I85PREP
⌘ K
LPIC-3 Mixed Environment study materials
LPIC-3 Mixed Environment study resources

LPIC-3 Mixed Environment practice questions

One question at a time. Build your LPIC-3 Mixed Environment understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Samba Basics

Which command should an administrator run after editing /etc/samba/smb.conf to check the file for invalid parameters without restarting any Samba service?

  1. smbstatus
  2. testparm Correct answer.
  3. smbcontrol
  4. net conf

Explanation

testparm parses smb.conf, reports unknown or invalid parameters and values, and prints the resulting configuration that the daemons would load. It only reads the file, so it never starts, stops, or restarts smbd or nmbd, which makes it safe to run immediately after every edit.

Question 2Samba Basics

Which task is performed by the smbd daemon on a Samba file server?

  1. It maps Windows security identifiers to Linux UIDs and GIDs for domain users.
  2. It handles SMB client connections, authenticates sessions, and serves file and printer shares. Correct answer.
  3. It resolves NetBIOS names and maintains the browse list for the network.
  4. It synchronizes the Samba host clock with the domain controller during a domain join.

Explanation

smbd listens on TCP ports 445 and 139, negotiates the SMB dialect, authenticates users against the configured passdb backend, and enforces share permissions while serving files and printers. Name resolution and browse-list duties belong to nmbd, and SID mapping belongs to winbindd.

Question 3Samba Basics

An administrator needs to enumerate the shares exported by the host fileserver over SMB without supplying a password and without mounting anything. Which command accomplishes this?

  1. mount.cifs //fileserver/share /mnt -o guest
  2. smbclient -L fileserver -N Correct answer.
  3. smbstatus -L
  4. net share list \\fileserver

Explanation

smbclient with the -L option requests a list of shares and other services from the target server, and -N suppresses the password prompt so the connection is attempted with the current credentials or as a null session. The command reports the shares without mounting any of them.

Question 4Samba Basics

A server is configured with security = ADS. Which smb.conf parameter names the Kerberos realm that Samba uses when authenticating domain users?

  1. realm Correct answer.
  2. winbind separator
  3. password server
  4. kerberos method

Explanation

In ADS security mode Samba obtains Kerberos tickets, so it must know the realm name, which the realm parameter supplies, conventionally in uppercase DNS form such as EXAMPLE.COM. The workgroup parameter still carries the short NetBIOS domain name, but it does not define the Kerberos realm.

Question 5Samba Basics

Which command lists the user accounts currently stored in the configured Samba passdb backend?

  1. smbclient -L localhost
  2. pdbedit -L Correct answer.
  3. smbpasswd -a
  4. net user list

Explanation

pdbedit operates directly on the passdb backend, and the -L option lists the accounts it contains together with their SMB user names. Adding a verbose flag with -v shows additional fields such as the user SID and account flags.

Question 6Samba Basics

A share definition must allow only members of the Linux group staff to connect, while denying every other user. Which share parameter achieves this?

  1. valid users = @staff Correct answer.
  2. hosts allow = @staff
  3. admin users = @staff
  4. write list = @staff

Explanation

valid users defines the complete set of users and groups permitted to access the share, and the @ prefix denotes a group name, so only members of staff are admitted. Users who are not listed are rejected at connection time regardless of file permissions.

Question 7Samba Basics

A Samba member server must create its machine account in an Active Directory domain using the credentials of a domain administrator. Which command performs the join?

  1. net rpc join -U Administrator
  2. net ads join -U Administrator Correct answer.
  3. net ads testjoin -U Administrator
  4. net groupmap add -U Administrator

Explanation

net ads join performs an Active Directory join, creating or updating the machine account and, when configured, writing the Kerberos keytab used for subsequent authentication. It relies on the realm and workgroup settings already present in smb.conf.

Question 8Samba Basics

An administrator wants winbind to allocate UID and GID values for accounts from the domain EXAMPLE only within the range 20000 to 49999. Which directive accomplishes this?

