Free 300-300 sample questions

Correct answer: Establishing a cross-realm Kerberos trust between the FreeIPA and AD domains.

This scenario requires identities from one Kerberos realm (FreeIPA) to be authenticated by a service in another realm (the Samba server in AD). This is the primary use case for a cross-realm trust. By establishing a trust, the AD domain controllers can validate Kerberos tickets issued by the FreeIPA KDC, allowing staff members to access resources in the student domain. SSSD is involved on the client side, but the fundamental enabling technology is the trust relationship. A FreeIPA replica cannot be placed in an AD domain.

Correct answers: mount -t cifs //server/share /mnt -o sec=krb5; mount -t cifs //server/share /mnt -o multi-user,sec=krb5i

`sec=krb5` explicitly tells `mount.cifs` to use Kerberos v5 authentication. It will use the ticket from the user's ccache.

`sec=krb5i` specifies Kerberos v5 authentication with packet integrity signing, which is a more secure variant. The `multi-user` option is also commonly used in this context but not strictly required for Kerberos itself.

Correct answer: The SSSD `nfs` id-mapping provider.

In a modern FreeIPA environment, the traditional `rpc.idmapd` daemon is often replaced by SSSD's capabilities. SSSD can handle the translation between NFSv4's `user@domain` string principals and the local system's numeric UID/GIDs. This provides a centralized and consistent mapping source, which is crucial in an identity-managed environment like FreeIPA. The other options are either legacy methods or not directly related to NFSv4 ID mapping.

Correct answer: veto files = /*.tmp/lost+found/

The `veto files` parameter instructs Samba to hide files and directories that match the specified patterns, making them invisible and inaccessible to SMB clients, regardless of filesystem permissions. If a pattern in this list inadvertently matches legitimate files, they will disappear from the users' view. `hide unreadable` hides files the user cannot read, but the scenario states they have read permissions. `dont descend` applies to directories, and `case sensitive = yes` affects name matching, not visibility.

Correct answer: True

True. The `ad_access_filter` parameter allows an administrator to specify a custom LDAP filter that is evaluated against the user object in Active Directory during the access control phase. A common use case is to restrict logins to members of a specific AD group, for example: `ad_access_filter = (memberOf=cn=LinuxUsers,ou=Groups,dc=example,dc=com)`. This is a powerful method for controlling access to Linux systems from Active Directory.

Correct answer: Enable the NIS server role during FreeIPA server installation or with `ipa-server-install --setup-nis`.

FreeIPA includes a compatibility tree and services to respond to NIS client requests. This functionality must be explicitly enabled. This can be done during the initial server installation by answering 'yes' to configuring the NIS domain and server, or by passing the `--setup-nis` flag to `ipa-server-install`. This configures the schema and starts the necessary services (`ypserv`) to serve NIS maps from the FreeIPA LDAP backend.

Correct answer: -d 10

Most Samba command-line tools, including `samba-tool`, use the `-d ` or `--debuglevel= ` option to control the verbosity of logging output. A debug level of 10 provides the maximum amount of detail, which is essential for diagnosing complex issues during processes like domain provisioning. `--verbose` is a common flag in many Linux utilities but is not the primary mechanism for detailed debugging in Samba. `--log-stdout` redirects logs but does not set the level, and `--show-progress` only affects progress indicators.

Correct answer: Deploy a new FreeIPA domain. Establish a two-way trust between FreeIPA and the existing AD domain. Migrate OpenLDAP users to FreeIPA. Configure Linux clients and the Samba server to use SSSD to authenticate against the FreeIPA domain.

This solution meets all requirements. Deploying FreeIPA and establishing a trust with AD allows for consolidated identity management while respecting the constraint that AD remains primary. Linux clients authenticating against FreeIPA (via SSSD) can leverage its centralized management for sudo and automount maps. Because of the trust, AD users can authenticate to IPA-enrolled clients and services. The Samba server, joined to the IPA realm, can authenticate both IPA and trusted AD users and can be configured to support Windows ACLs (`vfs_acl_xattr`). This eliminates the need for OpenLDAP and the local smbpasswd file.

Correct answers: The underlying filesystem must be mounted with the `user_xattr` and `acl` options.; The `smb.conf` share definition must include `vfs objects = acl_xattr`.

Samba stores Windows ACLs in extended attributes (xattrs) on the Linux filesystem. The filesystem must be mounted with support for user extended attributes (`user_xattr`) and POSIX ACLs (`acl`) to store and process this information correctly.

The `acl_xattr` VFS module is responsible for the translation layer between Windows Security Descriptors (ACLs) and the POSIX ACLs and extended attributes stored on the filesystem. This module must be enabled for the share.

Correct answer: The `nss` service was not added to the `services` line in the `[sssd]` section of `sssd.conf`.

SSSD provides several services, including authentication (`pam`) and identity lookups (`nss`). If the `nss` service is not enabled in the main `[sssd]` section, the system's Name Service Switch cannot use SSSD to look up user information, including supplementary group memberships. Authentication may still succeed via PAM, but commands like `id` and `getent group` will not be able to retrieve the full group list from SSSD. The other options relate to schema mapping or token groups, which are less likely to be the primary cause for a complete lack of secondary groups.