HCL-BF-PRO-10 Questions and Answers

• An analysis is a custom content that allows operators to monitor and audit specific properties of the managed BigFix clients12.
• To create an analysis, an operator needs to have the Can Manage Analyses permission, which grants the ability to create, edit, activate, and deactivate analyses3 .
• This permission can be assigned to any console operator, regardless of whether they are master or non-master operators3 .
• Therefore, the correct answer is D. Only console operators with the Can Manage Analyses permission are allowed to create an analysis. References:
• Create Analysis - HCL Product Documentation
• Creating Analyses - HCL Product Documentation
• Operators and analysis - HCL Product Documentation
• [Operator Permissions - HCL Product Documentation]

• The BigFix Diagnostics Tool is a program that checks the status and configuration of the server components, such as the database, the gather service, and the web reports server.
• The tool can be run at any time, either after installing the server or later, to troubleshoot any issues or monitor the server performance.
• To run the tool, you need to log on to the server as an administrator and launch the program from the Start menu.
• The tool will analyze the server components and display the results in a graphical interface, with green, yellow, or red lights indicating the health of each component.
• You can also click on the Full Interface button to see more details and access the knowledge base articles for each component.
• The tool can also be run remotely by taking action on the Troubleshoot: Execute Server Diagnostic task located in the BES Support site, but this requires the client to be installed on the server. References:
• Running the BigFix Diagnostics tool
• Running the IBM BigFix Diagnostics tool
• Waiting for downloads to be mirrored - BigFix Forum
• BigFix Wiki - BES Client Diagnostics

• The license.pvk file is the private key file that is part of the BigFix license. It is protected by a password that is set during the installation of the BigFix server.
• The license.pvk file is used to authenticate the BigFix Master Operators, who are the highest level of authority in the BigFix hierarchy. They can perform any action on any computer or site in the BigFix deployment.
• The license.pvk file is also used to sign the masthead file, which contains the configuration settings and the public key for the BigFix deployment. The masthead file isdistributed to all BigFix components, such as clients, relays, and consoles, to verify the identity and authority of the BigFix server.
• The license.pvk file is not used to authenticate the BigFix Site Administrator, who is a special Master Operator that can manage the license and the masthead files. The Site Administrator uses the site admin password to access the license.pvk file and perform license-related tasks.
• The license.pvk file is not used to authenticate the BigFix local operators, who are the lower level of authority in the BigFix hierarchy. They can only perform actions on the computers and sites that are assigned to them by the Master Operators. The local operators use their username and password to log in to the BigFix console.
• The license.pvk file is not used to authenticate the BigFix LDAP operators, who are the local operators that are authenticated by an external LDAP server. They use their LDAP credentials to log in to the BigFix console. References:
• Managing licenses
• Missing or Lost license.pvk file
• Check private key password - license.pvk

• Locking a BigFix Client means preventing it from accepting any actions that could modify its state, such as installing patches, changing settings, or running scripts1.
• Locking a BigFix Client can be useful for various reasons, such as testing new actions on a subset of unlocked computers, protecting critical or sensitive systems from unwanted changes, or complying with security policies or regulations12.
• Locking a BigFix Client can be done by using the BigFix Console, the BigFix WebUI, or the BES Client API13.
• Locking a BigFix Client does not affect its other functions, such as reporting, gathering, relay selection, or client settings2.
• The locked status of a BigFix Client can be changed by sending an unlock action, which can be done by a Master Operator or a Non-Master Operator who has the Write permission to the site where the client is subscribed14.
• The locked status of a BigFix Client can also be set to expire after a certain period of time, by using a custom action script15.
• Therefore, the only valid reason among the options for locking a computer is D. When changes or updates need to be excluded from the computer. References:
• 1: Locking clients
• 2: Just how locked is “Locked”?
• 3: [BES Client API]
• 4: [The Console Operators]
• 5: [Locking a client for a specific period of time]
• 6: [Locking clients]
• 7: [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]
• : [Locking clients]
• : [Just how locked is “Locked”?]
• : [BES Client API]
• : [The Console Operators]
• : [Locking a client for a specific period of time]

