HCL-HWA-ADM-102 HCLSoftware Certified Administrator- HWA 10.2 Exam Preparation Resources

dumps2026-01-23T10:23:42+08:00

To earn HCLSoftware Certified Administrator-HWA10.2 certification, you need to take and pass HCL-HWA-ADM-102 exam. Learning HCLSoftware Certified Administrator-HWA10.2 HCL-HWA-ADM-102 exam information is a required step. There are 40 multiple choice or multiple response questions in real HCL-HWA-ADM-102 exam, and you have 60 minutes to answer all the questions. The required passing score is 52. We provide the latest HCLSoftware Certified Administrator-HWA10.2 HCL-HWA-ADM-102 exam preparation resources, which are useful in your preparation. Free HCLSoftware Certified Administrator-HWA10.2 HCL-HWA-ADM-102 exam preparation resources are available below.

Page 1 of 26

1. What is the default data directory for Dynamic Workload Console in 10.2, and how is it customized during dwcinst installation?

DWC_home/data; not customizable

User's home; automatic

/var/HCL/DWC; using -datadir

Same as TWA_home/TWSDATA

DWC_home/DWC_DATA; using --data_dir

2. Which syntax correctly references a variable from a specific table in a job definition for HCL Workload Automation 10.2?

%variable tablename

&tablename.variablename

$parm tablename.variablename

${tablename.variablename}

3. HCL HWA 10.2 MDM-DWC certificate chain with Let's Encrypt fails renewal automation: "OCSP response invalid". CRL distribution point blocked.

What localopts configuration bypasses OCSP for short-lived certificates?

ACME client handles OCSP bypass automatically

SSL_OCSP_STAPLING=NO; SSL_OCSP_VALIDITY=86400

localopts SSL_VALIDITY_GRACE_PERIOD=30d

optman mod_SSL_SHORT_LIVED_CERT_VALIDATION=YES

4. Scenario: Deploying HCL Workload Automation 10.2 with containers on OpenShift.

Which tool is used alongside container images?

Docker Compose directly

Standalone docker run

Kubernetes YAML only

Helm chart

Podman build

5. Scenario: A critical issue requires maximum tracing on the application server for HCL Workload Automation 10.2 processes.

What trace specification enables full detailed logging, and where are the traces stored?

tws_all in trace properties file

com.hcl.tws.*=all in TWSConfig.properties

tws_info default level

org.apache.*=all for wink servers

All traces go to stdlist/traces

6. During HCL HWA 10.2 architecture migration from MDM-only to active-active HA (2 MDMs + 2 DWCs), secondary MDM fails Netman SSL linkage to primary workstation pool during symreq with 2500 jobs. Primary DWC shows secondary workstations "Down", secondary DWC shows all "Unknown". Event Rule Processor stable.

What certificate chain deployment sequence ensures both MDMs access workstation SSL truststores?

Update globalopts SSL on primary; replicate database

Deploy wa-waserver certificates to both MDMs; conman "linkall"

Copy TWS_home/TWS/certs to secondary; full startup

Renew SSL secrets in all namespaces; helm upgrade

7. Certificate revocation checking enabled on HCL HWA 10.2 MDM causes agent reconnect failures during CA maintenance: "PKIX path validation failed: revoked certificate".

What localopts configuration disables OCSP temporarily?

optman mod_SSL_REVOCATION_CHECK=FALSE

SSL_OCSP_CHECKING=NO; SSL_CRL_CHECKING=OFF

localopts SSL_TRUSTSTORE_VALIDATION=PERMISSIVE

jvm.args: -Dcom.sun.net.ssl.checkRevocation=false

8. Scenario: Customizing a container deployment of HCL Workload Automation 10.2 server.

Which parameter enables custom certificates in Helm values?

useCustomizedCert: true

sslkeysfolder mount

generateDefault: false

enableSSL: yes

certSecretName

9. FTA workstation batchman corruption blocks HCL HWA 10.2 production cycle CP=16h48m during 3800-job peak. Jobman 950 queued jobs fault-tolerant. PlanBox.msg 98% full.

What reset sequence maximizes critical path recovery?

planman resyncplan wsname /URGENT

rm msg/*.msg; full workstation startup

conman "stop wsname#batchman"; evtsize PlanBox.msg, Courier.msg 0; startup wsname#batchman

conman "resetws wsname --critical"; preserve queue

10. To restrict access preventing users from canceling critical jobs in production plan for HCL Workload Automation 10.2, which security entry is precise?

DEPENDENCY access=RELEASE restricted

JOB access=SUBMIT only

RUN access=STOP for specific streams

PLAN access=KILL with NO for non-admins

JOB access=CANCEL with CPU=/critical/* DENY

Page 2 of 26

11. During HCL Workload Automation 10.2 template-based configuration for 50 dynamic agents across hybrid cloud, the deployment team encounters variable substitution failures in agent templates due to unresolved ${AGENT_HOSTNAME}. The template references database-driven workstation definitions. To parameterize agent configuration using templates with automatic variable resolution from engine database, which template directive correctly substitutes runtime values during composer import?

