HCL-BF-PRO-10 HCL Software Academy HCLSoftware U Certified Professional-BigFix Platform 1 Free Practice Exam Questions (2025 Updated)

According to the BigFix platform documentation, the BigFix server on Windows systems supports the following configurations: Local or remote Microsoft SQL Server 2012, 2014, 2016, 2017, 2019 or 202212.

Therefore, the correct answer is option D. Microsoft SQL Server.

The other options are not supported by BigFix on Windows systems, and can be ruled out. Therefore, options A, B, and C are incorrect. References:

Database requirements

Software requirements

Message Level Encryption (MLE) allows your Clients to encrypt upstream data using a combination of an RSA public/private key-pair and an AES session key1.

When MLE is enabled, the BigFix Root server (or a decrypting Relay) needs to use the corresponding RSA private key to decrypt the AES session key, which is then used to decrypt the Client report1.

This decryption process consumes CPU resources on the BigFix Root server, and the amount of CPU usage depends on the number of encrypted reports received and the key length used1.

Therefore, the BigFix Root server requires additional CPU resources appropriate to the number of managed endpoints to process the encrypted reports1.

The other options are incorrect because:

A is not relevant to the question, as it assumes that there are top-level Relays in the deployment. The question states that there are no top-level Relays, so all Relays are downstream from the BigFix Root server. Moreover, the RAM requirement for Relays is not affected by MLE, as Relays do not perform any encryption or decryption by default1.

C is not necessary, as adding an additional NIC to the BigFix Root server does not affect the CPU load caused by the encrypted reports. The network bandwidth requirement for MLE is not significantly higher than for clear-text reports, as the encryption adds only a small overhead to the report size1.

D is not a valid setting for the BigFix Root server, as it only applies to Relays that are configured to decrypt and repackage encrypted reports before relaying them to theBigFix Root server2. This setting controls the maximum number of concurrent decryption threads on a Relay, and does not affect the BigFix Root server2. References:

1: Message Level Encryption (MLE) Overview

2: [Enabling encryption on Relays]

A BigFix Client is a software agent that is installed on every computer that must be managed by the BigFix platform1.

The BigFix Client continuously assesses the state of the computer against all subscribed content, which includes policies, checklists, and remediation tasks12.

The BigFix Client communicates with its parent, which can be either the BigFix Server or a BigFix Relay, to report its status and receive new content13.

The BigFix Client performs most of the analysis, processing, and enforcement work locally, reducing the workload and bandwidth usage of the BigFix Server14.

The BigFix Client operates with less than 10 megabytes of RAM and can run on various operating systems, such as Windows, Linux, UNIX, and Mac OS1 . References:

1: BigFix Platform

2: Learning about SCAP

3: Relays and Servers

4: BigFix Architecture

: Client requirements

To create a new retrieved property in BigFix, the following steps are required:

From the BigFix Console, select Manage Properties from the Tools menu. The Manage Properties dialog is displayed.

You can filter the properties by using the left filter panel to select a subset of the properties to view on the right. If you cannot find what you want in this list, create a new property: click Add New, then enter a name for the property and a valid Relevance expression. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.

After you define the new property, the Clients automatically compute the value of the corresponding relevance expression and return it to the Database. Click the OK button.

The new property will be available in the column headers of computer listings, allowing you to sort and filter on its values. It can also be used to target Fixlet actions and generate Web Reports.

References:

Creating Retrieved Properties

Adding new properties under “By retrieved properties”

The download cache size on a relay or a server can be changed by using the Fixlet ID# 148 BES Relay/Server Setting: Download Cache Size, available from the BES Support Site.

This Fixlet allows the administrator to specify the desired cache size in MB as a parameter of the action.

To increase the cache size to 10 GB, the administrator needs to enter 10240 as the value of the parameter, since 1 GB = 1024 MB.

The Fixlet will then create or modify the client setting _BESGather_Download_CacheLimitMB on the target relay or server, and set its value to the specified parameter.

The Fixlet will also restart the BES Client service on the target relay or server to apply the new setting.

