• Message Level Encryption (MLE) allows your Clients to encrypt upstream data using a combination of an RSA public/private key-pair and an AES session key1.
• When MLE is enabled, the BigFix Root server (or a decrypting Relay) needs to use the corresponding RSA private key to decrypt the AES session key, which is then used to decrypt the Client report1.
• This decryption process consumes CPU resources on the BigFix Root server, and the amount of CPU usage depends on the number of encrypted reports received and the key length used1.
• Therefore, the BigFix Root server requires additional CPU resources appropriate to the number of managed endpoints to process the encrypted reports1.
• The other options are incorrect because:
• 1: Message Level Encryption (MLE) Overview
• 2: [Enabling encryption on Relays]

• BigFix Clients use UDP (User Datagram Protocol) to automatically find their closest relay based on network hops12.
• UDP is a connectionless protocol that does not guarantee reliable delivery of packets, but is faster and more efficient than TCP (Transmission Control Protocol)3.
• BigFix Clients send UDP packets to the BigFix Server and all the BigFix Relays in their subnet, and wait for responses12.
• The BigFix Server and the BigFix Relays reply with UDP packets containing their relay information and the number of hops to reach them12.
• The BigFix Client compares the responses and selects the relay with the lowest number of hops as its closest relay12.
• If the BigFix Client does not receive any response within a timeout period, it assumes that there is no relay in its subnet and falls back to the BigFix Server12. References:
• Automatically assigning relays to existing clients
• Configuring BigFix for automatic Relay selection Blog
• UDP (User Datagram Protocol)

• The WebUI cache is used to improve the response time of the WebUI by storing and refreshing some data that requires complex calculations, such as the number of applicable devices or patches1.
• The cache refresh interval, also known as the cache Time To Live (TTL) value, determines how often the cached data is invalidated and updated1. The default value is 600 seconds (10 minutes)1.
• To change the cache refresh interval, you can use the client setting _WebUIAppEnv_CACHE_TTL and enter the desired interval in seconds1. The minimum value is 180 seconds (3 minutes)1.
• Increasing the cache refresh interval can reduce the impact on system resources, especially for large deployments and intensive patching activities1. However, it can also affect the freshness of the cached data1.
• Another setting that affects the WebUI caching is _WebUIAppEnv_CACHE_INTERVAL, which determines how often the WebUI checks for new data from the BigFix server1. The default value is 60 seconds1.
• Decreasing the cache interval can improve the responsiveness of the WebUI, but it can also increase the load on the BigFix server1. Therefore, you should balance the cache interval and the cache TTL values according to your needs and environment1.
• The other settings, _WebUIAppEnv_SP_QUEUE_CONCURRENT, _WebUIAppEnv_DATA_REFRESH_SECONDS, and _WebUIAppEnv_SITE_CACHE_SIZE, are not related to the WebUI cache refresh interval12.
• _WebUIAppEnv_SP_QUEUE_CONCURRENT limits the number of stored procedures that run simultaneously per app in the background that update cache values1. The default value is 51.
• _WebUIAppEnv_DATA_REFRESH_SECONDS determines how often the WebUI polls the BigFix server for new data2. The default value is 15 seconds2.
• _WebUIAppEnv_SITE_CACHE_SIZE specifies the maximum size of the site cache in megabytes2. The default value is 100 MB2.

References:

• Caching - HCL Product Documentation
• Server settings definitions - HCL Product Documentation

• The BES Client Usage Profiler is a tool that collects information about the client evaluation cycle, such as the average, maximum, and minimum duration, and the percentage of time spent on different tasks, such as action, api, archive, gather, etc.1
• To enable the BES Client Usage Profiler, you need to run the task 361 TROUBLESHOOTING: Enable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 1 and restart the client service.2
• After the task is completed, you can use the analysis 362 TROUBLESHOOTING: BES Client Usage Profiler to view the results of the profiler. This analysis will show you the evaluation cycle statistics and the breakdown of the time spent on each task.3
• You can use this information to identify any potential issues or bottlenecks in the client evaluation cycle, such as long action duration, high api percent, or excessive gather time. You can also compare the results with other clients or the average values to see if there are any anomalies or outliers.4
• To disable the BES Client Usage Profiler, you need to run the task 363 TROUBLESHOOTING: Disable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 0 and restart the client service.