@VARIABLE hostname="${resolve('workstation.name')}" in template body

#INCLUDE TEMPLATE agent_dynamic vars="@{hostname=resolve()}"

USE TEMPLATE agent_std @PARAM(hostname=db_query('select name from workstations'))

DEFINE AGENTDYN TEMPLATE vars="#resolve(db.workstation.hostname)"

12. Scenario: Implementing custom certificates in a containerized HCL Workload Automation 10.2 deployment using Helm charts.

Which method replaces default server certificates securely? (Select two)

Use cert-manager annotation for automatic issuance

Create Kubernetes secret with custom files matching default names and apply

Restart pods after configMap update

Mount volume with PEM files to /etc/ssl/certs

Set useCustomizedCert: true in values.yaml

13. In HCL Workload Automation 10.2, the writer process runs as a thread within which parent process on master and domain managers?

mailman

netman

batchman

monman

jobman

14. During a joint installation of HCL Workload Automation master domain manager and Dynamic Workload Console on the same host, the administrator wants to prevent conflicts when setting the data_dir environment variable. The issue arises because twa_env always points data_dir to the master domain manager directory.

How can the administrator avoid this conflict while installing both components on the same workstation?

Run dwcinst before serverinst so that twa_env binds data_dir to the console’s directory

Use tws_env instead of twa_env, or specify distinct --data_dir values when running serverinst and dwcinst so each component has its own data directory

Use twa_env and set a single shared data_dir for both components to simplify management

Avoid using any environment scripts and rely on default installation paths

15. HCL HWA 10.2 workstation architecture batchman fails PlanBox.msg write during 10, 000 job extended symreq; Courier.msg jobman launches fault-tolerant, DWC shows "Plan sync failed". Netman stable.

What capacity planning parameter prevents symreq message exhaustion?

Add secondary batchman instance; HA config

conman "limitsymreq 5000"; workload partitioning

Increase TWS_home disk 500GB; filesystem expansion

localopts enMsgFileResize=YES; evtsize PlanBox.msg 100M pre-symreq

16. HCL HWA 10.2 event rule monitoring CPU>90% on MDM triggers 1000 alert emails. conman "altpri ALERT_HIGHCPU 1" fails syntax.

What correct conman command deprioritizes excessive event rule notifications?

conman "stoprule ALERT_HIGHCPU"

conman "altpri rule ALERT_HIGHCPU 0"

conman "delp rule=ALERT_HIGHCPU"

conman "rje rule.ALERT_HIGHCPU"

17. In HCL Workload Automation 10.2, configuring using templates supports which advanced scenario for reporting in DB2 HADR?

Dynamic agent gateways

Client reroute parameters in datasource template

Automatic failover global options

Variable table definitions

Carry forward settings

18. Scenario: Containerized dynamic agents in HCL Workload Automation 10.2 require persistent job history across pod restarts.

Which Helm values.yaml storage configuration is mandatory?

EmptyDir for temporary

PersistentVolumeClaim mounted to /opt/IBM/TWA/TWS

No persistence needed

HostPath binding

ConfigMap for stdlist

19. To configure authentication using basic registry as temporary measure in HCL Workload Automation 10.2 production, which is discouraged but possible via?

composer add user

Direct fileRegistry.xml edits

Security file USER statements

optman for user addition

20. To deploy updated event rule configurations after modifying multiple rules in the database and setting isDraft=no in HCL Workload Automation 10.2, avoiding disruption to currently triggered rules, the precise planman command is?

planman deploy -force

planman deploy -scratch

planman deploy -noreset

planman deploy -full

planman deploy -all

Page 3 of 26

21. Which parameters are configurable in the Dynamic Workload Console advanced settings file TdwcGlobalSettings.xml? (Select All that Apply)

Carry forward behavior for job streams

Maximum query result limits

Timeout for HCL Workload Automation for Z engine operations

Custom documentation URLs for jobs and job streams

Current user registry in use

22. Scenario: Installing the Dynamic Workload Console 10.2 on UNIX as a non-root user fails due to permission issues on the target directory.

What is the correct resolution?

Run as root and specify -uname <nonroot>

Use -inst_dir with a user-writable path

Ensure the non-root user has full 777 permissions on parent directories

Switch to embedded Derby only

Pre-create the installation directory with correct ownership

23. Scenario: During a fresh installation of HCL Workload Automation 10.2 master domain manager using DB2, the database administrator has created the database instance and user.

Which command sequence correctly populates the database tables?

Edit datasource_DB2.xml manually and restart the application server

Use optman to set database parameters and run JnextPlan

Run configureDb.sh --rdbmstype DB2 --dbhostname host --dbport 50000 --dbname TWS --dbuser twsuser --dbadminuser db2admin

Run create_database.sql on the DB2 server followed by configureDb.sh with appropriate parameters

Copy dbtools/db2 scripts to the server and run dbrunstats

24. Dynamic Workload Broker allocation fails 41% across HCL HWA 10.2 165 Kubernetes dynamic agents during ramp-up (6800 jobs/hour). ResourceAdvisorConfig.properties agentScoreThreshold=0.6 too restrictive. BrokerWorkstation.properties heartbeatInterval=45s shows all agents responsive.

