HCL-BF-PRO-10 HCLSoftware U Certified Professional-BigFix Platform 1 Questions and Answers

A Top Level Relay is a relay that directly communicates with the BigFix Server and has other relays as its children. A Top Level Relay has no limit as to the number of relays they can manage, but it is recommended to have no more than 1000 relays per Top Level Relay for optimal performance. When designing a relay hierarchy, the BigFix Administrator should consider the following factors:

• The network bandwidth and latency between the relays and the server
• The number and size of the fixlets, actions, and reports that are exchanged between the relays and the server
• The CPU and memory resources of the relays and the server
• The relay affiliation and selection settings of the clients and the relays
• The encryption and decryption of the client reports by the relays and the server

References:

• Creating top-level decrypting relays
• Top-Level Relays - Platform - BigFix Forum
• Relay Health - BigFix
• Creating top-level decrypting relays - IBM

• The BES Client Usage Profiler is a tool that collects information about the client evaluation cycle, such as the average, maximum, and minimum duration, and the percentage of time spent on different tasks, such as action, api, archive, gather, etc.1
• To enable the BES Client Usage Profiler, you need to run the task 361 TROUBLESHOOTING: Enable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 1 and restart the client service.2
• After the task is completed, you can use the analysis 362 TROUBLESHOOTING: BES Client Usage Profiler to view the results of the profiler. This analysis will show you the evaluation cycle statistics and the breakdown of the time spent on each task.3
• You can use this information to identify any potential issues or bottlenecks in the client evaluation cycle, such as long action duration, high api percent, or excessive gather time. You can also compare the results with other clients or the average values to see if there are any anomalies or outliers.4
• To disable the BES Client Usage Profiler, you need to run the task 363 TROUBLESHOOTING: Disable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 0 and restart the client service.

References:

• 1: evaluation cycle | BigFix Developer
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_usage_profiler.html
• 3: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_usage_profiler_analysis.html
• 4: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056

• BigFix Clients use UDP (User Datagram Protocol) to automatically find their closest relay based on network hops12.
• UDP is a connectionless protocol that does not guarantee reliable delivery of packets, but is faster and more efficient than TCP (Transmission Control Protocol)3.
• BigFix Clients send UDP packets to the BigFix Server and all the BigFix Relays in their subnet, and wait for responses12.
• The BigFix Server and the BigFix Relays reply with UDP packets containing their relay information and the number of hops to reach them12.
• The BigFix Client compares the responses and selects the relay with the lowest number of hops as its closest relay12.
• If the BigFix Client does not receive any response within a timeout period, it assumes that there is no relay in its subnet and falls back to the BigFix Server12. References:
• Automatically assigning relays to existing clients
• Configuring BigFix for automatic Relay selection Blog
• UDP (User Datagram Protocol)

• When creating roles in Web Reports, you can define the permissions that you want to grant to the users who are assigned to that role.
• There are some check boxes that you can use to specify the permissions, such as:
• These check boxes are available in the Create Roles page, which you can access from Administration > User Management > Manage Roles > Create role.
• The other options (A, D, and F) are not available as check boxes when creating roles in Web Reports. They are either irrelevant or controlled by other settings. References:
• Manage Roles
• Create Roles
• Permissions Set in the BigFix Console

To create a new retrieved property in BigFix, the following steps are required:

• From the BigFix Console, select Manage Properties from the Tools menu. The Manage Properties dialog is displayed.
• You can filter the properties by using the left filter panel to select a subset of the properties to view on the right. If you cannot find what you want in this list, create a new property: click Add New, then enter a name for the property and a valid Relevance expression. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.
• After you define the new property, the Clients automatically compute the value of the corresponding relevance expression and return it to the Database. Click the OK button.
• The new property will be available in the column headers of computer listings, allowing you to sort and filter on its values. It can also be used to target Fixlet actions and generate Web Reports.

