Pass the HCL Software Academy HCLSoftware U Certified Professional HCL-BF-PRO-10 Questions and answers with CertsForce

According to the BigFix Platform documentation, the Site Administrator is responsible for installing and maintaining the BigFix software, and to run administrative tasks that globally affect the environment such as site-level signing keys management. There is only one Site Administrator for a BigFix environment1.

Some of the global system options that the Site Administrator can set and modify are:

The default masthead file and license certificate

The default site subscription policy

The default client settings

The default relay settings

The default server settings

The default Web Reports settings

The default WebUI settings

The default LDAP settings

The default SAML settings

The default audit log settings

The default DSA settings

The default proxy settings

The default encryption settings

The default caching settings

The default logging settings

The default performance settings

The default security settings

The default diagnostic settings

To set and modify these global system options, the Site Administrator must use the BigFix Administration Tool, which is a separate application from the BigFix Console. The Site Administrator must also have the Action Site Credentials, which are a special key generated during the installation process.

The other options (A, B, and D) are not exclusive to the Site Administrator, and can be performed by other Console Operators, depending on their permissions and roles.

References:

BigFix Site Administrator and Console Operators

Site administrator responsibilities

Global system options

[BigFix Administration Tool]

Starting from V9.5.6, the relay diagnostics page is disabled by default and can be protected by a password when enabled.

To enable the relay diagnostics page, you need to set the client setting _BESRelay_Diagnostics_Enable to a value of 1 on the relay computer. You can do this using the BigFix Console, the registry editor, or a custom fixlet or task.

To protect the relay diagnostics page with a password, you need to assign a value to the _BESRelay_Diagnostics_Password client setting on the relay computer. You can do this using the same methods as above.

After setting the _BESRelay_Diagnostics_Password, the URL to the relay diagnostics page must use the https protocol instead of http, otherwise the browser will show the “403 forbidden” error and the relay diagnostics page will not display.

To access the relay diagnostics page, open a browser and type in the address field: https:// :52311/rd or https:// :52311/RelayDiagnostics, where is the address of the workstation where the relay that you want to check is installed. You will be prompted to enter the password that you set for the _BESRelay_Diagnostics_Password client setting.

On the relay diagnostics page, you can gather information about your environment settings, relay status, console user authorization, site gathering, and client registration. References:

Relay and Server diagnostics

How can I enable _BESRelay_Diagnostics_Enable" = “1”

Relay diagnostics

The BES Client Usage Profiler is a tool that collects information about the client evaluation cycle, such as the average, maximum, and minimum duration, and the percentage of time spent on different tasks, such as action, api, archive, gather, etc.1

To enable the BES Client Usage Profiler, you need to run the task 361 TROUBLESHOOTING: Enable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 1 and restart the client service.2

After the task is completed, you can use the analysis 362 TROUBLESHOOTING: BES Client Usage Profiler to view the results of the profiler. This analysis will show you the evaluation cycle statistics and the breakdown of the time spent on each task.3

You can use this information to identify any potential issues or bottlenecks in the client evaluation cycle, such as long action duration, high api percent, or excessive gather time. You can also compare the results with other clients or the average values to see if there are any anomalies or outliers.4

To disable the BES Client Usage Profiler, you need to run the task 363 TROUBLESHOOTING: Disable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 0 and restart the client service.

References:

1: evaluation cycle | BigFix Developer

2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_usage_profiler.html

3: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_usage_profiler_analysis.html

4: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056

Domains are a major organizing principle in the BigFix Console that allow you to access and manage related sites, such as Patch Management, AntiVirus Management, Power Management, and so on.

Domains are not collections of Fixlet messages, but rather contain a set of related sites that have Fixlet messages, tasks, analyses, and other content. The content is created by HCL, other vendors, or yourself, depending on the site type and subscription.

Domains do not provide a way to deploy actions across the network, but rather help you to find and select the relevant content for your actions. You can still use the Action Wizard or the Take Action button to deploy actions from any domain or site.

Domains are located in the lower-left portion of the Console, where you can select the domain you want from the buttons at the bottom of the panel. The contents of the domain are then displayed in the upper-right panel, where you can filter and sort them by various criteria.

Domains are not located under Tools in the Console, but rather under the Sites node in the navigation tree. You can also access the Manage Domains dialog from the Tools menu, where you can create, edit, or delete domains. References:

Domains

Introducing Domains

Manage Domains

To create an Automatic Computer Group, you need to use a Relevance expression that evaluates to true or false for each computer in your deployment12.