What threshold enables ramp-up completion?

ResourceAdvisorConfig.properties agentScoreThreshold=0.3

ResourceAdvisorConfig.properties enGracefulRampup=YES

JobDispatcherConfig.properties minEligibleAgents=50

BrokerWorkstation.properties rampUpGracePeriod=1800

25. For Oracle database usage in HCL Workload Automation 10.2 master domain manager installation, which editions support the Partitioning feature for improved event-driven workload automation performance?

Oracle Personal Edition

Oracle Standard Edition

Oracle Express Edition

Oracle Standard Edition One

Oracle Enterprise Edition

26. HCL Workload Automation 10.2 Docker deployment on Docker Swarm 20.10.24 fails healthcheck with "netman not ready" despite container Running status. swarm overlay network configured. docker service logs show port binding conflicts.

Which container deployment port configuration using precise docker-compose v3 syntax resolves swarm networking?

ports: - mode: host target: 31114 protocol: tcp - "9443:9443" healthcheck: test: ["CMD", "conman", "status"]

ports: - "31114:31114/tcp" - "443:9443/tcp" deploy: resources: reservations: memory: 16G

deploy: placement: constraints: [node.role==manager] endpoint_mode: vip ports: - 31114/tcp

networks: hwa-overlay ports: - target: 31114 published: 31114 protocol: tcp mode: host

27. HCL HWA 10.2 FTA jobman trace analysis requires pattern matching across 24-hour rotation TWS_home/log/jobman.2026010*.trc for Courier.msg semaphore exhaustion correlating to 5200-job symreq peaks.

What grep pattern+audit reveals production triggers?

find . -name "jobman*.trc" -exec grep slide {} +; conman showplans

zgrep "semaphore|Courier|timeout|wait" jobman.2026010*.trc; tail auditbox.msg | grep symreq

planman resyncplan /TRACE

localopts enJobmanTrace=SUMMARY; analyze rotation

28. HCL HWA 10.2 Dynamic Workload Broker ResourceAdvisorConfig.properties cpuThreshold=0.8 causes 62% job rejections during 3800 jobs/hour peak across 32 dynamic agents. DWC shows "Resource unhealthy" despite 45% actual CPU.

What weighted resource formula resolves false rejections?

resourceSelectAlgorithm=bestFit;cpuThreshold=0.9

cpuThreshold=0.65; enableDiskMonitoring=YES

ResourceAdvisorConfig.properties: cpuWeight=0.3;memoryWeight=0.5;diskWeight=0.2;cpuThreshold=0.85

memoryWeight=0.8;diskWeight=0.1;cpuWeight=0.1

29. In a scenario where you need to uninstall a dynamic agent in HCL Workload Automation 10.2, which prerequisites must be met before running twsinst -uninst?

Stop all HCL Workload Automation processes and services on the workstation.

Disconnect from the master domain manager network.

All jobs on the agent must be completed or canceled, with no pending or active jobs.

Backup the TWA_DATA_DIR first.

Run JnextPlan on the master first.

30. HCL Workload Automation 10.2 typical installation hardware assessment for VMware vSAN cluster reveals datastore latency 25ms during peak I/O testing. vSAN ReadyNode specs: 16 cores/512GB/10TB SSD cache. Production plan 500GB symphony file. Vendor benchmarks show 5ms target.

Which storage sizing recommendation using precise IOPS calculation meets server installation requirements?

Configure vSAN ESA dedup=enabled compression=on FTT=RAID-5 destage=25% SSD cache

Upgrade vSphere 8.0 U2 Enterprise Plus vSAN File Services for NFS workloads

Add vSAN Witness appliance co-located; resxtop esxtop disk latency target <15ms

Deploy vSAN OSA with 2PB all-flash Read Cache 1PB Write Intensive, 400K IOPS@4K QD32

Page 4 of 26

31. HCL HWA 10.2 fault-tolerant agent installation completes but shows offline in DWC after plan submission. conman "systat" displays agentname@domain as [OFFLINENOHEARTBEAT].Network connectivity confirmed.

What startup sequence using exact commands brings agent online?

conman startappsrv @agentname; monstop; netman

killall -9 jobman; /opt/hcl/twa/bin/startAgent.sh

shutdown; startagent; link @/@

/opt/hcl/twa/bin/tws_shutdown; rm $TWS_DATA_DIR/lastplan/S0; /opt/hcl/twa/bin/tws_start

32. An administrator is setting global options using the optman command in HCL Workload Automation 10.2.

Which command correctly changes the production day start time to 0300?

optman chg sod=0300

optman chg enStartOfDay=0300

optman chg globalStart=0300

optman chg startOfDay=0300

optman chg sd=0300

33. Scenario: Dynamic agents in HCL Workload Automation 10.2 show frequent reconnects to the broker. Investigation points to jobman instability.

