A Non-Master operator can create a Retrieved Property by creating an Analysis, which is a collection of properties and relevance expressions that can be evaluated on a set of computers 1 .

To create an Analysis, the operator needs to have the  Create Custom Content  permission and the  Read  permission on the site where the Analysis will be created 2 .

To create an Analysis, the operator can follow these steps 3 :

Choose  Tools > Create New Analysis . The Create Analysis dialog is displayed.

Type in the name and description of the Analysis and select the site where it will be stored.

Click the  Properties  tab and then click the  Add Property  button. The Add Property dialog is displayed.

Type in the name of the new Retrieved Property and create a Relevance Expression to evaluate. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.

Optionally, select the  Reported in  option and specify how often the property value should be reported to the server.

Click the  OK  button to add the property to the Analysis.

Repeat steps 3 to 6 to add more properties if needed.

Click the  Relevance  tab and then click the  Edit  button. The Relevance Expression dialog is displayed.

Type in or edit the relevance expression that defines the applicability of the Analysis to the computers. This can be based on operating system, installed software, or any other criteria.

Click the  OK  button to save the relevance expression.

Click the  OK  button to create the Analysis.

After creating the Analysis, the operator can activate it by right-clicking on it and choosing  Activate  from the context menu.  The Analysis will then be evaluated on the computers that match the relevance expression and the property values will be reported to the server 4 .

The operator can view the property values by selecting the Analysis from the  Analyses  list area in the Console and then selecting the  Results  tab. The property values will be displayed in the columns corresponding to the property names.

The operator can also use the property values as filters, sorts, or targets in other Console features, such as computer listings, Fixlet actions, or Web Reports.

References:

1 :  What is an Analysis?

2 :  Creating an Analysis

3 :  Creating an Analysis

4 : [Activating an Analysis]

: [Viewing Analysis Results]

: [Using Analysis Properties]

When installing the BigFix agent on a Windows endpoint, you can optionally include a pre-defined settings file in the same directory as the setup.exe file, to create custom settings for the Windows client at installation time, for example to assign the new client to a specific parent relay 1 .

The name of this file must be  clientsettings.cfg 1 2 .  This file should contain one setting per line, in the format  SETTING_NAME=SETTING_VALUE 2 3 .

The other options are incorrect because:

A, C, and D are not valid names for the settings file.  The BigFix agent will ignore them and use the default settings instead 1 2 .

For more information on how to use the clientsettings.cfg file and what settings can be defined, see the following references.  References:

1 :  Installing the Client using the .exe setup

2 :  Clientsettings.cfg question

3 :  Unix/Linux/Mac Client Deploy Tool

BigFix clients can download resources directly from the Internet instead of their parent relay by using the  download now  command in the action script 1 .  This command bypasses the relay hierarchy and requests the file from the URL specified in the action script 2 .

However, this command may not be suitable for all scenarios, as it may consume more bandwidth and increase the download time 2 .  Therefore, BigFix provides several settings to control the download behavior of the clients based on different criteria 3 .

One of these settings is  _BESClient_Download_Direct_SubnetList , which allows the clients to download resources directly from the Internet if they are on a specific subnet 4 .  This setting is useful for clients that are connected to the enterprise network through a VPN, as they may have a faster connection to the Internet than to their parent relay 4 .

To enable this setting, the clients need to have the following values in their configuration files 4 :

_BESClient_Download_Direct = 1

_BESClient_Download_DirectRecovery = 1

_BESClient_Download_Direct_SubnetList = list of subnets separated by semicolons

For example, if the clients are on the subnets 172.31.148.0/22, 172.31.152.0/22, 172.31.156.0/22, 172.31.160.0/24, 10.31.148.0/22, 10.31.152.0/22, 10.31.156.0/22, or 10.31.160.0/24, the setting value would be 4 :

_BESClient_Download_Direct_SubnetList = 172.31.148.0/22;172.31.152.0/22;172.31.156.0/22;172.31.160.0/24;10.31.148.0/22;10.31.152.0/22;10.31.156.0/22;10.31.160.0/24

The other settings, such as _BESClient_Download_DirectPatchList, _BESClient_Download_Direct_Domainlist, and _BESClient_Download_Direct_ByVendor, are used to download resources directly from the Internet based on the patch name, the domain name, or the vendor name, respectively 3 . These settings are not relevant for the question scenario, as they do not depend on the client’s network location.  References:

Configuration Settings

Managing Downloads

Download Commands

Setting creation to download the patch content Directlyy

To define password complexity criteria for local Web Reports users, you need to edit the  webreports.cfg  file located in the  C:\Program Files (x86)\BigFix Enterprise\BES Server\BESReportsServer\wwwroot\cgi-bin  directory. 1

In the  webreports.cfg  file, you can set the following parameters to customize the password complexity requirements: 2

passwordComplexity : Set to a regular expression that defines the password complexity requirement. For example,  (?=.*\d)(?=.*[a-z])(?=.*[A-Z] ).{8,}  means that the password must contain at least one digit, one lowercase letter, one uppercase letter, and be at least 8 characters long.

passwordComplexityDescription : Set to a human-readable string describing the password complexity requirement. This string will be shown to the user when a password choice fails the complexity requirements set using the  passwordComplexity  option. An example password complexity description is “Passwords must have at least 6 characters.”

passwordMinLength : Set to the minimum length of acceptable passwords. The default value is  6 .

passwordMaxLength : Set to the maximum length of acceptable passwords. The default value is  256 .

