HCL-BF-PRO-10 Sample Questions Answers

• The download cache size on a relay or a server can be changed by using the Fixlet ID# 148 BES Relay/Server Setting: Download Cache Size, available from the BES Support Site.
• This Fixlet allows the administrator to specify the desired cache size in MB as a parameter of the action.
• To increase the cache size to 10 GB, the administrator needs to enter 10240 as the value of the parameter, since 1 GB = 1024 MB.
• The Fixlet will then create or modify the client setting _BESGather_Download_CacheLimitMB on the target relay or server, and set its value to the specified parameter.
• The Fixlet will also restart the BES Client service on the target relay or server to apply the new setting.
• The new cache size will take effect after the service restarts, and the relay or server will be able to store more downloaded files in its cache. References:
• Managing Downloads
• BES Client download cache limit?
• The download size exceeds the maximum value set in the client setting

• To create an Automatic Computer Group, you need to use a Relevance expression that evaluates to true or false for each computer in your deployment12.
• The Relevance expression should check two conditions: the operating system is Windows 10 and a user is signed in.
• To check the operating system, you can use the name of operating system property, which returns a string like “Win10” or “Win7” for Windows computers3. You can use the contains operator to see if the string contains “Win10”.
• To check the user status, you can use the logged on user property, which returns the name of the current user or an empty string if no user is logged on4. You can use the exists or not operators to see if the property has a value or not.
• You can use the and operator to combine the two conditions into one Relevance expression.
• The correct answer is D, which checks if the name of operating system contains “Win10” and if the logged on user exists.
• The other options are incorrect because:
• 1: Create Automatic Computer Group
• 2: Create Automatic Computer Group
• 3: Operating System Inspector
• 4: Logged On User Inspector
• 5: [Version Inspector]

To create a new retrieved property in BigFix, the following steps are required:

• From the BigFix Console, select Manage Properties from the Tools menu. The Manage Properties dialog is displayed.
• You can filter the properties by using the left filter panel to select a subset of the properties to view on the right. If you cannot find what you want in this list, create a new property: click Add New, then enter a name for the property and a valid Relevance expression. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.
• After you define the new property, the Clients automatically compute the value of the corresponding relevance expression and return it to the Database. Click the OK button.
• The new property will be available in the column headers of computer listings, allowing you to sort and filter on its values. It can also be used to target Fixlet actions and generate Web Reports.

References:

• Creating Retrieved Properties
• Adding new properties under “By retrieved properties”

To perform a BigFix installation with a new serial number, you need to have a license authorization file from the BigFix License Key Center site. This file contains the information about your license purchase and the serial number. You need to enter thisfile during the installation process to request and get the license certificate file (license.crt) and the private key file (license.pvk). These two files together complete your license. You also generate the masthead file (masthead.afxm) during the installation, which contains the information about your BigFix deployment. References:

• Managing licenses
• Installation Instructions
• Admin site key for installation

• Launch the BigFix Administration Tool from the Start menu or from the installation folder.
• Enter the current password for the Site Administrator private key and click OK.
• Click the Advanced Options tab and select Change Site Administrator Private Key Password.
• Enter the new password, confirm it, and click OK.
• Restart the BigFix Server service for the changes to take effect. References:
• Re-creating Site Credentials
• Change Private Key Password
• Need help in to recover or set a new password for the Bigfix Admin

• The BigFix Console is a graphical user interface that allows you to interact with the BigFix Platform and perform various tasks, such as deploying actions, creating content, managing sites, and viewing reports1.
• The BigFix Console operators are the users who can access the BigFix Console and perform different activities based on their permissions and roles2.
• There are two types of Console operators: Master Operators (MO) and Non-Master Operators (NMO)2.
• Master Operators are the administrative users of the BigFix Console. They have access to all the computers defined in the BigFix environment and the authority to create and manage other Console operators2.
• Non-Master Operators are the users who manage the day-to-day BigFix operations, including Fixlet management and action deployment, against a subset of computers they are allowed to manage by the Master Operator2.
• Some of the activities that can only be performed by a Master Operator are23:
• Some of the activities that can be performed by both Master Operators and Non-Master Operators are23:

References:

• The BigFix Console
• The Console Operators
• Accessing the console

• Message Level Encryption (MLE) allows your Clients to encrypt upstream data using a combination of an RSA public/private key-pair and an AES session key1.
• When MLE is enabled, the BigFix Root server (or a decrypting Relay) needs to use the corresponding RSA private key to decrypt the AES session key, which is then used to decrypt the Client report1.
• This decryption process consumes CPU resources on the BigFix Root server, and the amount of CPU usage depends on the number of encrypted reports received and the key length used1.
• Therefore, the BigFix Root server requires additional CPU resources appropriate to the number of managed endpoints to process the encrypted reports1.
• The other options are incorrect because:
• 1: Message Level Encryption (MLE) Overview
• 2: [Enabling encryption on Relays]

• The WebUI is a web-based interface that provides access to the flexibility and power of BigFix.
• The WebUI has some upper use limits that depend on many factors, such as the number of endpoints, the workload, the time of day, the server location, and the number of concurrent users.
• Concurrent users are defined as highly active users who perform multiple actions per minute on the WebUI.
• According to the BigFix Capacity Planning Guide, both the Windows and Linux WebUI instances support 36 concurrent users on a 250k deployment base. This is the recommended scalability limit for the WebUI server on BigFix v10.x.
• The WebUI also requires additional hardware resources, such as CPU, memory, and storage, to power the WebUI. These resources are in addition to the BigFix root server requirements and depend on the number of concurrent users.
• The WebUI also implements a database cache for several counters to improve the WebUI response times. The cache has a default refresh interval of 10 minutes. References:
• Hardware Requirements
• WebUI Administrators Guide
• BigFix WebUI

• Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.
• Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.
• Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.
• To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.
• Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.
• Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.
• Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potentialsynchronization issues, so it should be done with caution and proper planning. References:
• Introducing Baselines
• Creating or Customizing Baselines
• Baselines

• The BigFix Diagnostics Tool is a program that checks the status and configuration of the server components, such as the database, the gather service, and the web reports server.
• The tool can be run at any time, either after installing the server or later, to troubleshoot any issues or monitor the server performance.
• To run the tool, you need to log on to the server as an administrator and launch the program from the Start menu.
• The tool will analyze the server components and display the results in a graphical interface, with green, yellow, or red lights indicating the health of each component.
• You can also click on the Full Interface button to see more details and access the knowledge base articles for each component.
• The tool can also be run remotely by taking action on the Troubleshoot: Execute Server Diagnostic task located in the BES Support site, but this requires the client to be installed on the server. References:
• Running the BigFix Diagnostics tool
• Running the IBM BigFix Diagnostics tool
• Waiting for downloads to be mirrored - BigFix Forum
• BigFix Wiki - BES Client Diagnostics

• A Multiple Action Group is a way to deploy a set of Fixlets or tasks in a single grouping using the Take multiple actions command1.
• As a requirement, each Fixlet or task involved in the group must have associated a default action1.
• A default action is an action script that is predefined by the Fixlet or task author and can be executed without any user input2.
• If one or more of the Fixlets that are selected do not have a default action, the Take multiple actions command will fail and display an error in the Console1.
• To resolve this issue, the operator can either select only Fixlets or tasks that have default actions, or create a Baseline that includes the Fixlets or tasks without default actions1. References:
• 1: Taking multiple actions
• 2: Action Script
• 3: Take multiple actions
• 4: Action Script Guide

According to the BigFix Platform documentation, the Site Administrator is responsible for installing and maintaining the BigFix software, and to run administrative tasks that globally affect the environment such as site-level signing keys management. There is only one Site Administrator for a BigFix environment1.

Some of the global system options that the Site Administrator can set and modify are:

• The default masthead file and license certificate
• The default site subscription policy
• The default client settings
• The default relay settings
• The default server settings
• The default Web Reports settings
• The default WebUI settings
• The default LDAP settings
• The default SAML settings
• The default audit log settings
• The default DSA settings
• The default proxy settings
• The default encryption settings
• The default caching settings
• The default logging settings
• The default performance settings
• The default security settings
• The default diagnostic settings

To set and modify these global system options, the Site Administrator must use the BigFix Administration Tool, which is a separate application from the BigFix Console. The Site Administrator must also have the Action Site Credentials, which are a special key generated during the installation process.

The other options (A, B, and D) are not exclusive to the Site Administrator, and can be performed by other Console Operators, depending on their permissions and roles.

References:

• BigFix Site Administrator and Console Operators
• Site administrator responsibilities
• Global system options
• [BigFix Administration Tool]

• BigFix Clients are the endpoints that run the BigFix Agent software and communicate with the BigFix Server or Relays.
• BigFix Clients periodically check for new content from the BigFix Server or Relays, such as Fixlets, Tasks, Actions, or Analyses.
• The default interval for checking new content is 15 minutes, but this can be configured by the BigFix Administrator.
• To reduce the network traffic and latency, BigFix also uses a notification mechanism to inform the BigFix Clients of new content as soon as possible.
• The notification mechanism uses the UDP protocol, which is a connectionless and lightweight protocol that does not require a handshake or acknowledgment.
• The BigFix Server or Relays send UDP packets to the BigFix Clients on port 52311, which is the default port for BigFix communication.
• The UDP packets do not contain any content, but only serve to notify the BigFix Clients that there is something new for them to gather.
• Upon receiving a UDP notification, the BigFix Client initiates a TCP connection to the BigFix Server or Relay to gather the new content over a secure and reliable channel.
• The UDP notification mechanism can be enabled or disabled by the BigFix Administrator, and it can also be configured to use different ports or multicast addresses. References:
• BigFix Architecture
• BigFix Client Settings
• BigFix Notification Guide

According to the BigFix Platform documentation1, the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration. To configure a high scale Relay, you need to follow these steps2:

• Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.
• Set the _BESRelay_HTTPServer_MaxConnections setting to 2000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinute setting to 0 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinutePerClient setting to 0 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitPercent setting to 0 on the Relay.
• Set the _BESRelay_Download_CacheLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_CacheLimitPercent setting to 0 on the Relay.
• Restart the Relay service after applying the settings. References:
• Relay scalability
• Configuring a high scale Relay

• If UDP is not allowed on a network segment, the BigFix clients on that segment will not receive the UDP notifications from the server or relay, and will rely on the default 45-minute polling interval to check for new actions.1
• To reduce the delay in receiving new actions, you can enable the client polling feature, which allows the clients to poll the server or relay more frequently for new commands.2
• To enable the client polling feature, you need to set two client settings on the target clients:2
• You can set these client settings either through the console or manually on the endpoint.4
• After setting these client settings, the clients will poll the server or relay at the specified interval and receive new actions faster.

References:

• 1: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Installation/c_sample_proxy_configurations.html
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#_BESClient_Comm_CommandPollEnable
• 3: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056
• 4: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#Making_a_configuration_setting