HCL BigFix Platform 11 Administrator Practice Exam ;
Practice Questions with Answers & Explanations - Complete
Exam. - 108 Questions
Section 1: BigFix Architecture and Components (Questions 1-10)
1 In a geographically distributed BigFix deployment with over 50,000 endpoints, a senior administrator notices
that the root server's database experiences high I/O latency during the daily relevance evaluation cycle. Which
architectural change would most effectively reduce the load on the root server's database without compromising
the integrity of the deployment?
A) Increase the number of relays and configure them to cache fixlet relevance results locally.
B) Implement a Web Reports database on a separate server and offload all reporting queries to it.
C) Enable the 'Distributed Relevance Evaluation' feature to offload evaluation to relays.
D) Deploy an additional root server in a different data center and use a load balancer.
Answer: B
Rationale: The Web Reports database is a separate database instance that stores historical and reporting data.
Offloading reporting queries to it reduces the load on the main action database. Option A (relay caching) does not
reduce database load; relays do not process relevance evaluation. Option C is not a standard BigFix feature. Option
D adds complexity and does not directly reduce database I/O.
2 A BigFix administrator configures a relay hierarchy with three levels: root server, intermediate relay, and leaf
relay. The leaf relay serves 2,000 clients. During a major patch deployment, the leaf relay experiences high CPU
usage and delayed content distribution. Which of the following actions would most effectively mitigate this
bottleneck?
A) Increase the number of leaf relays and redistribute clients evenly.
B) Configure the leaf relay to use a faster internet connection to the root server.
C) Enable multicast distribution on the leaf relay's subnet.
D) Reduce the 'RefreshRate' setting on the leaf relay to 60 seconds.
Answer: A
Rationale: Adding more leaf relays and distributing clients reduces the load per relay. Option B (faster connection)
may help but does not address CPU-bound processing. Option C (multicast) is not supported for BigFix content
distribution. Option D (faster refresh) would increase CPU load, not reduce it.
3 A security auditor requires that all communication between BigFix clients and the root server be encrypted and
authenticated using certificates. Currently, the deployment uses self-signed certificates for the root server and
relays. Which of the following configurations ensures the highest level of security while maintaining operational
efficiency?
A) Replace all self-signed certificates with certificates signed by a public Certificate Authority and enforce TLS
1.2 on all components.
B) Import the root server's self-signed certificate into the Trusted Root Store of each client using a custom fixlet.
C) Configure the root server to use a hardware security module (HSM) for key storage and disable relay
encryption.
D) Enable mutual TLS authentication between clients and relays only, leaving root server communication
unencrypted.
,Answer: A
Rationale: Using CA-signed certificates and enforcing TLS 1.2 provides strong encryption and authentication.
Option B (importing self-signed) is less secure as it lacks third-party validation. Option C (HSM) is overkill and
disabling relay encryption is insecure. Option D (mutual TLS only on relays) leaves root server communication
vulnerable.
4 During a BigFix version upgrade from 10.x to 11.x, an administrator observes that the 'BigFix Server' service
fails to start. The error log indicates a failure to connect to the 'BESRootServer' database. The database server is
running and network connectivity is verified. Which of the following is the most likely cause?
A) The database driver (ODBC) is incompatible with the new version.
B) The database schema has not been upgraded to match the new server version.
C) The service account used by the BigFix Server lacks 'db_owner' permissions on the database.
D) The 'BESRootServer' database is in single-user mode.
Answer: B
Rationale: Upgrading BigFix requires a schema upgrade; if the schema is not upgraded, the server cannot connect.
Option A (driver incompatibility) is possible but less common; drivers are typically backward-compatible. Option
C (permissions) would cause a different error. Option D (single-user mode) is unlikely in a production
environment.
5 In a multi-site BigFix deployment, each site has its own root server and relays. The administrator needs to
ensure that fixlets created at one site can be deployed to clients at another site without manual intervention.
Which architecture component should be configured to enable this cross-site replication?
A) Configure a global relay that bridges the two sites.
B) Establish a VPN tunnel between the sites and enable 'Site Replication' in the BES Admin console.
C) Use the 'External Site' feature to import fixlets from one site into the other's masthead.
D) Deploy a 'Global Console' that connects to both root servers simultaneously.
Answer: C
Rationale: The 'External Site' feature allows a BigFix server to subscribe to and retrieve fixlets from another BigFix
server's site. Option A (global relay) does not replicate fixlets. Option B (VPN + Site Replication) is not a standard
BigFix feature. Option D (Global Console) would provide visibility but not automatic replication.