  1. template shell = 20000-49999
  2. winbind uid = 20000-49999
  3. idmap config EXAMPLE : range = 20000-49999 Correct answer.
  4. idmap uid = 20000-49999

Explanation

The modern idmap configuration uses per-domain stanzas of the form idmap config DOMAIN : range, which constrains the numeric IDs that the chosen backend may hand out for that domain. A matching idmap config EXAMPLE : backend line selects the mapping method, such as tdb, rid, or ad.

Question 9Samba Basics

A server is joined to the domain EXAMPLE and winbind is enabled. Users report that getent passwd shows entries such as EXAMPLE\jdoe. Which setting makes winbind report the plain name jdoe for accounts from the joined domain?

  1. winbind separator = +
  2. winbind use default domain = yes Correct answer.
  3. winbind enum users = yes
  4. idmap config * : backend = tdb

Explanation

winbind use default domain = yes tells winbind to omit the domain prefix for accounts belonging to the domain the server has joined, so the short user name is presented instead of the qualified form. Accounts from other trusted domains remain qualified to avoid ambiguity.

Question 10Samba Basics

An smb.conf contains the line server min protocol = SMB2_10. What is the effect on clients connecting to this server?

  1. Only clients negotiating exactly SMB 2.1 are accepted, and SMB 3.x clients are refused.
  2. SMB signing becomes mandatory for every connection, including SMB1 sessions.
  3. Guest and anonymous sessions are rejected, while authenticated SMB1 sessions are still allowed.
  4. Clients using SMB1 are refused, while SMB 2.1 and later dialects remain available. Correct answer.

Explanation

server min protocol sets the oldest dialect the server will accept, so SMB2_10 rejects SMB1 (NT1) negotiations and permits SMB 2.1, SMB 3.0, 3.02, and 3.1.1 up to whatever server max protocol allows. This is a common hardening step after disabling SMB1 on the network.

Question 11Samba Basics

A Samba file server must advertise the NetBIOS workgroup name SALES to clients browsing the network. Which parameter in the [global] section of smb.conf sets this name?

  1. realm = SALES
  2. workgroup = SALES Correct answer.
  3. server string = SALES
  4. netbios name = SALES

Explanation

The workgroup parameter defines the NetBIOS workgroup or domain name that Samba uses for browsing and legacy domain authentication. The netbios name parameter sets the server's own NetBIOS name, the server string is only a descriptive comment, and realm belongs to Kerberos configuration.

Question 12Samba Basics

Which Samba daemon registers NetBIOS names and handles browse-list elections on a classic NetBIOS network?

  1. smbd
  2. samba-bgqd
  3. nmbd Correct answer.
  4. winbindd

Explanation

nmbd provides NetBIOS name service and browsing support, including name registration and browser elections. smbd handles SMB file and print service, winbindd maps domain identities, and samba-bgqd runs background print jobs.

Question 13Samba Basics

Which command, run as root, changes the SMB password for an existing account named alice in the tdbsam passdb backend?

  1. net ads password alice
  2. passwd alice
  3. smbpasswd alice Correct answer.
  4. pdbedit -a alice

Explanation

smbpasswd updates the Samba password stored in the configured passdb backend when run by root for an existing account. passwd changes only the local Unix password, pdbedit -a adds a new Samba account, and net ads password changes an Active Directory password.

Question 14Samba Basics

Which command displays current SMB sessions, share connections, and locked files on a running Samba server?

  1. smbclient -L localhost
  2. net status shares
  3. testparm -s
  4. smbstatus Correct answer.

Explanation

smbstatus reports active SMB sessions, connected shares, and file locks by reading Samba's session and locking databases. smbclient -L lists shares, testparm validates configuration, and net status shares is not a valid Samba subcommand for this purpose.

Question 15Samba Basics

An administrator needs to define individual SID-to-UID/GID mappings by hand in a local database, without using RFC 2307 attributes in Active Directory or algorithmic RID mapping. Which winbind idmap backend fits?