The new cache size will take effect after the service restarts, and the relay or server will be able to store more downloaded files in its cache. References:

Managing Downloads

BES Client download cache limit?

The download size exceeds the maximum value set in the client setting

Here is a step by step comprehensive explanation of why this is the case:

The Action Script you are testing is trying to stop, start, and execute a service using batch commands.

The first line of the script uses the “appendfile” command to create a new file with the content “net stop myService”.

The second line of the script uses the “move” command to rename the file created by “appendfile” to “c:\runme.bat”.

The third line of the script uses the “waithidden” command to execute the file “c:\runme.bat” and wait for it to finish.

The fourth line of the script uses the “appendfile” command again to create a new file with the content “net start myService”.

The fifth line of the script uses the “move” command again to rename the file created by “appendfile” to “c:\runme.bat”.

The sixth line of the script uses the “waithidden” command again to execute the file “c:\runme.bat” and wait for it to finish.

The error occurs at the fifth line of the script because “appendfile” is trying to copy content to “c:\runme.bat” which already exists due to the previous actions in the script. In BigFix Action Script, “appendfile” is used to create a new file or append to an existing one, but it seems there’s an issue with overwriting or permissions that causes this line to fail.

To fix this error, you can either delete the file “c:\runme.bat” before using “appendfile” again, or use a different file name for the second “appendfile” command.

Some references that support this explanation are:

BigFix Action Script guide: 1

BigFix Action Script reference: 2

BigFix Action Script examples: 3

BigFix Action Script best practices: 4

The license.pvk file is the private key file that is part of the BigFix license. It is protected by a password that is set during the installation of the BigFix server.

The license.pvk file is used to authenticate the BigFix Master Operators, who are the highest level of authority in the BigFix hierarchy. They can perform any action on any computer or site in the BigFix deployment.

The license.pvk file is also used to sign the masthead file, which contains the configuration settings and the public key for the BigFix deployment. The masthead file isdistributed to all BigFix components, such as clients, relays, and consoles, to verify the identity and authority of the BigFix server.

The license.pvk file is not used to authenticate the BigFix Site Administrator, who is a special Master Operator that can manage the license and the masthead files. The Site Administrator uses the site admin password to access the license.pvk file and perform license-related tasks.

The license.pvk file is not used to authenticate the BigFix local operators, who are the lower level of authority in the BigFix hierarchy. They can only perform actions on the computers and sites that are assigned to them by the Master Operators. The local operators use their username and password to log in to the BigFix console.

The license.pvk file is not used to authenticate the BigFix LDAP operators, who are the local operators that are authenticated by an external LDAP server. They use their LDAP credentials to log in to the BigFix console. References:

Managing licenses

Missing or Lost license.pvk file

Check private key password - license.pvk

To create a Custom Site, you need to select Tools > Create Custom Site from the BigFix Console and enter a name for your site. You can also provide a description and a domain for your site.

To assign permission levels to operators, you need to click the Operator Permissions tab from the site dialog and select the operators from the list. You can also grant read permission globally to all operators by clicking the corresponding button.

The permission levels that can be assigned to operators are:

Reader: This level allows the operator to view the content of the site, but not to modify it or create new content. Readers can also subscribe computers to the site, but not change the subscription criteria.

Writer: This level allows the operator to view and modify the content of the site, as well as create new content. Writers can also subscribe computers to the site and change the subscription criteria.

Owner: This level allows the operator to view, modify, and create content, as well as manage the site settings, such as the name, description, domain, and operator permissions. Owners can also subscribe computers to the site and change the subscription criteria.

The permission levels that cannot be assigned to operators are:

User: This level is not applicable to Custom Sites, as it is only used for External Sites to indicate that the operator has accepted the license agreement for the site.

Administrator: This level is not applicable to Custom Sites, as it is only used for the Master Action Site to indicate that the operator has full control over the site and can perform any action on any computer.