What is the primary communication method affected?

Persistent HTTPS/WebSocket to Liberty

Courier.msg

UDP heartbeat

Local message queues

Batchman direct link

34. Configuring authentication HCL HWA 10.2 with smart card PIV fails PIN validation: "CKR_PIN_INCORRECT". Liberty pkcs11LoginModule configured but token slot mismatch. Required server.xml configuration?

PIV smart cards unsupported, use CAC instead

Liberty extracts PIN from certificate automatically

Hardware token middleware handles PIN automatically

35. Scenario: After database modifications to event rules, some rules fail to trigger due to partial deployment. To fully redeploy all active rules resetting states if necessary in HCL Workload Automation 10.2, the command is?

planman deploy -all

planman deploy -reset

planman deploy -reload

planman deploy -scratch -reset

planman deploy -fullreset

36. In the server installation of HCL Workload Automation 10.2 master domain manager, which script is used on UNIX/Linux to launch the installation?

installMaster.sh

launchpad.sh

configureServer

serverinst.sh

twsinst

37. In HCL Workload Automation 10.2, which workstation type is logical only and hosted by a physical FTA or manager?

Extended agent

Standard agent

Z-centric

Dynamic pool

Backup manager

38. Uninstallation scenario HWA 10.2: tws_uninst.sh -mdm removes binaries but $TWS_DATA_DIR/Symrec remains locked by monstop process.

What forceful sequence completes cleanup?

ps -ef |grep tws |awk '{print $2}' |xargs kill -TERM

db2 "deactivate db HWADB"; rm -rf $TWA_HOME

conman stopmon; tws_uninst -force

kill -9 pgrep monstop; rm -rf $TWS_DATA_DIR/*

39. A HCL Workload Automation 10.2 administrator sets Global Options to carry forward only critical job streams during extended maintenance windows, but non-critical streams inadvertently carry over due to wildcard matching. To refine carry forward to specific stream names using Global Options, which conman command achieves precise control?

set global jsCarryNames="CRIT_."; apply

alter global selectiveCarry="CRIT%"; commit

modify global carryforward.pattern=CRIT_*; refresh

alter global carryForward="CRIT_"; unlock global

40. Scenario: Installing a dynamic agent with advanced job types requiring Java in 10.2.

Which twsinst parameter ensures embedded JRE inclusion?

-jmportssl true

-advancedjobs true

-java true

-jreinstall yes

-addjruntime true

Page 5 of 26

41. A role-based access control review in an HCL Workload Automation environment requires that certain user groups see only specific monitoring dashboards in the Dynamic Workload Console. The administrator discovers a dedicated page for managing such access rules.

Which feature does the console provide to adjust what users can see and do, and where is it managed?

User profiles configured through the master domain manager’s database schema

Operating system groups mapped directly to Dynamic Workload Console widgets

Custom roles managed through the Manage Roles page in the Dynamic Workload Console

Command-line localopts entries controlling role visibility

42. Which command sequence enables and verifies plan auditing in HCL Workload Automation 10.2 without requiring full instance restart?

optman chg enPlanAudit=yes followed by stopmon/startmon

optman ls to check current, optman chg enPlanAudit=yes, JnextPlan to apply

Modify localopts directly and rerun JnextPlan

Use Dynamic Workload Console settings to toggle audit

planman deploy after optman change

43. Scenario: A fault-tolerant agent in HCL Workload Automation 10.2 needs complete reset after corrupted Symphony file. Local steps include? (Select two)

Stop all processes

Modify localopts

Run planman deploy

Restart to download fresh plan

Delete Symphony and .old files

44. HCL HWA 10.2 conman "showattrs AGENT01" reveals custom attribute JOBLIMIT=50 but 75 jobs queued.

What conman command enforces dynamic queue limit adjustment?

conman "chattr AGENT01 JOBLIMIT=50"

conman "enforcequeue AGENT01 50"

conman "altpri @/AGENT01/ 1 -limit=50"

conman "setlimit AGENT01 50"

45. Scenario: During a typical fresh installation of HCL Workload Automation 10.2 master domain manager, the installer prompts for database details.

Which action occurs automatically for the server container in supported deployments?

Database schema creation at container start

Direct connection to external HADR standby

Requirement for pre-created empty tablespaces

Automatic migration from Derby to DB2

Manual execution of create_database.sql

46. Which workstation type in HCL Workload Automation 10.2 architecture does not perform local dependency resolution and relies entirely on its manager for job launching?

Standard agent (STA)

Dynamic agent

Z-centric agent

Fault-tolerant agent (FTA)

Pool

47. HCL HWA 10.2 SSO session fixation attack prevented by regenerating session ID post-authentication. Browser cookies persist across login but Liberty detects fixation.