  1. autorid
  2. rid
  3. tdb Correct answer.
  4. ad

Explanation

The tdb idmap backend stores manually maintained SID-to-ID mappings in a local TDB file. The ad backend reads RFC 2307 attributes from Active Directory, rid derives IDs algorithmically from the RID, and autorid allocates ranges automatically.

Question 16Samba Basics

Which command sends a NetBIOS name service query to resolve the name FILESERVER to an IPv4 address?

  1. host fileserver
  2. nslookup fileserver.example.com
  3. nmblookup fileserver Correct answer.
  4. dig fileserver

Explanation

nmblookup sends a NetBIOS name service query and can resolve a NetBIOS name to an IPv4 address. nslookup, dig, and host query DNS instead of NBNS.

Question 17Samba Basics

A share named archive must remain reachable by the UNC path \\server\archive but must not appear in the browse list shown to clients. Which share parameter achieves this?

  1. read list = nobody
  2. available = no
  3. browseable = no Correct answer.
  4. guest ok = no

Explanation

Setting browseable = no hides the share from browse lists while leaving it accessible when clients specify the share name directly. available = no disables the share entirely, guest ok controls guest access, and read list restricts read access.

Question 18Samba Basics

An administrator wants SMB clients that present an unknown username to be treated as the guest account instead of being rejected, while valid users still authenticate normally. Which [global] parameter implements this?

  1. restrict anonymous = 0
  2. map to guest = Bad User Correct answer.
  3. map to guest = Never
  4. guest account = pcguest

Explanation

map to guest = Bad User maps sessions with unknown usernames to the guest account while still authenticating valid users normally. guest account selects the Unix account used for guest access, and restrict anonymous controls anonymous enumeration rather than failed-login mapping.

Question 19Samba Basics

A security policy requires that every SMB2/SMB3 session to a Samba server be cryptographically signed, and clients that cannot sign must be refused. Which smb.conf parameter enforces this?

  1. smb encrypt = required
  2. client signing = mandatory
  3. server signing = auto
  4. server signing = mandatory Correct answer.

Explanation

server signing = mandatory requires SMB signing on incoming server sessions and refuses clients that cannot sign. server signing = auto permits unsigned sessions when negotiation allows it, client signing applies to outbound client connections, and smb encrypt requires encryption rather than signing alone.

Question 20Samba Basics

Which command stores the smb.conf parameter 'log level = 3' in Samba's registry-based configuration so the setting persists across reloads without editing smb.conf?

  1. net conf list 'log level' 3
  2. net rpc conf setparm 'log level' 3
  3. net conf setparm 'log level' 3 Correct answer.
  4. smbcontrol all reload-config 'log level' 3

Explanation

net conf setparm writes a parameter into Samba's registry-based configuration, which is read when the registry config backend is enabled. net conf list displays stored parameters, net rpc targets remote servers, and smbcontrol reload-config only asks running daemons to reload configuration.

Question 21Samba Basics

A Samba server uses the default [homes] section and no [bob] share is defined. What happens when bob authenticates and connects to \\server\bob?

  1. Samba serves the directory /srv/samba/bob, creating it if needed.
  2. Samba rejects the connection because the share name is not defined.
  3. Samba redirects the connection to the [global] section.
  4. Samba serves bob's Unix home directory using the [homes] settings. Correct answer.

Explanation

When a client requests a share whose name matches a Unix user and no explicit share exists, Samba uses [homes] and maps the share to that user's home directory from the passwd database. The directory is not created automatically, and the share is not redirected to [global].

Question 22Samba Basics

A server's hostname is fs01.example.com, but SMB clients must see its primary NetBIOS name as ACCT01. Which smb.conf parameter changes that primary name?

  1. netbios aliases = ACCT01
  2. netbios name = ACCT01 Correct answer.
  3. workgroup = ACCT01
  4. server string = ACCT01

Explanation

netbios name sets the primary NetBIOS name that Samba registers; if unset it defaults to the hostname. workgroup sets the workgroup or domain name, server string is only a description, and netbios aliases adds additional names rather than replacing the primary name.

