LPIC-2 File Sharing and Samba Practice Question
Your company runs a Samba file server (version 4.15) in a mixed environment with Windows 10 and Linux clients. The server is part of an Active Directory domain. Recently, a new security policy requires that all SMB connections use SMB3 encryption. You have configured 'smb encrypt = required' in the [global] section of smb.conf and restarted smbd. However, Windows clients report that they cannot connect to the server, while Linux clients can connect using mount.cifs with the 'seal' option. You check smb.conf and verify that 'server min protocol = SMB3' is set. What is the most likely cause of the Windows clients' inability to connect?
⚠ Common exam trap
It's easy for candidates to assume Windows clients automatically support and negotiate SMB3 encryption when the server requires it, overlooking that Windows clients need explicit configuration to enable encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows clients do not have SMB encryption enabled by default, so they reject the required encryption
Windows 10 clients do not enable SMB encryption by default; they require the client to request encryption, but when the server sets 'smb encrypt = required', the server demands encryption on all connections. Windows clients without explicit encryption configuration (e.g., via Group Policy or registry) will fail to connect because they do not negotiate SMB3 encryption automatically. Linux clients succeed because mount.cifs with the 'seal' option explicitly requests encryption, matching the server's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'server min protocol = SMB3' should be 'SMB2' to allow Windows 10 to negotiate SMB3
Why it's wrong here
Windows 10 supports SMB3 natively, protocol negotiation is fine.
- ✓
Windows clients do not have SMB encryption enabled by default, so they reject the required encryption
Why this is correct
SMB encryption must be enabled on Windows client side.
- ✗
The Samba server must be joined to the domain again after changing encryption settings
Why it's wrong here
Re-joining is not required for encryption changes.
- ✗
The 'smb encrypt' parameter is deprecated and should be replaced by 'server smb encrypt'
Why it's wrong here
'smb encrypt' is valid in Samba 4.15.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.