What server.xml httpSession configuration prevents fixation?

jvm.options: -Dcom.ibm.ws.session.securityIntegration=strict

SSO prevents session fixation automatically

httpSession idLength="56" useExternalFormOfSessionId="true"

48. An administrator wants to deploy a monitoring script that runs conman showresources periodically from multiple application servers that are not the master domain manager. The script should use the same connection profile on every server but allow each server to authenticate with the user logged into that system.

Which configuration approach is most appropriate to enable this behavior?

Distribute a standard localopts template to each server that defines all connection parameters except username and password, relying on the logged-in user for authentication

Add command-line parameters with full connection details to every script invocation and avoid local configuration

Use environment variables on each server that contain full connection parameters including the authenticated username and password

Configure all servers to share a single global localopts file over NFS with embedded username and password

49. Restrict access scenario: HCL HWA 10.2 MDM receives unauthorized conman connections from jump host 192.168.1.100. tcpdump shows successful SSL handshake but authentication failure.

What MDM configuration blocks pre-authentication?

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port protocol="tcp" port="31114" reject'

netman.conf: restricted_ips=192.168.1.100/32 action=reject

iptables -I INPUT -s 192.168.1.100 -p tcp --dport 31114 -j REJECT

localopts SSL_CLIENT_AUTH=REQUIRED; optman mod_TCPIP_CLIENT_AUTH=YES

50. HCL HWA 10.2 planman extend 48h fails during 3200 final job stream upgrades across 80 workstations with "Symphony file locked". Event processor backlog 18000 events/hr delays rules. Primary MDM CPU 92%.

What production cycle command forces extension bypassing upgrade locks?

planman extend 48h /FORCE; conman "stopmonitor"

kill -9 batchman; planman extend /RECOVER

planman resyncplan all /NOVERIFY; extend 24h twice

conman "stopsymphony"; planman create 48h

Page 6 of 26

51. Healthcare organization performs HCL Workload Automation 10.2 server installation across air-gapped network with offline repository. During serverinst execution for faulttolerant domain manager, installer reports "Open Liberty V24.0.0.9 validation failed" despite manual Liberty download. The target processes HIPAA-compliant workloads requiring FIPS 140-2 crypto.

Which server installation prerequisite using precise commands resolves Liberty validation for air-gapped server deployment?

serverinst --libertyPath /custom/liberty --fips140=true --offlineRepo /mnt/repo

Download OpenLiberty-24.0.0.9.zip; unzip -d /opt/liberty/; export WLP_INSTALL_DIR=/opt/liberty before serverinst

Install Liberty via rpm -ivh openliberty-24.0.0.9.rpm; serverinst --skipLibertyCheck

Extract Liberty from TWA media; symlink /opt/HWA/liberty -> ./OpenLibertyServer24.0.0.9

52. HCL HWA 10.2 production cycle shows 1800 event-driven job streams failing final upgrade during planman UPGRDJSTREAM due to event processor overload (25000 events/hr). Rule evaluation timeout=300s exceeded.

What production cycle isolation completes upgrades?

planman extend 48h; event processor restart

Increase timeout=900s; retry upgrade

planman create /NOEVENTS; upgrade manually

conman "stopmonitor"; planman UPGRDJSTREAM /FORCE; conman "startmonitor"

53. What is the recommended command to stop the Dynamic Workload Console application server in HCL Workload Automation 10.2?

wasstop.sh

conman stopappserv

ShutdownDW

stopwas.sh

stopAppServer.sh -direct

54. PostgreSQL 13 installation for HWA 10.2 MDM: pg_createcluster fails "insufficient shared_buffers". postgresql.conf shows 25% RAM. For 512GB server, what initdb parameter meets HWA minimum?

wal_buffers=-1 (auto-tuned)

--shared-buffers=128GB --max-wal-size=32GB

pg_settings.shared_preload_libraries=timescaledb

initdb -D /var/lib/pgsql/13/data --locale=en_U

UTF8

55. Monman 8500 QUEUE_EVENT/hr overwhelms Monbox.msg despite edwa timeout=420s on HCL HWA 10.2. Moncmd.msg DEPLOY_CONFIG backlog.

What prevents event processor failure?

enEventProcessorHttpsProtocol=NO

Moncmd.msg clean; core tune

edwa timeout=900; ssmagent restart

evtsize Monbox.msg 35M; T(monmanPoll)=5

56. HCL HWA 10.2 plan contains circular dependency: PAYROLL@ -> BANKING@ -> PAYROLL@ causing deadlock. conman "dj PAYROLL@" shows WAIT_DEP.

What single conman command breaks cycle preserving dependent jobs?

conman "deldep sched PAYROLL@; deldep sched BANKING@"

conman "ddj PAYROLL@; dds BANKING@"

conman "reljob @/PAYROLL/; deps"

conman "rjs PAYROLL@; rje BANKING@"

57. HCL HWA 10.2 Switch Event Processor rule inheritance conflict: Child rule overrides parent condition incorrectly. conman showswitchep shows RULE_INHERITANCE_ERROR.