Question 23Samba Basics

A share must accept connections from clients that provide no username or password, using the account named in the global guest account parameter. Which share-level setting enables this?

  1. map to guest = bad user
  2. security = share
  3. guest ok = yes Correct answer.
  4. restrict anonymous = no

Explanation

guest ok = yes, also called public, allows anonymous or guest connections to that share using the Unix account named by the global guest account parameter. map to guest is a global authentication-failure policy, and restrict anonymous is not a share-level switch.

Question 24Samba Basics

A share is configured with read only = yes and write list = @sales. A member of the Linux group sales opens a file in the share from an SMB client. What access does Samba grant?

  1. Read-only access, because read only = yes takes precedence.
  2. Read and write access, because write list overrides read only for listed users. Correct answer.
  3. No access, because the group must also appear in valid users.
  4. Write-only access, because read only is inverted for listed users.

Explanation

read only = yes makes the share read-only by default, but write list names users or groups that are granted write access anyway. Members of @sales therefore get read/write access while other users remain read-only; valid users is a separate access list.

Question 25Samba Basics

A share defines create mask = 0640 and force create mode = 0660. A client creates a new file and requests mode 0777. Which mode does the new file have on the Linux filesystem?

  1. 0640
  2. 0777
  3. 0600
  4. 0660 Correct answer.

Explanation

Samba first applies create mask by ANDing it with the requested mode: 0777 & 0640 = 0640. It then ORs in force create mode: 0640 | 0660 = 0660, so the new file is group-writable but not world-accessible.

Question 26Samba Basics

An administrator needs an /etc/fstab entry that mounts //fileserver/share at /mnt/share with SMB3, using credentials from /etc/samba/creds. Which entry is correct?

  1. fileserver:/share /mnt/share nfs credentials=/etc/samba/creds,vers=3.0 0 0
  2. \\fileserver\share /mnt/share cifs credentials=/etc/samba/creds 0 0
  3. //fileserver/share /mnt/share smbfs credentials=/etc/samba/creds,vers=3.0 0 0
  4. //fileserver/share /mnt/share cifs credentials=/etc/samba/creds,vers=3.0 0 0 Correct answer.

Explanation

The cifs filesystem type and //server/share UNC form are correct for mount.cifs, and credentials= points to a file containing username and password. vers=3.0 selects SMB3; smbfs is obsolete, backslash UNC paths are not used in fstab, and nfs is a different protocol.

Question 27Samba Basics

A Samba member server uses winbind with winbind use default domain = yes for domain EXAMPLE. How does winbind present domain users in NSS lookups such as getent passwd?

  1. As alice Correct answer.
  2. As [email protected]
  3. As EXAMPLE\alice
  4. As EXAMPLE+alice

Explanation

With winbind use default domain = yes, winbind strips the default domain prefix from user and group names returned through NSS, so getent passwd shows alice rather than EXAMPLE\alice. The winbind separator controls the qualified form only when the default-domain behavior is not in effect.

Question 28Samba Basics

An administrator suspects the machine account secret of a Samba AD member server has become stale. Which command tests whether the existing domain join is still valid without changing it?

  1. net ads join -U administrator
  2. net ads leave
  3. net ads dns register
  4. net ads testjoin Correct answer.

Explanation

net ads testjoin checks that the local machine account and its secret are still valid for the joined AD domain, without performing a new join. net ads join creates or resets the join, net ads leave removes it, and net ads dns register updates DNS records.

Question 29Samba Basics

The [global] section contains include = /etc/samba/smb.conf.%U. What happens when a user connects?

  1. Samba rejects the line because include does not expand variables.
  2. Samba loads the file only at startup, expanding %U to root.
  3. Samba treats %U as the share name and includes a share file.
  4. Samba includes /etc/samba/smb.conf.<username> after expanding %U. Correct answer.

Explanation

The include directive supports variable expansion, and %U expands to the current authenticated username, so Samba reads a per-user file such as smb.conf.alice when servicing that connection. The substitution is not fixed to root, and %U is not the share name.