• A BigFix Relay is a special type of BigFix Client that can cache and distribute files to other BigFix Clients, reducing the workload and bandwidth usage of the BigFix Server1.
• A BigFix Relay can be installed on any BigFix Client that runs on a supported BigFix Relay operating system, which includes Windows, Linux, and Solaris23.
• A BigFix Relay does not require a server operating system or a dedicated endpoint, as long as it meets the minimum system requirements and recommendations for a relay, which are similar to those for a workgroup file server23.
• A BigFix Relay must have a two-way TCP connection to its parent, which can be another relay or the BigFix Server23.
• A BigFix Relay can be installed using a Fixlet from the BigFix Console or the command line4. References:
• 1: Relays and Servers
• 2: Relay requirements and recommendations
• 3: Relay requirements
• 4: Installing a relay

According to the BigFix Platform documentation1, the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration. To configure a high scale Relay, you need to follow these steps2:

• Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.
• Set the _BESRelay_HTTPServer_MaxConnections setting to 2000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinute setting to 0 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinutePerClient setting to 0 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitPercent setting to 0 on the Relay.
• Set the _BESRelay_Download_CacheLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_CacheLimitPercent setting to 0 on the Relay.
• Restart the Relay service after applying the settings. References:
• Relay scalability
• Configuring a high scale Relay

• Domains are a major organizing principle in the BigFix Console that allow you to access and manage related sites, such as Patch Management, AntiVirus Management, Power Management, and so on.
• Domains are not collections of Fixlet messages, but rather contain a set of related sites that have Fixlet messages, tasks, analyses, and other content. The content is created by HCL, other vendors, or yourself, depending on the site type and subscription.
• Domains do not provide a way to deploy actions across the network, but rather help you to find and select the relevant content for your actions. You can still use the Action Wizard or the Take Action button to deploy actions from any domain or site.
• Domains are located in the lower-left portion of the Console, where you can select the domain you want from the buttons at the bottom of the panel. The contents of the domain are then displayed in the upper-right panel, where you can filter and sort them by various criteria.
• Domains are not located under Tools in the Console, but rather under the Sites node in the navigation tree. You can also access the Manage Domains dialog from the Tools menu, where you can create, edit, or delete domains. References:
• Domains
• Introducing Domains
• Manage Domains

• The Site Administrator key is a private key that is used to perform site-level tasks such as setting global system options, editing mastheads, and administering Distributed Server Architecture (DSA)1.
• The Site Administrator key is generated during the installation of the BigFix Server, when the site administrator is prompted to enter a password to encrypt the key2.
• The Site Administrator key is stored in a file named license.pvk in the BigFix Enterprise\BES Server folder on the BigFix Server3.
• The Site Administrator key is required to run the BESAdmin.exe tool, which is used to manage the BigFix Server configuration and settings.
• The Site Administrator key is also required to create the masthead file, which is a file that contains the digital signature and configuration information of the BigFix deployment.
• The Site Administrator key is different from the Master Operator key, which is used to access the BigFix Console and create other operators.

References:

• 1: The Site Administrator
• 2: Admin site key for installation
• 3: Site administrator responsibilities
• : Using the BESAdmin Tool
• : Creating the Masthead
• : BigFix Site Administrator and Console Operators

• The WebUI cache is used to improve the response time of the WebUI by storing and refreshing some data that requires complex calculations, such as the number of applicable devices or patches1.
• The cache refresh interval, also known as the cache Time To Live (TTL) value, determines how often the cached data is invalidated and updated1. The default value is 600 seconds (10 minutes)1.
• To change the cache refresh interval, you can use the client setting _WebUIAppEnv_CACHE_TTL and enter the desired interval in seconds1. The minimum value is 180 seconds (3 minutes)1.
• Increasing the cache refresh interval can reduce the impact on system resources, especially for large deployments and intensive patching activities1. However, it can also affect the freshness of the cached data1.
• Another setting that affects the WebUI caching is _WebUIAppEnv_CACHE_INTERVAL, which determines how often the WebUI checks for new data from the BigFix server1. The default value is 60 seconds1.
• Decreasing the cache interval can improve the responsiveness of the WebUI, but it can also increase the load on the BigFix server1. Therefore, you should balance the cache interval and the cache TTL values according to your needs and environment1.
• The other settings, _WebUIAppEnv_SP_QUEUE_CONCURRENT, _WebUIAppEnv_DATA_REFRESH_SECONDS, and _WebUIAppEnv_SITE_CACHE_SIZE, are not related to the WebUI cache refresh interval12.
• _WebUIAppEnv_SP_QUEUE_CONCURRENT limits the number of stored procedures that run simultaneously per app in the background that update cache values1. The default value is 51.
• _WebUIAppEnv_DATA_REFRESH_SECONDS determines how often the WebUI polls the BigFix server for new data2. The default value is 15 seconds2.
• _WebUIAppEnv_SITE_CACHE_SIZE specifies the maximum size of the site cache in megabytes2. The default value is 100 MB2.