What command resolves inheritance hierarchy?

conman switchep -resolve-inheritance

composer validate ruleset

Rule conflicts auto-resolved by priority

optman mod_SWITCHEP_INHERITANCE_STRICT=NO

58. HCL Workload Automation 10.2 Global Options set deadline tolerance to 5%, but strict SLAs require 0%. To disable tolerance globally, which command zeros it?

alter global deadlineTolerance=0%; unlock global

modify global tolerance=0; refresh

set global dlTolerance=0; apply

alter global strictDeadline=true; commit

59. When customizing certificates for bidirectional SSL between MDM and multiple DWCs in a distributed HCL Workload Automation 10.2 setup, which keystore operations ensure the CA chain is properly trusted without exposing private keys? (Select two)

Stash the keystore passwords using Liberty's securityUtility

Use keytool -importcert to add only the CA root and intermediates to truststores

Export the server private key from MDM and import into DWC truststore

Generate separate client certificates for each DWC signed by the same CA

Enable clientAuthentication="true" in DWC server.xml for mutual auth

60. An enterprise HCL Workload Automation 10.2 deployment requires Global Settings on Job Streams to limit priority inheritance from parent streams to prevent escalation during overload conditions. The administrator configures this via the security file, but observes that high-priority streams still preempt lower ones.

Which security file entry correctly implements priority ceiling enforcement?

[JobStreamGlobal] priorityCap=50

Define STREAM_PRIORITY_LIMIT=50 under [Global]

[GlobalStreamSettings] maxPriorityInherit=50

global.priority.ceiling=50 in [SecurityLimits] section

Page 7 of 26

61. In HCL Workload Automation 10.2 architecture, which workstation types maintain a local copy of the Symphony file for fault-tolerant operation? (Select two)

Domain Manager (DDM/FTAs acting as managers)

Dynamic agents

Master Domain Manager (MDM)

Backup Master Domain Manager

Standard agents

62. Monitoring HCL HWA 10.2 resource contention: 50 jobs WAIT_RES(TAPE001). conman "resources" shows 10/20 allocated.

What conman command redistributes resource across waiting consumers?

conman "relres TAPE001"

conman "freeres TAPE001 10"

conman "redistribute res TAPE001"

conman "resetres TAPE001"

63. An administrator customizes the Dynamic Workload Console branding. After deployment, some users still see old logos.

What is the most likely cause?

Customization directory incorrect

Engine restart required instead of console

Browser cache not cleared

Files not in PNG format

64. HCL HWA 10.2 Liberty auditbox.msg shows 3800 "Access denied" during Dynamic Workload Broker REST API calls from DWC. TWS_home/trace/appservman.*.trc empty. BrokerWorkstation.properties restApiEnabled=YES.

What audit+trace enabling diagnoses API authorization?

localopts enLibertyAudit=DETAILED; appservman traceLevel=DEBUG; recycle Liberty

DWC config auditCapture=API; refresh

BrokerWorkstation.properties: apiAuditLevel=SECURITY

globalopts AUDIT_API=VERBOSE; conman "startaudit liberty"

65. In HCL Workload Automation 10.2 workstation process architecture, which sequence correctly represents startup order on a fault-tolerant agent?

StartUp → netman → mailman

mailman → netman → jobman

jobman → mailman → netman

netman → StartUp → mailman → jobman

netman → mailman → jobman

66. Scenario: A user with operator role in HCL Workload Automation 10.2 DWC can unexpectedly modify production job streams outside their assigned domain, violating leastprivilege principles. To restrict this, the administrator edits the security file.

Which entries correctly limit the user to their domain? (Select three)

USER username DOMAIN=assigned_domain

JOBSTREAM access=SUBMIT with DOMAIN restriction

APPLICATION access=USE limited to specific engine connections

OBJECT access with CPUCLASS matching domain managers

CPU=DOMAIN_NAME/* ACCESS=DISPLAY, MODIFY for the user

67. Enterprise performs typical HCL Workload Automation 10.2 installation for 100-agent environment but post-install conman fails with "Symphony file corruption" during first plan production. Serverinst completed without warnings, 64GB RAM allocated with 32GB swap. Disk I/O metrics show 95% utilization on /TWS filesystem during makprod.

Which typical installation filesystem configuration using precise mount options prevents symphony corruption for high-scale deployments?

Mount /TWS with noatime, nodiratime, x-systemd.automount, size=100G on ext4

mkfs.xfs -d su=64k, sw=8 /dev/sdb1; mount -o allocsize=64k /dev/sdb1 /TWS

Create LVM /TWS with 100GB, mount -o defaults, stripe=64K /dev/vgTWS/lvTWS /TWS

Btrfs subvolume /TWS@prod with qgroup limit 100G compression=lzo

68. During DWC installation in 10.2 for production, which database choice is recommended over the default?

Embedded Derby

Remote DB2 or Oracle

Apache Derby only for test

No database needed

Local PostgreSQL

69. A high-availability HCL Workload Automation 10.2 cluster spanning three data centers requires automatic failover between MDM1 (primary) and MDM2 (backup) with heartbeat monitoring every 30 seconds and failover timeout of 5 minutes. During testing, failover succeeds but the production plan lags 2 hours behind due to clock skew.

