Free 300-300 sample questions

Correct answer: vfs objects = recycle recycle:repository = /home/%U/recycle_bin/%d

The `vfs objects = recycle` parameter enables the recycle bin functionality. To meet the requirement of storing deleted files in a user-specific home directory location with a date stamp, the `recycle:repository` path must be constructed using Samba variables. `/home/%U/recycle_bin/%d` correctly uses `%U` for the username and `%d` for the current date, placing the recycled files on the separate storage tier where home directories reside. The other options either use a centralized repository, a relative path within the share, or incorrectly use the `shadow_copy2` module which is for versioning, not a recycle bin.

Correct answer: use_fully_qualified_names = false

The `use_fully_qualified_names` parameter controls whether SSSD returns qualified or non-qualified user names. Setting it to `false` allows users to log in with their short names. The domain part is still implicitly managed by SSSD's domain configuration, ensuring that lookups are directed to the correct FreeIPA domain. `re_expression` is for filtering, `default_domain_suffix` appends a domain, and `full_name_format` controls how the GECOS field is constructed, not the login name format.

Correct answer: Establishing a cross-realm Kerberos trust between the FreeIPA and AD domains.

This scenario requires identities from one Kerberos realm (FreeIPA) to be authenticated by a service in another realm (the Samba server in AD). This is the primary use case for a cross-realm trust. By establishing a trust, the AD domain controllers can validate Kerberos tickets issued by the FreeIPA KDC, allowing staff members to access resources in the student domain. SSSD is involved on the client side, but the fundamental enabling technology is the trust relationship. A FreeIPA replica cannot be placed in an AD domain.

Correct answers: mount -t cifs //server/share /mnt -o sec=krb5; mount -t cifs //server/share /mnt -o multi-user,sec=krb5i

`sec=krb5` explicitly tells `mount.cifs` to use Kerberos v5 authentication. It will use the ticket from the user's ccache.

`sec=krb5i` specifies Kerberos v5 authentication with packet integrity signing, which is a more secure variant. The `multi-user` option is also commonly used in this context but not strictly required for Kerberos itself.

Correct answer: The SSSD `nfs` id-mapping provider.

In a modern FreeIPA environment, the traditional `rpc.idmapd` daemon is often replaced by SSSD's capabilities. SSSD can handle the translation between NFSv4's `user@domain` string principals and the local system's numeric UID/GIDs. This provides a centralized and consistent mapping source, which is crucial in an identity-managed environment like FreeIPA. The other options are either legacy methods or not directly related to NFSv4 ID mapping.

Correct answer: veto files = /*.tmp/lost+found/

The `veto files` parameter instructs Samba to hide files and directories that match the specified patterns, making them invisible and inaccessible to SMB clients, regardless of filesystem permissions. If a pattern in this list inadvertently matches legitimate files, they will disappear from the users' view. `hide unreadable` hides files the user cannot read, but the scenario states they have read permissions. `dont descend` applies to directories, and `case sensitive = yes` affects name matching, not visibility.

Correct answer: True

True. The `ad_access_filter` parameter allows an administrator to specify a custom LDAP filter that is evaluated against the user object in Active Directory during the access control phase. A common use case is to restrict logins to members of a specific AD group, for example: `ad_access_filter = (memberOf=cn=LinuxUsers,ou=Groups,dc=example,dc=com)`. This is a powerful method for controlling access to Linux systems from Active Directory.

Correct answer: Enable the NIS server role during FreeIPA server installation or with `ipa-server-install --setup-nis`.

FreeIPA includes a compatibility tree and services to respond to NIS client requests. This functionality must be explicitly enabled. This can be done during the initial server installation by answering 'yes' to configuring the NIS domain and server, or by passing the `--setup-nis` flag to `ipa-server-install`. This configures the schema and starts the necessary services (`ypserv`) to serve NIS maps from the FreeIPA LDAP backend.

Correct answer: -d 10

Most Samba command-line tools, including `samba-tool`, use the `-d ` or `--debuglevel= ` option to control the verbosity of logging output. A debug level of 10 provides the maximum amount of detail, which is essential for diagnosing complex issues during processes like domain provisioning. `--verbose` is a common flag in many Linux utilities but is not the primary mechanism for detailed debugging in Samba. `--log-stdout` redirects logs but does not set the level, and `--show-progress` only affects progress indicators.

Correct answer: Deploy a new FreeIPA domain. Establish a two-way trust between FreeIPA and the existing AD domain. Migrate OpenLDAP users to FreeIPA. Configure Linux clients and the Samba server to use SSSD to authenticate against the FreeIPA domain.

This solution meets all requirements. Deploying FreeIPA and establishing a trust with AD allows for consolidated identity management while respecting the constraint that AD remains primary. Linux clients authenticating against FreeIPA (via SSSD) can leverage its centralized management for sudo and automount maps. Because of the trust, AD users can authenticate to IPA-enrolled clients and services. The Samba server, joined to the IPA realm, can authenticate both IPA and trusted AD users and can be configured to support Windows ACLs (`vfs_acl_xattr`). This eliminates the need for OpenLDAP and the local smbpasswd file.