After editing the  webreports.cfg  file, you need to restart the Web Reports service for the changes to take effect. 1

References:

1 : https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Web_Reports/c_web_reports_config_file.html

2 : https://bigfix-wiki.hcltechsw.com/wikis/home?lang=en-us#!/wiki/BigFix%20Wiki/page/Console%20User%20Password%20Policies

Message Level Encryption (MLE) allows your Clients to encrypt upstream data using a combination of an RSA public/private key-pair and an AES session key 1 .

When MLE is enabled, the BigFix Root server (or a decrypting Relay) needs to use the corresponding RSA private key to decrypt the AES session key, which is then used to decrypt the Client report 1 .

This decryption process consumes CPU resources on the BigFix Root server, and the amount of CPU usage depends on the number of encrypted reports received and the key length used 1 .

Therefore, the BigFix Root server requires additional CPU resources appropriate to the number of managed endpoints to process the encrypted reports 1 .

The other options are incorrect because:

A is not relevant to the question, as it assumes that there are top-level Relays in the deployment. The question states that there are no top-level Relays, so all Relays are downstream from the BigFix Root server.  Moreover, the RAM requirement for Relays is not affected by MLE, as Relays do not perform any encryption or decryption by default 1 .

C is not necessary, as adding an additional NIC to the BigFix Root server does not affect the CPU load caused by the encrypted reports.  The network bandwidth requirement for MLE is not significantly higher than for clear-text reports, as the encryption adds only a small overhead to the report size 1 .

D is not a valid setting for the BigFix Root server, as it only applies to Relays that are configured to decrypt and repackage encrypted reports before relaying them to the BigFix Root server 2 .  This setting controls the maximum number of concurrent decryption threads on a Relay, and does not affect the BigFix Root server 2 .  References:

1 :  Message Level Encryption (MLE) Overview

2 : [Enabling encryption on Relays]

Starting from V9.5.6, the relay diagnostics page is disabled by default and can be protected by a password when enabled.

To enable the relay diagnostics page, you need to set the client setting _BESRelay_Diagnostics_Enable to a value of 1 on the relay computer. You can do this using the BigFix Console, the registry editor, or a custom fixlet or task.

To protect the relay diagnostics page with a password, you need to assign a value to the _BESRelay_Diagnostics_Password client setting on the relay computer. You can do this using the same methods as above.

After setting the _BESRelay_Diagnostics_Password, the URL to the relay diagnostics page must use the https protocol instead of http, otherwise the browser will show the “403 forbidden” error and the relay diagnostics page will not display.

To access the relay diagnostics page, open a browser and type in the address field: https:// < computer_name > :52311/rd or https:// < computer_name > :52311/RelayDiagnostics, where < computer_name > is the address of the workstation where the relay that you want to check is installed. You will be prompted to enter the password that you set for the _BESRelay_Diagnostics_Password client setting.

On the relay diagnostics page, you can gather information about your environment settings, relay status, console user authorization, site gathering, and client registration.  References:

Relay and Server diagnostics

How can I enable _BESRelay_Diagnostics_Enable" = “1”

Relay diagnostics

A BigFix Client is a software agent that is installed on every computer that must be managed by the BigFix platform 1 .

The BigFix Client continuously assesses the state of the computer against all subscribed content, which includes policies, checklists, and remediation tasks 1 2 .

The BigFix Client communicates with its parent, which can be either the BigFix Server or a BigFix Relay, to report its status and receive new content 1 3 .

The BigFix Client performs most of the analysis, processing, and enforcement work locally, reducing the workload and bandwidth usage of the BigFix Server 1 4 .

The BigFix Client operates with less than 10 megabytes of RAM and can run on various operating systems, such as Windows, Linux, UNIX, and Mac OS 1  .  References:

1 :  BigFix Platform

2 :  Learning about SCAP

3 :  Relays and Servers

4 : BigFix Architecture

: Client requirements

According to the BigFix Platform documentation 1 , the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration.  To configure a high scale Relay, you need to follow these steps 2 :

Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.

Set the  _BESRelay_HTTPServer_MaxConnections  setting to 2000 on the Relay.

Set the  _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize  setting to 10000000000 on the Relay.

Set the  _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount  setting to 100000 on the Relay.

Set the  _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize  setting to 10000000000 on the Relay.

Set the  _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount  setting to 100000 on the Relay.

Set the  _BESRelay_Download_LimitBytesPerMinute  setting to 0 on the Relay.

Set the  _BESRelay_Download_LimitBytesPerMinutePerClient  setting to 0 on the Relay.

Set the  _BESRelay_Download_PreCacheStageDiskLimitMB  setting to 100000 on the Relay.

Set the  _BESRelay_Download_PreCacheStageDiskLimitPercent  setting to 0 on the Relay.

Set the  _BESRelay_Download_CacheLimitMB  setting to 100000 on the Relay.

Set the  _BESRelay_Download_CacheLimitPercent  setting to 0 on the Relay.

Restart the Relay service after applying the settings.  References:

Relay scalability

Configuring a high scale Relay