Question 30Samba Basics

A share defines admin users = alice. Alice connects and modifies a file owned by another user. How does smbd perform the filesystem operation?

  1. As the guest account, because admin users maps to guest.
  2. As the share owner defined by force user.
  3. As alice's own UID, with an ACL granting root rights.
  4. As UID 0, so the operation bypasses normal Unix permission checks. Correct answer.

Explanation

admin users = alice causes smbd to perform all filesystem operations for Alice on that share with effective UID 0. This bypasses normal Unix ownership and permission checks inside the share, so the parameter should be granted sparingly.

Question 31Samba Basics

An administrator has edited /etc/samba/smb.conf and wants to check for syntax errors and see the effective configuration before reloading Samba. Which command performs this check?

  1. smbclient -T
  2. pdbedit -S
  3. net conf check
  4. testparm Correct answer.

Explanation

testparm parses smb.conf, reports unknown parameters or malformed lines, and prints the resulting service definitions. Running it before a reload helps catch configuration errors that would otherwise affect smbd. It does not apply changes by itself.

Question 32Samba Basics

A site security baseline forbids SMB1 dialects on a Samba server. Which smb.conf parameter in the [global] section sets the oldest SMB dialect that smbd will accept from clients?

  1. server signing
  2. server max protocol
  3. client min protocol
  4. server min protocol Correct answer.

Explanation

In Samba, server min protocol controls the oldest SMB dialect that smbd will negotiate for incoming client connections. Setting it above SMB1 prevents legacy dialect fallback. client min protocol affects outgoing connections made by Samba client tools, not the server side.

Question 33Samba Basics

A Linux administrator needs to enumerate the shares exported by the SMB server FS01 without mounting any share, authenticating as user alice. Which command does this?

  1. net share list -U alice //FS01
  2. smbclient //FS01 -U alice -c 'ls'
  3. smbclient -L //FS01 -U alice Correct answer.
  4. smbstatus -L -U alice

Explanation

The -L option asks smbclient to list the shares and other services exported by the server, and -U selects the user. No share name is supplied because the connection is to the server's service list, not to a file share. It prompts for alice's password unless other credentials are supplied.

Question 34Samba Basics

A Samba server stores its account database in tdbsam. Which command lists the Samba user accounts in that backend without showing per-account details?

  1. smbpasswd -l
  2. pdbedit -L Correct answer.
  3. pdbedit -x -L
  4. smbclient -M alice

Explanation

pdbedit -L reads the configured passdb backend, here tdbsam, and prints one line per Samba account. Adding -v would show full per-account policy and SID details. It is the passdb administration tool and does not require smbd to be restarted.

Question 35Samba Basics

A Samba file server in a workgroup must map the Windows group name Accounting to the existing Linux group accounting. Which command creates that mapping?

  1. net groupmap add unixgroup=Accounting ntgroup=accounting
  2. net groupmap add ntgroup=Accounting unixgroup=accounting Correct answer.
  3. net rpc group add Accounting accounting
  4. pdbedit -g accounting -n Accounting

Explanation

net groupmap add creates a mapping between a Windows/NT group name and an existing Unix group. ntgroup names the SMB-side group and unixgroup names the local group that supplies the GID. The mapping can then be used by share ACLs and group-based access controls.

Question 36Samba Basics

A share uses the default map archive = yes setting. A Windows client writes a file and sets the DOS archive attribute. Which Unix permission bit does smbd use to represent that attribute?

  1. Sticky bit
  2. Group execute bit
  3. Setgid bit
  4. Owner execute bit Correct answer.

Explanation

With map archive enabled, Samba represents the DOS archive attribute using the Unix owner execute permission bit. This preserves the attribute across SMB clients without a separate extended attribute. It does not use group execute, sticky, or setgid bits for that purpose.

Question 37Samba Basics

An administrator wants to tell only the smbd daemons to reload their configuration, without signaling nmbd or winbindd. Which command does this?

