HCL-BF-PRO-10 HCLSoftware U Certified Professional-BigFix Platform 1 Questions and Answers

• Domains are a major organizing principle in the BigFix Console that allow you to access and manage related sites, such as Patch Management, AntiVirus Management, Power Management, and so on.
• Domains are not collections of Fixlet messages, but rather contain a set of related sites that have Fixlet messages, tasks, analyses, and other content. The content is created by HCL, other vendors, or yourself, depending on the site type and subscription.
• Domains do not provide a way to deploy actions across the network, but rather help you to find and select the relevant content for your actions. You can still use the Action Wizard or the Take Action button to deploy actions from any domain or site.
• Domains are located in the lower-left portion of the Console, where you can select the domain you want from the buttons at the bottom of the panel. The contents of the domain are then displayed in the upper-right panel, where you can filter and sort them by various criteria.
• Domains are not located under Tools in the Console, but rather under the Sites node in the navigation tree. You can also access the Manage Domains dialog from the Tools menu, where you can create, edit, or delete domains. References:
• Domains
• Introducing Domains
• Manage Domains

• The Site Administrator key is a private key that is used to perform site-level tasks such as setting global system options, editing mastheads, and administering Distributed Server Architecture (DSA)1.
• The Site Administrator key is generated during the installation of the BigFix Server, when the site administrator is prompted to enter a password to encrypt the key2.
• The Site Administrator key is stored in a file named license.pvk in the BigFix Enterprise\BES Server folder on the BigFix Server3.
• The Site Administrator key is required to run the BESAdmin.exe tool, which is used to manage the BigFix Server configuration and settings.
• The Site Administrator key is also required to create the masthead file, which is a file that contains the digital signature and configuration information of the BigFix deployment.
• The Site Administrator key is different from the Master Operator key, which is used to access the BigFix Console and create other operators.

References:

• 1: The Site Administrator
• 2: Admin site key for installation
• 3: Site administrator responsibilities
• : Using the BESAdmin Tool
• : Creating the Masthead
• : BigFix Site Administrator and Console Operators

• Locking a BigFix Client means preventing it from accepting any actions that could modify its state, such as installing patches, changing settings, or running scripts1.
• Locking a BigFix Client can be useful for various reasons, such as testing new actions on a subset of unlocked computers, protecting critical or sensitive systems from unwanted changes, or complying with security policies or regulations12.
• Locking a BigFix Client can be done by using the BigFix Console, the BigFix WebUI, or the BES Client API13.
• Locking a BigFix Client does not affect its other functions, such as reporting, gathering, relay selection, or client settings2.
• The locked status of a BigFix Client can be changed by sending an unlock action, which can be done by a Master Operator or a Non-Master Operator who has the Write permission to the site where the client is subscribed14.
• The locked status of a BigFix Client can also be set to expire after a certain period of time, by using a custom action script15.
• Therefore, the only valid reason among the options for locking a computer is D. When changes or updates need to be excluded from the computer. References:
• 1: Locking clients
• 2: Just how locked is “Locked”?
• 3: [BES Client API]
• 4: [The Console Operators]
• 5: [Locking a client for a specific period of time]
• 6: [Locking clients]
• 7: [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]

• When creating roles in Web Reports, you can define the permissions that you want to grant to the users who are assigned to that role.
• There are some check boxes that you can use to specify the permissions, such as:
• These check boxes are available in the Create Roles page, which you can access from Administration > User Management > Manage Roles > Create role.
• The other options (A, D, and F) are not available as check boxes when creating roles in Web Reports. They are either irrelevant or controlled by other settings. References:
• Manage Roles
• Create Roles
• Permissions Set in the BigFix Console

• Launch the BigFix Administration Tool from the Start menu or from the installation folder.
• Enter the current password for the Site Administrator private key and click OK.
• Click the Advanced Options tab and select Change Site Administrator Private Key Password.
• Enter the new password, confirm it, and click OK.
• Restart the BigFix Server service for the changes to take effect. References:
• Re-creating Site Credentials
• Change Private Key Password
• Need help in to recover or set a new password for the Bigfix Admin