Guest: This level is not applicable to Custom Sites, as it is only used for the BES Support Site to indicate that the operator has read-only access to the site and cannot subscribe computers to the site. References:

Creating Custom Sites

User Permissions and Guidelines

Selecting Sites

A Multiple Action Group is a way to deploy a set of Fixlets or tasks in a single grouping using the Take multiple actions command1.

As a requirement, each Fixlet or task involved in the group must have associated a default action1.

A default action is an action script that is predefined by the Fixlet or task author and can be executed without any user input2.

If one or more of the Fixlets that are selected do not have a default action, the Take multiple actions command will fail and display an error in the Console1.

To resolve this issue, the operator can either select only Fixlets or tasks that have default actions, or create a Baseline that includes the Fixlets or tasks without default actions1. References:

1: Taking multiple actions

2: Action Script

3: Take multiple actions

4: Action Script Guide

The Site Administrator key is a private key that is used to perform site-level tasks such as setting global system options, editing mastheads, and administering Distributed Server Architecture (DSA)1.

The Site Administrator key is generated during the installation of the BigFix Server, when the site administrator is prompted to enter a password to encrypt the key2.

The Site Administrator key is stored in a file named license.pvk in the BigFix Enterprise\BES Server folder on the BigFix Server3.

The Site Administrator key is required to run the BESAdmin.exe tool, which is used to manage the BigFix Server configuration and settings.

The Site Administrator key is also required to create the masthead file, which is a file that contains the digital signature and configuration information of the BigFix deployment.

The Site Administrator key is different from the Master Operator key, which is used to access the BigFix Console and create other operators.

References:

1: The Site Administrator

2: Admin site key for installation

3: Site administrator responsibilities

: Using the BESAdmin Tool

: Creating the Masthead

: BigFix Site Administrator and Console Operators

An analysis is a type of content that collects and reports information about the computers in the BigFix environment1.

An analysis can be activated or deactivated by an operator who has the permission to do so1.

An analysis can be authored by a Master Operator or a Non-Master Operator who has the Custom Content permission2.

An analysis can be stored in a custom site or an external site2. A custom site is a site that is created and managed by a Master Operator, while an external site is a site that is provided by HCL or a third-party vendor3.

According to the BigFix documentation, the following statements are true about the rights and restrictions of BigFix Console operators when activating, deactivating and modifying analyses2 :

A Master Operator can activate or deactivate any analysis in any site, regardless of who authored it or where it is stored.

A Non-Master Operator can activate or deactivate an analysis in a custom site only if they have the Write permission to that site and the analysis is authored by them or another Non-Master Operator.

A Non-Master Operator cannot activate or deactivate an analysis in an external site, even if they have the Read permission to that site.

A Non-Master Operator cannot deactivate an analysis that is activated by a Master Operator or another Non-Master Operator on computers that they administer, unless they have the Write permission to the site where the analysis is stored and the analysis is authored by a Non-Master Operator.

A Master Operator can edit any analysis in any site, regardless of who authored it or where it is stored.

A Non-Master Operator can edit an analysis in a custom site only if they have the Write permission to that site and the analysis is authored by them.

A Non-Master Operator cannot edit an analysis in an external site, even if they have the Read permission to that site.

Based on the above information, the only valid statement among the options is B. Non-Master operators cannot deactivate an analysis activated by other operators on computers they administer. References:

1: [Using analyses]

2: [The Console Operators]

3: [Sites]

: [Operators permissions]

: [Using analyses]

: [The Console Operators]

: [Sites]

: [Operators permissions]

To perform a BigFix installation with a new serial number, you need to have a license authorization file from the BigFix License Key Center site. This file contains the information about your license purchase and the serial number. You need to enter thisfile during the installation process to request and get the license certificate file (license.crt) and the private key file (license.pvk). These two files together complete your license. You also generate the masthead file (masthead.afxm) during the installation, which contains the information about your BigFix deployment. References:

Managing licenses

Installation Instructions

Admin site key for installation

The BigFix Diagnostics Tool is a program that checks the status and configuration of the server components, such as the database, the gather service, and the web reports server.

The tool can be run at any time, either after installing the server or later, to troubleshoot any issues or monitor the server performance.