  1. smbcontrol smbd reload-config Correct answer.
  2. smbcontrol all reload-config
  3. smbcontrol nmbd reload-config
  4. smbcontrol winbindd reload-config

Explanation

smbcontrol takes a destination and a message type; the destination smbd targets the smbd daemons, and reload-config makes them reread smb.conf. Existing sessions remain active, although some parameter changes may not affect already-open connections. Using all would also signal other daemons such as nmbd and winbindd.

Question 38Samba and Active Directory Domains

Which command initializes a brand-new Samba Active Directory domain, including its initial sam.ldb database, on a freshly installed server?

  1. samba-tool domain join EXAMPLE.COM DC
  2. net ads join -U Administrator
  3. samba-tool domain provision Correct answer.
  4. samba-tool domain classicupgrade

Explanation

samba-tool domain provision creates the initial AD forest, local sam.ldb, DNS zone data, and a krb5.conf suitable for the new realm. It is run once on the first DC, not on servers that will join an existing domain. After provisioning, the Samba daemon can be started and DNS and Kerberos clients can be pointed at the new DC.

Question 39Samba and Active Directory Domains

A Samba file server must authenticate users against an existing Active Directory domain with Kerberos while remaining a member server, not a domain controller. Which smb.conf setting selects that authentication model?

  1. security = share
  2. security = user
  3. security = ads Correct answer.
  4. security = domain

Explanation

The ads security mode makes Samba use Active Directory, Kerberos, and LDAP for authentication on a domain member. The domain mode is for NT4-style domains, while user mode authenticates against local Samba accounts. share mode was removed from modern Samba releases.

Question 40Samba and Active Directory Domains

Which daemon must be running for wbinfo -u to list users from a joined Active Directory domain on a Samba member server?

  1. smbd
  2. samba
  3. winbindd Correct answer.
  4. nmbd

Explanation

winbindd implements the winbind NSS and PAM interfaces that wbinfo queries, so it must be running and nsswitch.conf must reference winbind. smbd serves SMB file and print shares but does not provide the wbinfo user enumeration. nmbd handles NetBIOS name service, and samba is only a wrapper script.

Question 41Samba and Active Directory Domains

Before running net ads join -U Administrator on a Linux member server, which condition is required for Kerberos authentication to succeed?

  1. The server has been promoted to a Samba AD DC.
  2. The server uses security = domain in smb.conf.
  3. A local Administrator account exists on the server.
  4. Clock skew from the DC is under five minutes. Correct answer.

Explanation

Kerberos rejects tickets when the client and KDC clocks differ by more than the configured tolerance, typically five minutes, so time synchronization is a practical prerequisite for net ads join. The join also needs working DNS SRV records and a reachable KDC, but those are not the condition listed here. A local Administrator account and DC promotion are unrelated to member-server joining.

Question 42Samba and Active Directory Domains

Which idmap backend calculates a Unix UID for an AD user arithmetically from the user's Windows RID and a configured range, without maintaining a per-user mapping database?

  1. idmap_autorid
  2. idmap_tdb
  3. idmap_ad
  4. idmap_rid Correct answer.

Explanation

idmap_rid derives the Unix ID by adding the RID to the lower bound of the configured range, so no per-user database is needed. idmap_ad reads POSIX attributes such as uidNumber from AD, and idmap_autorid allocates ranges per domain. idmap_tdb stores explicit mappings in a local TDB file.

Question 43Samba and Active Directory Domains

With winbind use default domain = yes, how may an AD user named alice in domain EXAMPLE be referenced in an smb.conf share ACL?

  1. EXAMPLE/alice only
  2. alice@EXAMPLE only
  3. EXAMPLE\alice only
  4. alice alone Correct answer.

Explanation

The parameter lets winbind treat the joined domain as the default, so user names can be written without the DOMAIN\ prefix in Samba configuration. Explicitly qualified forms remain available but are not required. The unqualified name is the practical effect of the setting.

Question 44Samba and Active Directory Domains

Which command lists all Group Policy objects stored in a Samba Active Directory domain?