• To create a custom Fixlet, you need to use the Action Script language, which is a set of commands that run on relevant clients to fix the problem identified by the Applicability Relevance clause1.
• The Action Script language supports various types of scripts that can be executed on different operating systems, such as Windows, Linux, Mac OS, etc2.
• Some of the valid Action Script types are:
• Among the options given in the question, Powershell and csh are valid Action Script types, as they are supported by the waithidden, runhidden, wait, and run commands2.
• Powershell is a scripting language for Windows systems, which can be executed by using the powershell.exe executable2.
• csh is a shell script for Unix-like systems, which can be executed by using the csh command2.
• AppleScript, Python, and Javascript are not valid Action Script types, as they are not supported by the Action Script language2.
• AppleScript is a scripting language for Mac OS systems, which can be executed by using the osascript command2.
• Python is a general-purpose programming language, which can be executed by using the python command2.
• Javascript is a scripting language for web browsers, which can be executed by using the cscript.exe or wscript.exe commands on Windows systems2.

References:

• The Action Script Language
• Action Script Guide

According to the BigFix Platform documentation, the Site Administrator is responsible for installing and maintaining the BigFix software, and to run administrative tasks that globally affect the environment such as site-level signing keys management. There is only one Site Administrator for a BigFix environment1.

Some of the global system options that the Site Administrator can set and modify are:

• The default masthead file and license certificate
• The default site subscription policy
• The default client settings
• The default relay settings
• The default server settings
• The default Web Reports settings
• The default WebUI settings
• The default LDAP settings
• The default SAML settings
• The default audit log settings
• The default DSA settings
• The default proxy settings
• The default encryption settings
• The default caching settings
• The default logging settings
• The default performance settings
• The default security settings
• The default diagnostic settings

To set and modify these global system options, the Site Administrator must use the BigFix Administration Tool, which is a separate application from the BigFix Console. The Site Administrator must also have the Action Site Credentials, which are a special key generated during the installation process.

The other options (A, B, and D) are not exclusive to the Site Administrator, and can be performed by other Console Operators, depending on their permissions and roles.

References:

• BigFix Site Administrator and Console Operators
• Site administrator responsibilities
• Global system options
• [BigFix Administration Tool]

To perform a BigFix installation with a new serial number, you need to have a license authorization file from the BigFix License Key Center site. This file contains the information about your license purchase and the serial number. You need to enter thisfile during the installation process to request and get the license certificate file (license.crt) and the private key file (license.pvk). These two files together complete your license. You also generate the masthead file (masthead.afxm) during the installation, which contains the information about your BigFix deployment. References:

• Managing licenses
• Installation Instructions
• Admin site key for installation

• Command polling is a feature that allows BigFix Clients to poll their parent Relay or Server for UDP commands they may have missed, such as actions or refreshes. This is useful for Clients that cannot receive UDP notifications due to network or firewall restrictions.
• Command polling interval is a setting that determines how frequently the Clients will perform command polling. The default value is 900 seconds (15 minutes), which means that the Clients will check for new commands every 15 minutes.
• Setting the command polling interval to less than 900 seconds should be avoided to prevent performance issues, as it may cause excessive load on the BigFix Server, the Relays, and the database. It may also increase the network traffic and the CPU usage of the Clients.
• According to the documentation, setting the command polling interval to less than 20 minutes may cause performance issues and is not recommended1. A fixlet that enables command polling also warns that setting the polling interval to less than 900 seconds may cause performance issues2.
• Therefore, the answer is B. Less than 900 seconds. The other options (A, C, and D) are not correct, as they are either equal to or greater than the default value of 900 seconds, and thus do not pose a significant risk of performance degradation. References:
• Configuring FillDB
• Fixlet | BES Client Setting: Enable Command Polling

• The BES Client Usage Profiler is a tool that collects information about the client evaluation cycle, such as the average, maximum, and minimum duration, and the percentage of time spent on different tasks, such as action, api, archive, gather, etc.1
• To enable the BES Client Usage Profiler, you need to run the task 361 TROUBLESHOOTING: Enable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 1 and restart the client service.2
• After the task is completed, you can use the analysis 362 TROUBLESHOOTING: BES Client Usage Profiler to view the results of the profiler. This analysis will show you the evaluation cycle statistics and the breakdown of the time spent on each task.3
• You can use this information to identify any potential issues or bottlenecks in the client evaluation cycle, such as long action duration, high api percent, or excessive gather time. You can also compare the results with other clients or the average values to see if there are any anomalies or outliers.4
• To disable the BES Client Usage Profiler, you need to run the task 363 TROUBLESHOOTING: Disable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 0 and restart the client service.