To run the tool, you need to log on to the server as an administrator and launch the program from the Start menu.

The tool will analyze the server components and display the results in a graphical interface, with green, yellow, or red lights indicating the health of each component.

You can also click on the Full Interface button to see more details and access the knowledge base articles for each component.

The tool can also be run remotely by taking action on the Troubleshoot: Execute Server Diagnostic task located in the BES Support site, but this requires the client to be installed on the server. References:

Running the BigFix Diagnostics tool

Running the IBM BigFix Diagnostics tool

Waiting for downloads to be mirrored - BigFix Forum

BigFix Wiki - BES Client Diagnostics

The Four Eyes Approval feature is a security mechanism that requires the approval of another console operator who is a member of a specified role before an action can be executed. This feature is useful for preventing unauthorized or accidental actions that could affect the endpoints in the BigFix deployment. To enable this feature, you need to follow these steps:

Use the BigFix Administration Tool to add the useFourEyesAuthentication advanced option and set its value to true.

Restart the BES Root Server service and the BigFix Console.

Create a role for the approvers and add one or more operators to it.

Select the Actions Require Approval option for the operators who need to get approval for their actions and choose the approvers role from the drop-down list.

When an operator takes an action that requires approval, they will see a dialog box asking them to enter the credentials of an approver. The action will be pending until an approver logs in and approves it. References:

Four Eyes Approval Capability

Has anyone tried SAML Authentication with Four-Eyes authentication?

BigFix Platform Security Configuration Guide

When creating a scheduled activity in Web Reports, the Activity Actions box allows the user to specify what actions to take when the activity runs1.

The available options are:

Email: The user can choose to send the report or alert to one or more recipients via email. The user can also customize the subject line and the message body of the email. The user can also choose to include the output of the report, a link to the report, or a link to the archive in the email1.

Archive: The user can choose to save the report or alert in the Web Reports archive for later viewing or downloading. The user can also set the limits for the number of archives, the time duration of each archive, the disk space used by each archive, or the number of entries in each archive1.

Customized Executable: The user can choose to run a customized executable that is triggered when the activity runs. The executable must be located in the correct directory on the Web Reports server. The user can also pass some variable information to the executable, such as the activity name, the report file, or the activity creator1.

The user can select one or more of these options for each scheduled activity. For example, the user can email and archive the report, or email and run the executable, or archive and run the executable, or do all three1.

References:

1: Creating Scheduled Activities

According to the BigFix Platform documentation1, the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration. To configure a high scale Relay, you need to follow these steps2:

Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.

Set the _BESRelay_HTTPServer_MaxConnections setting to 2000 on the Relay.

Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.

Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount setting to 100000 on the Relay.

Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.

Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount setting to 100000 on the Relay.

Set the _BESRelay_Download_LimitBytesPerMinute setting to 0 on the Relay.

Set the _BESRelay_Download_LimitBytesPerMinutePerClient setting to 0 on the Relay.

Set the _BESRelay_Download_PreCacheStageDiskLimitMB setting to 100000 on the Relay.

Set the _BESRelay_Download_PreCacheStageDiskLimitPercent setting to 0 on the Relay.

Set the _BESRelay_Download_CacheLimitMB setting to 100000 on the Relay.

Set the _BESRelay_Download_CacheLimitPercent setting to 0 on the Relay.

Restart the Relay service after applying the settings. References:

Relay scalability

Configuring a high scale Relay

To create a patch policy, you need to follow these steps12:

On the Policies page, click Add Policy. The Add Policy page is displayed.

Provide the following information under Policy Criteria page: Policy Name, Site, Description, Custom Content Criteria, and External Content Criteria.

Click Next to configure the Pre-Patch and Post-Patch behaviour of the new policy.

Click Next to configure the Schedule for the new policy. You can set the Start Date, End Date, Frequency, and Execution Window for the policy deployment.

Click Next to select the Targets for the new policy. You can choose from Manual Selection, Automatic Group, or Relevance Expression.

Review the Summary of the new policy and click Save to activate it. References:

Patch Policy Overview

Create a Patch Policy