References:

• 1: evaluation cycle | BigFix Developer
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_usage_profiler.html
• 3: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_usage_profiler_analysis.html
• 4: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056

A Top Level Relay is a relay that directly communicates with the BigFix Server and has other relays as its children. A Top Level Relay has no limit as to the number of relays they can manage, but it is recommended to have no more than 1000 relays per Top Level Relay for optimal performance. When designing a relay hierarchy, the BigFix Administrator should consider the following factors:

• The network bandwidth and latency between the relays and the server
• The number and size of the fixlets, actions, and reports that are exchanged between the relays and the server
• The CPU and memory resources of the relays and the server
• The relay affiliation and selection settings of the clients and the relays
• The encryption and decryption of the client reports by the relays and the server

References:

• Creating top-level decrypting relays
• Top-Level Relays - Platform - BigFix Forum
• Relay Health - BigFix
• Creating top-level decrypting relays - IBM

• An external site is a site that is created and maintained by HCL or a third-party vendor, and is subscribed by the BigFix administrator1. External sites provide content such as fixlets, tasks, analyses, and dashboards for various purposes, such as patching, compliance, inventory, and security1.
• The site properties for an external site in the Console show the following information2:
• Therefore, the correct answer is C. Description, as it is one of the information that is displayed in the site properties for an external site in the Console, along with Publisher and Current Version. The other options, A. Creator, B. Gather URL, and D. Created Date, are not correct, as they are either not shown or not relevant for the question. References:
• Sites
• Viewing site properties

• When installing the BigFix agent on a Windows endpoint, you can optionally include a pre-defined settings file in the same directory as the setup.exe file, to create custom settings for the Windows client at installation time, for example to assign the new client to a specific parent relay1.
• The name of this file must be clientsettings.cfg12. This file should contain one setting per line, in the format SETTING_NAME=SETTING_VALUE23.
• The other options are incorrect because:
• For more information on how to use the clientsettings.cfg file and what settings can be defined, see the following references. References:
• 1: Installing the Client using the .exe setup
• 2: Clientsettings.cfg question
• 3: Unix/Linux/Mac Client Deploy Tool

• BigFix Clients are the endpoints that run the BigFix Agent software and communicate with the BigFix Server or Relays.
• BigFix Clients periodically check for new content from the BigFix Server or Relays, such as Fixlets, Tasks, Actions, or Analyses.
• The default interval for checking new content is 15 minutes, but this can be configured by the BigFix Administrator.
• To reduce the network traffic and latency, BigFix also uses a notification mechanism to inform the BigFix Clients of new content as soon as possible.
• The notification mechanism uses the UDP protocol, which is a connectionless and lightweight protocol that does not require a handshake or acknowledgment.
• The BigFix Server or Relays send UDP packets to the BigFix Clients on port 52311, which is the default port for BigFix communication.
• The UDP packets do not contain any content, but only serve to notify the BigFix Clients that there is something new for them to gather.
• Upon receiving a UDP notification, the BigFix Client initiates a TCP connection to the BigFix Server or Relay to gather the new content over a secure and reliable channel.
• The UDP notification mechanism can be enabled or disabled by the BigFix Administrator, and it can also be configured to use different ports or multicast addresses. References:
• BigFix Architecture
• BigFix Client Settings
• BigFix Notification Guide

• If UDP is not allowed on a network segment, the BigFix clients on that segment will not receive the UDP notifications from the server or relay, and will rely on the default 45-minute polling interval to check for new actions.1
• To reduce the delay in receiving new actions, you can enable the client polling feature, which allows the clients to poll the server or relay more frequently for new commands.2
• To enable the client polling feature, you need to set two client settings on the target clients:2
• You can set these client settings either through the console or manually on the endpoint.4
• After setting these client settings, the clients will poll the server or relay at the specified interval and receive new actions faster.

References:

• 1: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Installation/c_sample_proxy_configurations.html
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#_BESClient_Comm_CommandPollEnable
• 3: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056
• 4: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#Making_a_configuration_setting

• A Non-Master operator can create a Retrieved Property by creating an Analysis, which is a collection of properties and relevance expressions that can be evaluated on a set of computers1.
• To create an Analysis, the operator needs to have the Create Custom Content permission and the Read permission on the site where the Analysis will be created2.
• To create an Analysis, the operator can follow these steps3:
• After creating the Analysis, the operator can activate it by right-clicking on it and choosing Activate from the context menu. The Analysis will then be evaluated on the computers that match the relevance expression and the property values will be reported to the server4.
• The operator can view the property values by selecting the Analysis from the Analyses list area in the Console and then selecting the Results tab. The property values will be displayed in the columns corresponding to the property names.
• The operator can also use the property values as filters, sorts, or targets in other Console features, such as computer listings, Fixlet actions, or Web Reports.