References:

• 1: evaluation cycle | BigFix Developer
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_usage_profiler.html
• 3: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_usage_profiler_analysis.html
• 4: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056

• BigFix clients can download resources directly from the Internet instead of their parent relay by using the download now command in the action script1. This command bypasses the relay hierarchy and requests the file from the URL specified in the action script2.
• However, this command may not be suitable for all scenarios, as it may consume more bandwidth and increase the download time2. Therefore, BigFix provides several settings to control the download behavior of the clients based on different criteria3.
• One of these settings is _BESClient_Download_Direct_SubnetList, which allows the clients to download resources directly from the Internet if they are on a specific subnet4. This setting is useful for clients that are connected to the enterprise network through a VPN, as they may have a faster connection to the Internet than to their parent relay4.
• To enable this setting, the clients need to have the following values in their configuration files4:
• For example, if the clients are on the subnets 172.31.148.0/22, 172.31.152.0/22, 172.31.156.0/22, 172.31.160.0/24, 10.31.148.0/22, 10.31.152.0/22, 10.31.156.0/22, or 10.31.160.0/24, the setting value would be4:
• The other settings, such as _BESClient_Download_DirectPatchList, _BESClient_Download_Direct_Domainlist, and _BESClient_Download_Direct_ByVendor, are used to download resources directly from the Internet based on the patch name, the domain name, or the vendor name, respectively3. These settings are not relevant for the question scenario, as they do not depend on the client’s network location. References:
• Configuration Settings
• Managing Downloads
• Download Commands
• Setting creation to download the patch content Directlyy

• An external site is a site that is created and maintained by HCL or a third-party vendor, and is subscribed by the BigFix administrator1. External sites provide content such as fixlets, tasks, analyses, and dashboards for various purposes, such as patching, compliance, inventory, and security1.
• The site properties for an external site in the Console show the following information2:
• Therefore, the correct answer is C. Description, as it is one of the information that is displayed in the site properties for an external site in the Console, along with Publisher and Current Version. The other options, A. Creator, B. Gather URL, and D. Created Date, are not correct, as they are either not shown or not relevant for the question. References:
• Sites
• Viewing site properties

• Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.
• Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.
• Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.
• To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.
• Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.
• Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.
• Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potentialsynchronization issues, so it should be done with caution and proper planning. References:
• Introducing Baselines
• Creating or Customizing Baselines
• Baselines

• The WebUI is a web-based interface that provides access to the flexibility and power of BigFix.
• The WebUI has some upper use limits that depend on many factors, such as the number of endpoints, the workload, the time of day, the server location, and the number of concurrent users.
• Concurrent users are defined as highly active users who perform multiple actions per minute on the WebUI.
• According to the BigFix Capacity Planning Guide, both the Windows and Linux WebUI instances support 36 concurrent users on a 250k deployment base. This is the recommended scalability limit for the WebUI server on BigFix v10.x.
• The WebUI also requires additional hardware resources, such as CPU, memory, and storage, to power the WebUI. These resources are in addition to the BigFix root server requirements and depend on the number of concurrent users.
• The WebUI also implements a database cache for several counters to improve the WebUI response times. The cache has a default refresh interval of 10 minutes. References:
• Hardware Requirements
• WebUI Administrators Guide
• BigFix WebUI

• An analysis is a type of content that collects and reports information about the computers in the BigFix environment1.
• An analysis can be activated or deactivated by an operator who has the permission to do so1.
• An analysis can be authored by a Master Operator or a Non-Master Operator who has the Custom Content permission2.
• An analysis can be stored in a custom site or an external site2. A custom site is a site that is created and managed by a Master Operator, while an external site is a site that is provided by HCL or a third-party vendor3.
• According to the BigFix documentation, the following statements are true about the rights and restrictions of BigFix Console operators when activating, deactivating and modifying analyses2 :
• Based on the above information, the only valid statement among the options is B. Non-Master operators cannot deactivate an analysis activated by other operators on computers they administer. References:
• 1: [Using analyses]
• 2: [The Console Operators]
• 3: [Sites]
• : [Operators permissions]
• : [Using analyses]
• : [The Console Operators]
• : [Sites]
• : [Operators permissions]