Which failover configuration parameter synchronizes plan time across failover nodes while enforcing strict heartbeat validation?

conman "configure failover MDM2 heartbeat=30 timeout=300 syncplan=true"

alter domain failover.heartbeat=30s failover.timeout=5m clock.sync=true

Set [Failover] heartbeat.interval=30s timeout=300000ms in shared JobManager.ini

modify switchmgr auto=MDM2 monitor=30s maxlag=120m timesync=force

70. Which planman commands are essential for unlocking and checking the status of a locked production plan after a failed JnextPlan in HCL Workload Automation 10.2? (Select two)

planman deploy

planman showinfo

planman resync

planman checksync

planman unlock

Page 8 of 26

71. Scenario: A high-security environment mandates restricting DWC access to only specific IP ranges for administrators managing critical workloads in HCL Workload Automation 10.2. Additionally, certain users must be denied access to submit jobs with elevated privileges.

How can this be achieved using native security features? (Select all that apply)

Assign roles with NOACCESS for PRIVILEGEDJOB submission in security file

Configure WebSphere Liberty host name filtering in server.xml with allowed hosts

Implement IP-based access control lists in the DWC connection properties

Define USER objects in the security file with DENY access for SUBMIT on specific CPUs

Use operating system firewall rules to block ports except from allowed IPs

72. HCL HWA 10.2 Switch Event Processor geographic distribution: EU rules latency 500ms vs US 50ms. conman showswitchep shows REGIONAL_BIAS.

What command configures latency-based event routing?

optman mod_SWITCHEP_REGION_AWARE=YES; optman mod_SWITCHEP_LATENCY_THRESHOLD=200ms

localopts SWITCHEP_GEO_FENCING=EU:200ms, US:50ms

conman switchep -geo eu-cluster -latency 200ms

SwitchEP auto-detects latency automatically

73. To combine advanced console settings with global options: Custom documentation URLs are set in TdwcGlobalSettings.xml, but access requires security.

Which file controls optman access for related global changes?

Security file on master with GLOBALOPTS MODIFY

Localopts on console

TdwcGlobalSettings.xml

JobManager.ini

Broker properties

74. In a complex production cycle with event-driven workload, after modifying multiple event rules, the administrator needs to deploy them efficiently in HCL Workload Automation 10.2.

Which planman command option minimizes deployment time for a large number of rules?

planman deploy -force

planman deploy -fast

planman deploy -incremental

planman deploy with no options

planman deploy -all

75. HCL HWA 10.2 DWC SSL encryption with FIPS 140-2 compliance fails: "FIPS mode: Self-test failed". IBM Semeru JDK11 configured but crypto policy unlimited missing. Required jvm.options configuration?

server.xml: <ssl sslProtocol="TLSv1.3" fipsMode="true" enabledCipherSuites="TLS_RSA_WITH_AES_256_CBC_SHA256"/>

-Dcom.ibm.crypto.provider.preferred=FIPS; -Djava.security.properties=/opt/ibm/java-semeru-11/security/java.security_fips

jvm.options: -Djdk.tls.client.protocols=TLSv1.3; -Dcom.ibm.ssl.protocolProvider=IBMJSSE2FIPS

export JAVA_OPTS="$JAVA_OPTS -Djava.security.egd=file:/dev/./urandom -Dfips.provider=BCFIPS"

76. In automatic failover scenarios for HCL Workload Automation 10.2, returning to the original master after recovery requires which action?

Automatic revert after restart

Propagate security file

Manual switchmgr command

Update global options list

Run JnextPlan on original

77. HCL HWA 10.2 emergency plan extension during outage: conman "extendplan 4h" fails "Invalid time specification". Current final 18:00, extend to 22:00. Correct syntax?

conman "setfinal 22:00"

conman "extendplan +4:00"

conman "extendplan -final 22:00"

conman "extendplan 2200"

78. During a fresh installation of HCL Workload Automation 10.2 on a fault-tolerant agent connected to an Oracle database, which connection parameters are mandatory in the localopts file for command-line operations? (Select All that Apply)

port - the Netman port for communication

password - the encrypted password of the HCL Workload Automation user

protocol - always set to https for secure connections

host - the hostname of the master domain manager

username - the HCL Workload Automation user with access privileges

79. HCL HWA 10.2 FTA batchman troubleshooting requires list files TWS_home/lst/PlanBox_20260107.lst analysis showing 4200-job dependency explosion blocking CP=18h42m. Audit correlates to planman UPGRDJSTREAM.

What list+audit pattern reveals dependency storm trigger?

conman "showplans /DEPS"; analyze dependency graph

grep "^DE

[0-9]{4, }" PlanBox_.lst; tail auditbox.msg | grep "UPGRDJSTREAM|dependency"

planman resyncplan /DEPENDENCY

localopts T(bm check file)=30; list regeneration

80. Scenario: After pod eviction in Kubernetes for HCL Workload Automation 10.2 dynamic agent, the workstation shows offline despite new pod running.