6 A BigFix environment experiences intermittent client communication failures. Logs show that clients are unable
to retrieve the 'BES Client' settings from the root server. The root server's 'BESRootServer' service is running,
and the firewall allows port 52311. Which of the following is the most likely cause?
A) The 'BESRelay' service on the root server is not running.
B) The 'BESClient' service on the root server is disabled.
C) The 'BES Web Reports' service is consuming all available CPU resources.
D) The 'BES Gather' service has not completed its initial scan.
Answer: A
Rationale: Clients retrieve settings via relays; the root server also runs a relay service. If the BESRelay service is not
running on the root server, clients cannot connect. Option B (BESClient) is not required on the server. Option C
(Web Reports) is separate. Option D (Gather) is for collecting client data, not serving settings.
7 An administrator wants to minimize the bandwidth usage of BigFix traffic over a WAN link connecting two
offices. The root server is in Office A, and Office B has 500 clients. Which of the following configurations
would be most effective?
,A) Deploy a relay in Office B and configure clients to use it, then set the relay's 'DownloadMode' to
'Background'.
B) Enable compression on the BigFix server's 'BESRootServer' service.
C) Configure clients to use a 'Peer-to-Peer' distribution model within Office B.
D) Set the 'MaxDownloadRate' on the root server to 100 Kbps.
Answer: A
Rationale: A relay in Office B caches content locally, reducing WAN traffic. 'DownloadMode' to 'Background'
ensures downloads occur during off-peak hours. Option B (compression) is not configurable on the server. Option
C (P2P) is not a native BigFix feature. Option D (rate limiting) does not reduce total bandwidth, only throttles it.
8 During a security incident, an administrator needs to immediately revoke the trust of a compromised relay.
Which of the following actions will prevent the relay from serving any content to clients?
A) Delete the relay's computer record from the BES Admin console.
B) Block the relay's IP address in the firewall.
C) Revoke the relay's certificate in the BigFix server's certificate store.
D) Set the relay's 'OperationalStatus' to 'Disabled' in the BES Relay settings.
Answer: C
Rationale: Revoking the relay's certificate invalidates its authentication, causing clients to reject its communications.
Option A (deleting record) does not affect existing connections immediately. Option B (firewall) is external and
may not be sufficient if the relay is inside the network. Option D (OperationalStatus) disables the relay but does not
revoke trust; clients might still accept cached content.
9 A BigFix environment has a single root server and 10 relays. The administrator wants to ensure that if the root
server fails, clients can still receive critical patches from relays. Which of the following components should be
configured?
A) Enable 'Failover' on each relay to point to a secondary root server.
B) Configure a 'Standby Root Server' that replicates the primary server's database.
C) Use 'Distributed Content' to pre-stage patches on relays.
D) Set 'ClientAutonomousMode' to 'Enabled' on all clients.
Answer: C
Rationale: Distributed Content allows relays to cache content independently of the root server. If the root server
fails, relays can still serve cached content. Option A (Failover) requires a secondary root server. Option B
(Standby) is complex and not standard. Option D (ClientAutonomousMode) allows clients to act autonomously but
does not ensure content availability.
10 An administrator notices that the 'BES Gather' service on the root server is taking longer than usual to complete
its cycle. Which of the following factors is most likely to cause this delay?
A) A large number of clients have been newly added and are reporting for the first time.
B) The 'BESRootServer' database is configured with the 'Simple' recovery model.
C) The 'BESRelay' service is experiencing high latency due to network congestion.
D) The 'BES Client' service on the root server is set to 'Manual' startup.
Answer: A
Rationale: The Gather service collects data from clients; new clients increase the volume of data to process,
extending the cycle. Option B (Simple recovery) improves performance, not delays it. Option C (relay latency)
affects client communication but not the Gather service directly. Option D (Client service on root server) is
irrelevant.
, Section 2: Installation and Configuration (Questions 11-25)
11 During the installation of a BigFix root server on a Windows Server 2019 machine, the installer fails to create
the required service account. The account will be used to run the BigFix Server service with minimal
privileges. Which of the following actions should the administrator take to ensure a successful installation?
A) Create a local user account manually and assign it the 'Log on as a service' right.
B) Use the built-in NetworkService account instead of a custom service account.
C) Install the server using the LocalSystem account and later change to a custom account.
D) Grant the custom account domain admin rights temporarily during installation.
