidates confuse network-level errors (bad network name, object not found) with authorization errors, assuming any failure to write must produce a specific NT_STATUS code, when in practice Samba often returns a generic 'cannot write' message at the client level.

How to eliminate wrong answers

Option A is wrong because NT_STATUS_BAD_NETWORK_NAME indicates the share name itself is invalid or not found, which would prevent any connection, not just write access. Option B is wrong because NT_STATUS_ACCESS_DENIED is a generic error that could occur, but in Samba, when a user can connect but lacks write permissions, the client often reports 'cannot write' rather than a distinct NT_STATUS_ACCESS_DENIED; the question specifies 'most likely error' based on typical Samba behavior. Option D is wrong because NT_STATUS_OBJECT_NAME_NOT_FOUND means a specific file or directory within the share is missing, not that the user lacks write permission to the share root.

Practice this question →
88
MCQhard

A user alice is connected to the 'data' share via smbd, but a file is locked. Which command can forcibly close the file?

A.smbpasswd -L -e alice
B.smbcontrol smbd close-share data
C.systemctl restart nmbd
D.kill -9 $(pgrep smbd)
AnswerB

smbcontrol can interact with smbd to close a share.

Why this answer

`smbcontrol smbd close-share data` sends a message to the smbd process to forcibly close all open files on the 'data' share, releasing any locks held by users like alice. This command directly targets the Samba daemon's internal state without disrupting the entire service or other shares.

Exam trap

The trap here is that candidates may confuse `smbcontrol` with other Samba utilities or think that restarting the entire Samba service (nmbd or smbd) is the only way to clear locks, overlooking the targeted `close-share` command.

How to eliminate wrong answers

Option A is wrong because `smbpasswd -L -e alice` enables a local Samba user account but does not affect file locks or close open files. Option C is wrong because `systemctl restart nmbd` restarts the NetBIOS name service daemon, which handles name resolution, not file locking or share connections. Option D is wrong because `kill -9 $(pgrep smbd)` forcefully terminates all smbd processes, which would close all files but also disconnect all users and disrupt Samba services, whereas the question asks for a command that forcibly closes a specific file without unnecessary disruption.

Practice this question →
89
Multi-Selecteasy

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Select 2 answers
A.hosts allow
B.invalid users
C.write list
D.valid users
E.read list
AnswersB, D

Specifies which users are denied access to the share.

Why this answer

(invalid users) is correct because it explicitly lists usernames that are denied access to a share, overriding any other access controls. Option D (valid users) is correct because it restricts access to only the specified usernames, denying all others. Both parameters operate at the Samba share level and directly filter based on usernames.

Exam trap

The trap here is that candidates often confuse 'valid users' and 'invalid users' with access control lists (ACLs) or think they only affect write permissions, when in fact they control all access (read and write) to the share.

Practice this question →
90
MCQmedium

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

A.printing = cups
B.cups server = localhost
C.printcap name = cups
D.load printers = yes
E.cups options = "raw"
AnswerA, C, D

Specifies CUPS as the printing system.

Why this answer

The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients.

Together, these three parameters are essential for seamless CUPS integration.

Exam trap

The trap here is that candidates often assume `cups server = localhost` is required for local CUPS integration, but it is actually the default and only needed for remote CUPS servers, while `cups options = "raw"` is a common but non-essential tuning parameter, not a core requirement.

How to eliminate wrong answers

Option B is wrong because `cups server = localhost` is not a required global parameter; Samba defaults to connecting to CUPS on localhost, and this setting is only needed if CUPS runs on a different host. Option E is wrong because `cups options = "raw"` is not a global parameter for basic CUPS integration; it is an optional per-printer or global setting used to bypass CUPS filtering (e.g., for sending raw data to printers), and it is not essential for enabling CUPS support.

Practice this question →
91
MCQhard

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

A.idmap config * : backend = ad
B.idmap config * : backend = tdb
C.idmap config * : backend = autorid
D.idmap config * : backend = rid
AnswerD

This derives UIDs from RIDs for consistent mapping.

Why this answer

The `rid` backend (option D) is recommended because it generates UNIX UIDs/GIDs deterministically from the Windows RID (Relative Identifier) portion of the user's SID, ensuring that files created by domain users on the Samba server are consistently owned by the same UNIX user accounts derived from the domain. This backend does not require an RFC 2307 schema or LDAP attributes, making it ideal for simple domain member setups where automatic UID/GID mapping is needed.

Exam trap

LPI often tests the misconception that `ad` backend is the default or best choice for any domain member, but the question specifically requires deterministic mapping without schema extensions, making `rid` the correct answer.

How to eliminate wrong answers

Option A is wrong because `idmap config * : backend = ad` requires the Active Directory schema to be extended with RFC 2307 attributes (uidNumber, gidNumber) and is typically used for domain controllers or when explicit UID/GID assignment is needed, not for automatic mapping from RIDs. Option B is wrong because `tdb` is a local, file-based backend that stores mappings in a TDB file, which is not suitable for a domain member with many users as it does not provide deterministic or scalable mapping from domain SIDs. Option C is wrong because `autorid` is designed for environments with multiple trusted domains and allocates ranges automatically, but it can lead to non-deterministic UID/GID mappings across reboots or reconfigurations, making it less reliable for consistent ownership of files.

Practice this question →
92
MCQhard

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

A.The 'winbind use default domain' option should be 'no'
B.The 'idmap backend' is not configured
C.The Samba server's time is not synchronized with the domain controller
D.The 'valid users' parameter uses domain prefix while default domain is set
AnswerD

If valid users expects 'DOMAIN\user' but winbind strips the domain, authentication fails.

Why this answer

When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Exam trap

The trap here is that candidates assume authentication success means all Samba operations are fine, overlooking the subtle interaction between 'winbind use default domain' and share-level access control parameters like 'valid users'.

How to eliminate wrong answers

Option A is wrong because setting 'winbind use default domain = no' would require users to always specify the domain prefix, which does not resolve the mismatch if 'valid users' already uses a prefix; the core issue is the inconsistency between the default domain setting and the share's user specification. Option B is wrong because the 'idmap backend' configuration is essential for mapping SIDs to UIDs/GIDs, but a missing or misconfigured idmap backend typically causes authentication failures or inability to resolve user identities, not a scenario where users can authenticate but cannot access shares due to a 'valid users' mismatch. Option C is wrong because time synchronization with the domain controller is critical for Kerberos authentication; if time were out of sync, authentication itself would fail (with a clock skew error), not just share access.

Practice this question →
← PreviousPage 2 of 2 · 92 questions total

Ready to test yourself?

Try a timed practice session using only File Sharing and Samba questions.

Start 20-question session