References:

• Creating Retrieved Properties
• Adding new properties under “By retrieved properties”

• The WebUI cache is used to improve the response time of the WebUI by storing and refreshing some data that requires complex calculations, such as the number of applicable devices or patches1.
• The cache refresh interval, also known as the cache Time To Live (TTL) value, determines how often the cached data is invalidated and updated1. The default value is 600 seconds (10 minutes)1.
• To change the cache refresh interval, you can use the client setting _WebUIAppEnv_CACHE_TTL and enter the desired interval in seconds1. The minimum value is 180 seconds (3 minutes)1.
• Increasing the cache refresh interval can reduce the impact on system resources, especially for large deployments and intensive patching activities1. However, it can also affect the freshness of the cached data1.
• Another setting that affects the WebUI caching is _WebUIAppEnv_CACHE_INTERVAL, which determines how often the WebUI checks for new data from the BigFix server1. The default value is 60 seconds1.
• Decreasing the cache interval can improve the responsiveness of the WebUI, but it can also increase the load on the BigFix server1. Therefore, you should balance the cache interval and the cache TTL values according to your needs and environment1.
• The other settings, _WebUIAppEnv_SP_QUEUE_CONCURRENT, _WebUIAppEnv_DATA_REFRESH_SECONDS, and _WebUIAppEnv_SITE_CACHE_SIZE, are not related to the WebUI cache refresh interval12.
• _WebUIAppEnv_SP_QUEUE_CONCURRENT limits the number of stored procedures that run simultaneously per app in the background that update cache values1. The default value is 51.
• _WebUIAppEnv_DATA_REFRESH_SECONDS determines how often the WebUI polls the BigFix server for new data2. The default value is 15 seconds2.
• _WebUIAppEnv_SITE_CACHE_SIZE specifies the maximum size of the site cache in megabytes2. The default value is 100 MB2.

References:

• Caching - HCL Product Documentation
• Server settings definitions - HCL Product Documentation

According to the BigFix Platform documentation, the default port used for BigFix Web Reports to connect is 8083, as of version 9.5.2. This is because the HTTPS configuration is automatically enabled on port 8083 when Web Reports is installed. If you want to use a different port or switch to HTTP configuration, you need to customize the Web Reports settings manually or using the BigFix Console12.

The other options (A, B, and D) are not correct because:

• Port 443 is the default port for WebUI to use HTTPS, not Web Reports3.
• Port 52311 is the default port for BigFix clients and relays to communicate with the BigFix server, not Web Reports4.
• Port 80 was the default port for Web Reports in version 9.2.4 and earlier, but it was changed to avoid conflict with WebUI.

References:

• Installing Web Reports Standalone
• Customizing HTTPS on Web Reports
• Change Communication Ports
• Network Port Conflicts
• [BigFix Network Ports]

According to the BigFix Platform documentation, the Site Administrator is responsible for installing and maintaining the BigFix software, and to run administrative tasks that globally affect the environment such as site-level signing keys management. There is only one Site Administrator for a BigFix environment1.

Some of the global system options that the Site Administrator can set and modify are:

• The default masthead file and license certificate
• The default site subscription policy
• The default client settings
• The default relay settings
• The default server settings
• The default Web Reports settings
• The default WebUI settings
• The default LDAP settings
• The default SAML settings
• The default audit log settings
• The default DSA settings
• The default proxy settings
• The default encryption settings
• The default caching settings
• The default logging settings
• The default performance settings
• The default security settings
• The default diagnostic settings

To set and modify these global system options, the Site Administrator must use the BigFix Administration Tool, which is a separate application from the BigFix Console. The Site Administrator must also have the Action Site Credentials, which are a special key generated during the installation process.

The other options (A, B, and D) are not exclusive to the Site Administrator, and can be performed by other Console Operators, depending on their permissions and roles.