Answer: A
Rationale: The BigFix installer requires a service account with the 'Log on as a service' right. If the installer fails to
create it, the administrator should create the account manually and assign this right. Using NetworkService (B) is
not recommended for security and performance reasons. LocalSystem (C) has excessive privileges and should be
avoided. Domain admin rights (D) are unnecessary and violate least privilege.
12 An administrator is configuring a BigFix relay on a Linux server that must support 5,000 clients. The relay's
database is SQLite. Which of the following is the most critical configuration parameter to adjust to prevent
performance degradation?
A) Increase the number of worker threads in the relay's config file.
B) Set the SQLite cache size to at least 20000 pages.
C) Disable SSL termination at the relay to reduce CPU load.
D) Reduce the client polling interval to 15 minutes.
Answer: B
Rationale: SQLite performance heavily depends on cache size. For a relay with 5000 clients, increasing cache size
reduces disk I/O. Worker threads (A) help but are secondary to database tuning. Disabling SSL (C) compromises
security. Reducing polling interval (D) increases load, not reduces it.
13 In a distributed BigFix environment, the root server is installed in the DMZ, and internal relays are behind a
firewall. The administrator must ensure that the root server can communicate with the relays on the default
port. Which firewall rule is required?
A) Allow inbound TCP port 52311 from relays to the root server.
B) Allow outbound TCP port 52311 from the root server to relays.
C) Allow inbound TCP port 80 from relays to the root server.
D) Allow outbound UDP port 52311 from the root server to relays.
Answer: A
Rationale: BigFix relays connect to the root server using TCP port 52311 (the default for the BigFix Server service).
The root server must accept inbound connections from relays. Outbound rules (B) are not needed for relays to
initiate. Port 80 (C) is for HTTP, not the BigFix protocol. UDP (D) is not used for this communication.
14 An administrator is configuring SSL for a BigFix root server. The certificate is issued by an internal CA, and
the server's hostname is 'bigfix.example.com'. After importing the certificate into the BigFix server's certificate
store, clients report a certificate name mismatch error. What is the most likely cause?
A) The certificate's Subject Alternative Name (SAN) does not include 'bigfix.example.com'.
B) The certificate is not trusted by the clients' root CA store.
C) The certificate was imported into the Windows certificate store instead of the BigFix store.
D) The BigFix server service needs to be restarted after importing the certificate.
Answer: A
Practice Questions with Answers & Explanations - Complete
Exam. - 108 Questions
Section 1: BigFix Architecture and Components (Questions 1-10)
1 In a geographically distributed BigFix deployment with over 50,000 endpoints, a senior administrator notices
that the root server's database experiences high I/O latency during the daily relevance evaluation cycle. Which
architectural change would most effectively reduce the load on the root server's database without compromising
the integrity of the deployment?
A) Increase the number of relays and configure them to cache fixlet relevance results locally.
B) Implement a Web Reports database on a separate server and offload all reporting queries to it.
C) Enable the 'Distributed Relevance Evaluation' feature to offload evaluation to relays.
D) Deploy an additional root server in a different data center and use a load balancer.
Answer: B
Rationale: The Web Reports database is a separate database instance that stores historical and reporting data.
Offloading reporting queries to it reduces the load on the main action database. Option A (relay caching) does not
reduce database load; relays do not process relevance evaluation. Option C is not a standard BigFix feature. Option
D adds complexity and does not directly reduce database I/O.
2 A BigFix administrator configures a relay hierarchy with three levels: root server, intermediate relay, and leaf
relay. The leaf relay serves 2,000 clients. During a major patch deployment, the leaf relay experiences high CPU
usage and delayed content distribution. Which of the following actions would most effectively mitigate this
bottleneck?
A) Increase the number of leaf relays and redistribute clients evenly.
B) Configure the leaf relay to use a faster internet connection to the root server.
C) Enable multicast distribution on the leaf relay's subnet.
D) Reduce the 'RefreshRate' setting on the leaf relay to 60 seconds.
Answer: A
Rationale: Adding more leaf relays and distributing clients reduces the load per relay. Option B (faster connection)
may help but does not address CPU-bound processing. Option C (multicast) is not supported for BigFix content
distribution. Option D (faster refresh) would increase CPU load, not reduce it.
3 A security auditor requires that all communication between BigFix clients and the root server be encrypted and
authenticated using certificates. Currently, the deployment uses self-signed certificates for the root server and
relays. Which of the following configurations ensures the highest level of security while maintaining operational
efficiency?
A) Replace all self-signed certificates with certificates signed by a public Certificate Authority and enforce TLS
1.2 on all components.