The Relevance expression should check two conditions: the operating system is Windows 10 and a user is signed in.

To check the operating system, you can use the name of operating system property, which returns a string like “Win10” or “Win7” for Windows computers3. You can use the contains operator to see if the string contains “Win10”.

To check the user status, you can use the logged on user property, which returns the name of the current user or an empty string if no user is logged on4. You can use the exists or not operators to see if the property has a value or not.

You can use the and operator to combine the two conditions into one Relevance expression.

The correct answer is D, which checks if the name of operating system contains “Win10” and if the logged on user exists.

The other options are incorrect because:

A uses the windows 10 of operating system property, which does not exist3.

B uses the logged on user property without checking if it has a value or not, which could return false for computers where a user is logged on but the property is empty4.

C uses the version of windows property, which returns a version object like “10.0.19042” for Windows 10 computers3. You cannot use the starts with operator with a version object, you need to use the as string cast first5. References:

1: Create Automatic Computer Group

2: Create Automatic Computer Group

3: Operating System Inspector

4: Logged On User Inspector

5: [Version Inspector]

The Site Administrator key is a private key that is used to perform site-level tasks such as setting global system options, editing mastheads, and administering Distributed Server Architecture (DSA)1.

The Site Administrator key is generated during the installation of the BigFix Server, when the site administrator is prompted to enter a password to encrypt the key2.

The Site Administrator key is stored in a file named license.pvk in the BigFix Enterprise\BES Server folder on the BigFix Server3.

The Site Administrator key is required to run the BESAdmin.exe tool, which is used to manage the BigFix Server configuration and settings.

The Site Administrator key is also required to create the masthead file, which is a file that contains the digital signature and configuration information of the BigFix deployment.

The Site Administrator key is different from the Master Operator key, which is used to access the BigFix Console and create other operators.

References:

1: The Site Administrator

2: Admin site key for installation

3: Site administrator responsibilities

: Using the BESAdmin Tool

: Creating the Masthead

: BigFix Site Administrator and Console Operators

A BigFix Relay is a special type of BigFix Client that can cache and distribute files to other BigFix Clients, reducing the workload and bandwidth usage of the BigFix Server1.

A BigFix Relay can be installed on any BigFix Client that runs on a supported BigFix Relay operating system, which includes Windows, Linux, and Solaris23.

A BigFix Relay does not require a server operating system or a dedicated endpoint, as long as it meets the minimum system requirements and recommendations for a relay, which are similar to those for a workgroup file server23.

A BigFix Relay must have a two-way TCP connection to its parent, which can be another relay or the BigFix Server23.

A BigFix Relay can be installed using a Fixlet from the BigFix Console or the command line4. References:

1: Relays and Servers

2: Relay requirements and recommendations

3: Relay requirements

4: Installing a relay

The WebUI is a web-based interface that provides access to the flexibility and power of BigFix.

The WebUI has some upper use limits that depend on many factors, such as the number of endpoints, the workload, the time of day, the server location, and the number of concurrent users.

Concurrent users are defined as highly active users who perform multiple actions per minute on the WebUI.

According to the BigFix Capacity Planning Guide, both the Windows and Linux WebUI instances support 36 concurrent users on a 250k deployment base. This is the recommended scalability limit for the WebUI server on BigFix v10.x.

The WebUI also requires additional hardware resources, such as CPU, memory, and storage, to power the WebUI. These resources are in addition to the BigFix root server requirements and depend on the number of concurrent users.

The WebUI also implements a database cache for several counters to improve the WebUI response times. The cache has a default refresh interval of 10 minutes. References:

Hardware Requirements

WebUI Administrators Guide

BigFix WebUI

The Four Eyes Approval feature is a security mechanism that requires the approval of another console operator who is a member of a specified role before an action can be executed. This feature is useful for preventing unauthorized or accidental actions that could affect the endpoints in the BigFix deployment. To enable this feature, you need to follow these steps:

Use the BigFix Administration Tool to add the useFourEyesAuthentication advanced option and set its value to true.

Restart the BES Root Server service and the BigFix Console.

Create a role for the approvers and add one or more operators to it.

Select the Actions Require Approval option for the operators who need to get approval for their actions and choose the approvers role from the drop-down list.

When an operator takes an action that requires approval, they will see a dialog box asking them to enter the credentials of an approver. The action will be pending until an approver logs in and approves it. References:

Four Eyes Approval Capability

Has anyone tried SAML Authentication with Four-Eyes authentication?

BigFix Platform Security Configuration Guide