117-202 · Question #216
The Samba configuration file contains the following lines: hosts allow = 192.168.1.100 192.168.2.0/255.255.255.0 localhost hosts deny = 192.168.2.31 interfaces = 192.168.1.0/255.255.255.0…
The correct answer is E. hosts allow = 192.168.1.0/255.255.255.0 192.168.2.0/255.255.255.0 localhost. See the full explanation below for the reasoning.
Question
Options
- Ahosts allow = 192.168.1.1-255
- Bhosts allow = 192.168.1.100 192.168.2.200 localhost
- Chosts deny = 192.168.1.100/255.255.255.0 192.168.2.31 localhost
- Dhosts deny = 192.168.2.200/255.255.255.0 192.168.2.31 localhost
- Ehosts allow = 192.168.1.0/255.255.255.0 192.168.2.0/255.255.255.0 localhost
How the community answered
(39 responses)- A3% (1)
- B10% (4)
- D5% (2)
- E82% (32)
Community Discussion
8
Ola B.Dec 27, 2025The answer is E, and once you spin up a test Samba server and watch this yourself it clicks immediately. The original hosts allow line only whitelists the single IP 192.168.1.100 from the wired network, so every other machine on 192.168.1.x hits an implicit deny and gets blocked. The wireless side works fine because the whole 192.168.2.0/255.255.255.0 subnet was already listed, which is exactly what the wired side was missing. Option E fixes that by replacing the lone IP with the full wired subnet 192.168.1.0/255.255.255.0 while keeping the wireless subnet and localhost in place, and the existing hosts deny line still blocks 192.168.2.31 so no previously denied host gets snuck back in.
Mateus R.Dec 29, 2025Solid breakdown, and the subnet mask piece is worth stressing one more time: that 255.255.255.0 mask is basically telling Samba "match any address where the first three octets are identical," so swapping the lone host entry for 192.168.1.0/255.255.255.0 is the difference between handing a bouncer one name versus the whole guest list.
Marit C.Nov 4, 2025A uses invalid range syntax, subnet notation fixes it, E.
Carlos M.Nov 7, 2025Yep, and worth flagging for the exam that wildcard mask syntax trips people up the same way, so if they swap in an ACL question you want to double-check the format before you even look at the options.
Carlos M.Dec 2, 2025The current hosts allow only explicitly whitelists 192.168.1.100 (one machine), so the whole rest of the 192.168.1.x subnet is being blocked, which explains why almost every wired workstation gets denied while the wireless laptop on 192.168.2.x gets through fine since that whole subnet is already allowed. Does anyone know if Samba evaluates hosts allow and hosts deny in a specific order when both directives are present, and would flipping to a subnet entry like option E override the deny for 192.168.2.31 or would that deny still hold?
Dervla O.Nov 20, 2025E is right. The current allow list misses the whole 192.168.1.0 subnet, which is why the wired machines are blocked.
Mateus R.Dec 14, 2025A is the only one that opens the whole wired subnet, like handing a key to the whole neighborhood instead of one house.
Carlos M.Dec 16, 2025Mateus, the answer is E, not A, because a /16 summary route covers the entire 172.16.0.0 range and would still let traffic through to all those subnets, so the more specific /24 blocks are what actually get blocked when you null-route or filter them individually.