B) Import the root server's self-signed certificate into the Trusted Root Store of each client using a custom fixlet.
C) Configure the root server to use a hardware security module (HSM) for key storage and disable relay
encryption.
D) Enable mutual TLS authentication between clients and relays only, leaving root server communication
unencrypted.
,Answer: A
Rationale: Using CA-signed certificates and enforcing TLS 1.2 provides strong encryption and authentication.
Option B (importing self-signed) is less secure as it lacks third-party validation. Option C (HSM) is overkill and
disabling relay encryption is insecure. Option D (mutual TLS only on relays) leaves root server communication
vulnerable.
4 During a BigFix version upgrade from 10.x to 11.x, an administrator observes that the 'BigFix Server' service
fails to start. The error log indicates a failure to connect to the 'BESRootServer' database. The database server is
running and network connectivity is verified. Which of the following is the most likely cause?
A) The database driver (ODBC) is incompatible with the new version.
B) The database schema has not been upgraded to match the new server version.
C) The service account used by the BigFix Server lacks 'db_owner' permissions on the database.
D) The 'BESRootServer' database is in single-user mode.
Answer: B
Rationale: Upgrading BigFix requires a schema upgrade; if the schema is not upgraded, the server cannot connect.
Option A (driver incompatibility) is possible but less common; drivers are typically backward-compatible. Option
C (permissions) would cause a different error. Option D (single-user mode) is unlikely in a production
environment.
5 In a multi-site BigFix deployment, each site has its own root server and relays. The administrator needs to
ensure that fixlets created at one site can be deployed to clients at another site without manual intervention.
Which architecture component should be configured to enable this cross-site replication?
A) Configure a global relay that bridges the two sites.
B) Establish a VPN tunnel between the sites and enable 'Site Replication' in the BES Admin console.
C) Use the 'External Site' feature to import fixlets from one site into the other's masthead.
D) Deploy a 'Global Console' that connects to both root servers simultaneously.
Answer: C
Rationale: The 'External Site' feature allows a BigFix server to subscribe to and retrieve fixlets from another BigFix
server's site. Option A (global relay) does not replicate fixlets. Option B (VPN + Site Replication) is not a standard
BigFix feature. Option D (Global Console) would provide visibility but not automatic replication.
6 A BigFix environment experiences intermittent client communication failures. Logs show that clients are unable
to retrieve the 'BES Client' settings from the root server. The root server's 'BESRootServer' service is running,
and the firewall allows port 52311. Which of the following is the most likely cause?
A) The 'BESRelay' service on the root server is not running.
B) The 'BESClient' service on the root server is disabled.
C) The 'BES Web Reports' service is consuming all available CPU resources.
D) The 'BES Gather' service has not completed its initial scan.
Answer: A
Rationale: Clients retrieve settings via relays; the root server also runs a relay service. If the BESRelay service is not
running on the root server, clients cannot connect. Option B (BESClient) is not required on the server. Option C
(Web Reports) is separate. Option D (Gather) is for collecting client data, not serving settings.
7 An administrator wants to minimize the bandwidth usage of BigFix traffic over a WAN link connecting two
offices. The root server is in Office A, and Office B has 500 clients. Which of the following configurations
would be most effective?
,A) Deploy a relay in Office B and configure clients to use it, then set the relay's 'DownloadMode' to
'Background'.
B) Enable compression on the BigFix server's 'BESRootServer' service.
C) Configure clients to use a 'Peer-to-Peer' distribution model within Office B.
D) Set the 'MaxDownloadRate' on the root server to 100 Kbps.
Answer: A
Rationale: A relay in Office B caches content locally, reducing WAN traffic. 'DownloadMode' to 'Background'
ensures downloads occur during off-peak hours. Option B (compression) is not configurable on the server. Option
C (P2P) is not a native BigFix feature. Option D (rate limiting) does not reduce total bandwidth, only throttles it.
8 During a security incident, an administrator needs to immediately revoke the trust of a compromised relay.
Which of the following actions will prevent the relay from serving any content to clients?
A) Delete the relay's computer record from the BES Admin console.
B) Block the relay's IP address in the firewall.
C) Revoke the relay's certificate in the BigFix server's certificate store.
D) Set the relay's 'OperationalStatus' to 'Disabled' in the BES Relay settings.
Answer: C
Rationale: Revoking the relay's certificate invalidates its authentication, causing clients to reject its communications.