References:

• 1: What is an Analysis?
• 2: Creating an Analysis
• 3: Creating an Analysis
• 4: [Activating an Analysis]
• : [Viewing Analysis Results]
• : [Using Analysis Properties]

According to the BigFix Platform documentation1, the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration. To configure a high scale Relay, you need to follow these steps2:

• Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.
• Set the _BESRelay_HTTPServer_MaxConnections setting to 2000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinute setting to 0 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinutePerClient setting to 0 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitPercent setting to 0 on the Relay.
• Set the _BESRelay_Download_CacheLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_CacheLimitPercent setting to 0 on the Relay.
• Restart the Relay service after applying the settings. References:
• Relay scalability
• Configuring a high scale Relay

• Command polling is a feature that allows BigFix Clients to poll their parent Relay or Server for UDP commands they may have missed, such as actions or refreshes. This is useful for Clients that cannot receive UDP notifications due to network or firewall restrictions.
• Command polling interval is a setting that determines how frequently the Clients will perform command polling. The default value is 900 seconds (15 minutes), which means that the Clients will check for new commands every 15 minutes.
• Setting the command polling interval to less than 900 seconds should be avoided to prevent performance issues, as it may cause excessive load on the BigFix Server, the Relays, and the database. It may also increase the network traffic and the CPU usage of the Clients.
• According to the documentation, setting the command polling interval to less than 20 minutes may cause performance issues and is not recommended1. A fixlet that enables command polling also warns that setting the polling interval to less than 900 seconds may cause performance issues2.
• Therefore, the answer is B. Less than 900 seconds. The other options (A, C, and D) are not correct, as they are either equal to or greater than the default value of 900 seconds, and thus do not pose a significant risk of performance degradation. References:
• Configuring FillDB
• Fixlet | BES Client Setting: Enable Command Polling

• The license.pvk file is the private key file that is part of the BigFix license. It is protected by a password that is set during the installation of the BigFix server.
• The license.pvk file is used to authenticate the BigFix Master Operators, who are the highest level of authority in the BigFix hierarchy. They can perform any action on any computer or site in the BigFix deployment.
• The license.pvk file is also used to sign the masthead file, which contains the configuration settings and the public key for the BigFix deployment. The masthead file isdistributed to all BigFix components, such as clients, relays, and consoles, to verify the identity and authority of the BigFix server.
• The license.pvk file is not used to authenticate the BigFix Site Administrator, who is a special Master Operator that can manage the license and the masthead files. The Site Administrator uses the site admin password to access the license.pvk file and perform license-related tasks.
• The license.pvk file is not used to authenticate the BigFix local operators, who are the lower level of authority in the BigFix hierarchy. They can only perform actions on the computers and sites that are assigned to them by the Master Operators. The local operators use their username and password to log in to the BigFix console.
• The license.pvk file is not used to authenticate the BigFix LDAP operators, who are the local operators that are authenticated by an external LDAP server. They use their LDAP credentials to log in to the BigFix console. References:
• Managing licenses
• Missing or Lost license.pvk file
• Check private key password - license.pvk

• Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.
• Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.
• Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.
• To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.
• Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.
• Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.
• Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potentialsynchronization issues, so it should be done with caution and proper planning. References:
• Introducing Baselines
• Creating or Customizing Baselines
• Baselines

To create a patch policy, you need to follow these steps12:

• On the Policies page, click Add Policy. The Add Policy page is displayed.
• Provide the following information under Policy Criteria page: Policy Name, Site, Description, Custom Content Criteria, and External Content Criteria.
• Click Next to configure the Pre-Patch and Post-Patch behaviour of the new policy.
• Click Next to configure the Schedule for the new policy. You can set the Start Date, End Date, Frequency, and Execution Window for the policy deployment.
• Click Next to select the Targets for the new policy. You can choose from Manual Selection, Automatic Group, or Relevance Expression.
• Review the Summary of the new policy and click Save to activate it. References:
• Patch Policy Overview
• Create a Patch Policy