  1. samba-tool gpo listall Correct answer.
  2. samba-tool gpo aclcheck
  3. samba-tool gpo setlink
  4. samba-tool gpo backup

Explanation

samba-tool gpo listall enumerates the GPOs present in the domain so an administrator can inspect names and GUIDs. The aclcheck subcommand verifies Sysvol ACL consistency, setlink manages links to containers, and backup exports a GPO. Listing is a separate read-only operation.

Question 45Samba and Active Directory Domains

After restoring Sysvol content on a Samba AD DC, which command recalculates the NT ACLs on Sysvol from the domain's object records?

  1. samba-tool ntacl set
  2. samba-tool ntacl sysvolcheck
  3. samba-tool ntacl sysvolreset Correct answer.
  4. samba-tool dbcheck

Explanation

samba-tool ntacl sysvolreset resets the Sysvol ACLs to match the permissions defined in the AD object records, which is the usual repair step after a restore. sysvolcheck only verifies the ACLs, and ntacl set applies a manually specified ACL. dbcheck validates directory database integrity and does not repair Sysvol ACLs.

Question 46Samba and Active Directory Domains

A Samba member server must obtain UIDs and GIDs for AD users from the uidNumber and gidNumber attributes stored in AD. Which idmap configuration accomplishes this?

  1. idmap config * : backend = tdb with range = 3000-7999
  2. idmap config EXAMPLE : backend = rid with range = 10000-99999
  3. idmap config EXAMPLE : backend = autorid with range = 10000-99999
  4. idmap config EXAMPLE : backend = ad with schema_mode = rfc2307 Correct answer.

Explanation

The ad backend with schema_mode = rfc2307 reads the POSIX uidNumber and gidNumber attributes from AD user and group objects. The rid backend calculates IDs from RIDs, and autorid allocates ranges automatically; neither reads those attributes. The default tdb backend stores local mappings instead of consulting AD POSIX attributes.

Question 47Samba and Active Directory Domains

An organization has an existing Samba NT4-style domain and wants to migrate it to a Samba AD DC while preserving user and group accounts. Which tool is designed for this migration?

  1. samba-tool domain classicupgrade Correct answer.
  2. samba-tool domain backup restore
  3. samba-tool domain provision
  4. samba-tool domain join

Explanation

samba-tool domain classicupgrade reads the existing NT4-style Samba configuration, passdb, and group mappings and creates an AD domain from them. Provision creates a new empty AD domain, while join adds a DC to an existing AD domain. Backup restore restores a previously taken Samba backup and is not an NT4 migration path.

Question 48Samba and Active Directory Domains

On a newly provisioned Samba Active Directory domain controller, which DNS backend keeps zone data in the AD directory and requires no separate BIND process?

  1. BIND9_FLATFILE
  2. BIND9_DLZ
  3. SAMBA_INTERNAL Correct answer.
  4. NONE

Explanation

The SAMBA_INTERNAL backend runs DNS inside the samba process and stores zones in AD-integrated partitions, so no external BIND service is needed. BIND9_DLZ still depends on an external BIND server, while BIND9_FLATFILE is a legacy flat-file option and NONE disables DNS provisioning.

Question 49Samba and Active Directory Domains

Which command creates a new Active Directory user account directly in a Samba AD domain from the command line?

  1. useradd alice
  2. smbpasswd -a alice
  3. samba-tool user create alice Correct answer.
  4. pdbedit -a alice

Explanation

samba-tool user create writes the account into the Samba AD directory and sets the AD password attributes. useradd only creates a local Unix account, while pdbedit and smbpasswd manage the local Samba passdb rather than AD objects.

Question 50Samba and Active Directory Domains

Which smb.conf parameter controls the character inserted between the domain name and user name in winbind-generated names, whose default is a backslash?

  1. winbind nested groups
  2. winbind separator Correct answer.
  3. winbind use default domain
  4. winbind enum users

Explanation

winbind separator defines the character used between the domain and account name in names that winbind presents to Unix, and its default is a backslash. The other parameters control default-domain name shortening, user enumeration, and nested group handling respectively.