Option A (deleting record) does not affect existing connections immediately. Option B (firewall) is external and
may not be sufficient if the relay is inside the network. Option D (OperationalStatus) disables the relay but does not
revoke trust; clients might still accept cached content.
9 A BigFix environment has a single root server and 10 relays. The administrator wants to ensure that if the root
server fails, clients can still receive critical patches from relays. Which of the following components should be
configured?
A) Enable 'Failover' on each relay to point to a secondary root server.
B) Configure a 'Standby Root Server' that replicates the primary server's database.
C) Use 'Distributed Content' to pre-stage patches on relays.
D) Set 'ClientAutonomousMode' to 'Enabled' on all clients.
Answer: C
Rationale: Distributed Content allows relays to cache content independently of the root server. If the root server
fails, relays can still serve cached content. Option A (Failover) requires a secondary root server. Option B
(Standby) is complex and not standard. Option D (ClientAutonomousMode) allows clients to act autonomously but
does not ensure content availability.
10 An administrator notices that the 'BES Gather' service on the root server is taking longer than usual to complete
its cycle. Which of the following factors is most likely to cause this delay?
A) A large number of clients have been newly added and are reporting for the first time.
B) The 'BESRootServer' database is configured with the 'Simple' recovery model.
C) The 'BESRelay' service is experiencing high latency due to network congestion.
D) The 'BES Client' service on the root server is set to 'Manual' startup.
Answer: A
Rationale: The Gather service collects data from clients; new clients increase the volume of data to process,
extending the cycle. Option B (Simple recovery) improves performance, not delays it. Option C (relay latency)
affects client communication but not the Gather service directly. Option D (Client service on root server) is
irrelevant.
, Section 2: Installation and Configuration (Questions 11-25)
11 During the installation of a BigFix root server on a Windows Server 2019 machine, the installer fails to create
the required service account. The account will be used to run the BigFix Server service with minimal
privileges. Which of the following actions should the administrator take to ensure a successful installation?
A) Create a local user account manually and assign it the 'Log on as a service' right.
B) Use the built-in NetworkService account instead of a custom service account.
C) Install the server using the LocalSystem account and later change to a custom account.
D) Grant the custom account domain admin rights temporarily during installation.
Answer: A
Rationale: The BigFix installer requires a service account with the 'Log on as a service' right. If the installer fails to
create it, the administrator should create the account manually and assign this right. Using NetworkService (B) is
not recommended for security and performance reasons. LocalSystem (C) has excessive privileges and should be
avoided. Domain admin rights (D) are unnecessary and violate least privilege.
12 An administrator is configuring a BigFix relay on a Linux server that must support 5,000 clients. The relay's
database is SQLite. Which of the following is the most critical configuration parameter to adjust to prevent
performance degradation?
A) Increase the number of worker threads in the relay's config file.
B) Set the SQLite cache size to at least 20000 pages.
C) Disable SSL termination at the relay to reduce CPU load.
D) Reduce the client polling interval to 15 minutes.
Answer: B
Rationale: SQLite performance heavily depends on cache size. For a relay with 5000 clients, increasing cache size
reduces disk I/O. Worker threads (A) help but are secondary to database tuning. Disabling SSL (C) compromises
security. Reducing polling interval (D) increases load, not reduces it.
13 In a distributed BigFix environment, the root server is installed in the DMZ, and internal relays are behind a
firewall. The administrator must ensure that the root server can communicate with the relays on the default
port. Which firewall rule is required?
A) Allow inbound TCP port 52311 from relays to the root server.
B) Allow outbound TCP port 52311 from the root server to relays.
C) Allow inbound TCP port 80 from relays to the root server.
D) Allow outbound UDP port 52311 from the root server to relays.
Answer: A
Rationale: BigFix relays connect to the root server using TCP port 52311 (the default for the BigFix Server service).
The root server must accept inbound connections from relays. Outbound rules (B) are not needed for relays to
initiate. Port 80 (C) is for HTTP, not the BigFix protocol. UDP (D) is not used for this communication.
14 An administrator is configuring SSL for a BigFix root server. The certificate is issued by an internal CA, and
the server's hostname is 'bigfix.example.com'. After importing the certificate into the BigFix server's certificate
store, clients report a certificate name mismatch error. What is the most likely cause?
A) The certificate's Subject Alternative Name (SAN) does not include 'bigfix.example.com'.
B) The certificate is not trusted by the clients' root CA store.
C) The certificate was imported into the Windows certificate store instead of the BigFix store.
D) The BigFix server service needs to be restarted after importing the certificate.
Answer: A