References:

• Caching - HCL Product Documentation
• Server settings definitions - HCL Product Documentation

• The BigFix Console is a graphical user interface that allows you to interact with the BigFix Platform and perform various tasks, such as deploying actions, creating content, managing sites, and viewing reports1.
• The BigFix Console operators are the users who can access the BigFix Console and perform different activities based on their permissions and roles2.
• There are two types of Console operators: Master Operators (MO) and Non-Master Operators (NMO)2.
• Master Operators are the administrative users of the BigFix Console. They have access to all the computers defined in the BigFix environment and the authority to create and manage other Console operators2.
• Non-Master Operators are the users who manage the day-to-day BigFix operations, including Fixlet management and action deployment, against a subset of computers they are allowed to manage by the Master Operator2.
• Some of the activities that can only be performed by a Master Operator are23:
• Some of the activities that can be performed by both Master Operators and Non-Master Operators are23:

References:

• The BigFix Console
• The Console Operators
• Accessing the console

• To upgrade the BigFix platform components, you need to follow the recommended order and the version rules as documented in the Upgrade Paths and the BigFix Upgrade Best Practices.
• The recommended order of upgrading the components is as follows:1
• The version rules for the components are as follows:12

References:

• 1: Upgrade paths for BigFix 10 - HCL Product Documentation
• 2: Upgrading on Windows systems - HCL Product Documentation
• 3: BigFix Wiki - BigFix Upgrade Best Practices

• A Multiple Action Group is a way to deploy a set of Fixlets or tasks in a single grouping using the Take multiple actions command1.
• As a requirement, each Fixlet or task involved in the group must have associated a default action1.
• A default action is an action script that is predefined by the Fixlet or task author and can be executed without any user input2.
• If one or more of the Fixlets that are selected do not have a default action, the Take multiple actions command will fail and display an error in the Console1.
• To resolve this issue, the operator can either select only Fixlets or tasks that have default actions, or create a Baseline that includes the Fixlets or tasks without default actions1. References:
• 1: Taking multiple actions
• 2: Action Script
• 3: Take multiple actions
• 4: Action Script Guide

• A Manual Computer Group is a group that is defined by manually selecting the computers from the Computers List Panel1. A Manual Group can only be shared between Master Operators2.
• An Automatic Computer Group is a group that is defined by using Relevance expressions or properties to indicate the group membership3. An Automatic Group can change its population dynamically depending on the evaluation of the group properties3.
• An operator might create a Manual Computer Group instead of an Automatic Computer Group if they need to base the group membership on information that is not available using Relevance expressions or properties. For example, if the operator wants to group computers based on their physical location, owner, or usage, they might not be able to use Relevance expressions or properties to determine that information. In that case, they can manually select the computers that belong to the group4.
• However, Manual Groups have some drawbacks, such as being static, not scalable, and not extensible5. Therefore, it is recommended to use Automatic Groups whenever possible and use Manual Groups sparingly25. References:
• Manual Computer Groups - HCL Product Documentation
• Manual Groups vs Automatic - Platform - BigFix Forum
• Creating Automatic Computer Groups - HCL Product Documentation
• Task or Fixlet to move computers into manual group - BigFix Forum
• Regarding Manual Computer Groups - BigFix Forum