References:

• BigFix Site Administrator and Console Operators
• Site administrator responsibilities
• Global system options
• [BigFix Administration Tool]

• Locking a BigFix Client means preventing it from accepting any actions that could modify its state, such as installing patches, changing settings, or running scripts1.
• Locking a BigFix Client can be useful for various reasons, such as testing new actions on a subset of unlocked computers, protecting critical or sensitive systems from unwanted changes, or complying with security policies or regulations12.
• Locking a BigFix Client can be done by using the BigFix Console, the BigFix WebUI, or the BES Client API13.
• Locking a BigFix Client does not affect its other functions, such as reporting, gathering, relay selection, or client settings2.
• The locked status of a BigFix Client can be changed by sending an unlock action, which can be done by a Master Operator or a Non-Master Operator who has the Write permission to the site where the client is subscribed14.
• The locked status of a BigFix Client can also be set to expire after a certain period of time, by using a custom action script15.
• Therefore, the only valid reason among the options for locking a computer is D. When changes or updates need to be excluded from the computer. References:
• 1: Locking clients
• 2: Just how locked is “Locked”?
• 3: [BES Client API]
• 4: [The Console Operators]
• 5: [Locking a client for a specific period of time]
• 6: [Locking clients]
• 7: [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]

• Command polling is a feature that allows BigFix Clients to poll their parent Relay or Server for UDP commands they may have missed, such as actions or refreshes. This is useful for Clients that cannot receive UDP notifications due to network or firewall restrictions.
• Command polling interval is a setting that determines how frequently the Clients will perform command polling. The default value is 900 seconds (15 minutes), which means that the Clients will check for new commands every 15 minutes.
• Setting the command polling interval to less than 900 seconds should be avoided to prevent performance issues, as it may cause excessive load on the BigFix Server, the Relays, and the database. It may also increase the network traffic and the CPU usage of the Clients.
• According to the documentation, setting the command polling interval to less than 20 minutes may cause performance issues and is not recommended1. A fixlet that enables command polling also warns that setting the polling interval to less than 900 seconds may cause performance issues2.
• Therefore, the answer is B. Less than 900 seconds. The other options (A, C, and D) are not correct, as they are either equal to or greater than the default value of 900 seconds, and thus do not pose a significant risk of performance degradation. References:
• Configuring FillDB
• Fixlet | BES Client Setting: Enable Command Polling

• An external site is a site that is created and maintained by HCL or a third-party vendor, and is subscribed by the BigFix administrator1. External sites provide content such as fixlets, tasks, analyses, and dashboards for various purposes, such as patching, compliance, inventory, and security1.
• The site properties for an external site in the Console show the following information2:
• Therefore, the correct answer is C. Description, as it is one of the information that is displayed in the site properties for an external site in the Console, along with Publisher and Current Version. The other options, A. Creator, B. Gather URL, and D. Created Date, are not correct, as they are either not shown or not relevant for the question. References:
• Sites
• Viewing site properties

The Four Eyes Approval feature is a security mechanism that requires the approval of another console operator who is a member of a specified role before an action can be executed. This feature is useful for preventing unauthorized or accidental actions that could affect the endpoints in the BigFix deployment. To enable this feature, you need to follow these steps:

• Use the BigFix Administration Tool to add the useFourEyesAuthentication advanced option and set its value to true.
• Restart the BES Root Server service and the BigFix Console.
• Create a role for the approvers and add one or more operators to it.
• Select the Actions Require Approval option for the operators who need to get approval for their actions and choose the approvers role from the drop-down list.
• When an operator takes an action that requires approval, they will see a dialog box asking them to enter the credentials of an approver. The action will be pending until an approver logs in and approves it. References:
• Four Eyes Approval Capability
• Has anyone tried SAML Authentication with Four-Eyes authentication?
• BigFix Platform Security Configuration Guide

• An analysis is a custom content that allows operators to monitor and audit specific properties of the managed BigFix clients12.
• To create an analysis, an operator needs to have the Can Manage Analyses permission, which grants the ability to create, edit, activate, and deactivate analyses3 .
• This permission can be assigned to any console operator, regardless of whether they are master or non-master operators3 .
• Therefore, the correct answer is D. Only console operators with the Can Manage Analyses permission are allowed to create an analysis. References:
• Create Analysis - HCL Product Documentation
• Creating Analyses - HCL Product Documentation
• Operators and analysis - HCL Product Documentation
• [Operator Permissions - HCL Product Documentation]

• Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.
• Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.
• Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.
• To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.
• Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.
• Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.
• Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potentialsynchronization issues, so it should be done with caution and proper planning. References:
• Introducing Baselines
• Creating or Customizing Baselines
• Baselines