How to reset registration?

Scale down to 0 then up

Manual conman unlink/link

JnextPlan -for 0000

Delete workstation definition and let Helm recreate

Restart broker

Page 9 of 26

81. During HCL HWA 10.2 dynamic agent installation on RHEL9 Kubernetes worker node, the pod logs show "JobManager failed to bind to port 35000 due to permission denied". The DaemonSet yaml specifies securityContext runAsUser: 2000.

What installation parameter resolves the privileged port binding?

capabilities add: NET_BIND_SERVICE in securityContext

privileged: true container securityContext

hostNetwork: true with hostPID: true in pod spec

sysctl -w net.ipv4.ip_unprivileged_port_start=35000 on host

82. Using optman, an administrator lists all global options.

Which command displays the current value of enCarryForward?

optman show enCarryForward

optman chg cf ?

optman ls cf

optman ls | grep carry

optman display cf

83. Which process on HCL Workload Automation 10.2 agents is responsible for monitoring event rules locally when the agent is configured for decentralized event processing?

eventprocessor

monman

batchman

writer

jobman

84. Scenario: After enabling SSL on the DWC with custom certificates, browser access shows "certificate not trusted" despite CA import on clients. The certificate CN is the MDM hostname, but DWC is on a separate host.

What resolves this for multi-DWC setups? (Select three)

Configure Liberty virtual hosts with alias matching

Use SAN extensions in the certificate including all DWC hostnames/IPs

Redirect DWC traffic via load balancer presenting unified certificate

Import DWC-specific client certificates into MDM truststore

Synchronize TWSServerKeyFile.jks across all DWCs from a common template

85. Global Settings using Security file mandate non-working days calendars for all streams, but defaults fail.

Which entry enforces mandatory calendars?

[GlobalStreamSettings] requireCalendar=true

global.stream.calendar.required=true

CALENDAR_MANDATORY=true

[Calendars] mandatory=true

86. HCL HWA 10.2 conman script automates daily cleanup: "delp abend=ABEND1; rje @abend=ABEND1". Cleanup skips S0Wxxx warnings. Correct abend code pattern?

conman "purgeabends S0J*"

conman "delp -abend S0J*"

conman "delp @+abend=S0J*; rje @+abend=S0J*"

conman "delp abend=S0J*; rje abend=S0J*"

87. resetfta is preferred over unlink/link because?

Automatic certificate refresh

Faster for multiple agents

No access requirements

Stops jobs immediately

Handles internal state recovery beyond connectivity

88. Security file Global Settings block shadow jobs globally, but testing requires exceptions.

Which entry whitelists test workstations?

[GlobalShadow] exemptWorkstations=TEST_*

[Shadows] test=true

global.shadow.allow=TEST_*

SHADOW_TEST_EXEMPT=*

89. In container deployments of HCL Workload Automation 10.2, which component requires persistent storage for database and plan persistence?

All equally

Dynamic agent

Server (MDM)

Dynamic Workload Console

None if stateless

90. Restrict HCL HWA 10.2 plan modification to change window only. Unauthorized user creates job outside 0200-0600.

What localopts time-based access control prevents offhours changes?

cron restricts composer access /etc/cron.d/tws_plan_edit

PLAN_EDIT_WINDOW=0200-0600; optman mod_RESTRICTED_PLAN_EDIT=YES

localopts RBAC_TIME_RESTRICTION=0200-0600

composer create security timewindow 0200-0600 access=MDMAdmin

Page 10 of 26

91. In a HCL Workload Automation environment, a team wants to centralize access to the engine from multiple monitoring tools and scripts running on different servers. They decide to rely on localopts for connection defaults but also need to override certain parameters for specific scripts.

Given the client’s parameter resolution behavior, how should they design these scripts to avoid accidental use of outdated host or port values?

Store connection details only in environment variables and ignore both localopts and command-line parameters

Pass any parameter that might change over time (such as host or port) explicitly in the script so it overrides older values in localopts, while leaving stable parameters in localopts

Place the most current values in localopts and avoid passing any connection parameters from scripts

Never use localopts and instead hard-code all connection parameters into every script

92. Troubleshooting HCL HWA 10.2 jobman abend shows TWS_home/log/jobman.20260107.trc truncated at 85MB during 3200 job launches/hour. Courier.msg semaphore contention. Audit trail shows jobman restarts x17. DWC job properties incomplete.

What trace configuration prevents diagnostic loss?

conman "starttrace wsname#jobman MAX"

globalopts TRACEFILESIZE=400M; jobmanTraceLevel=FULL

localopts TraceFileSize=500M; TraceFileCount=10

TWS_home/TWS/trace.properties maxFileSize=1G

93. HCL HWA 10.2 SSO SAML signature validation fails with ADFS: "Signature algorithm mismatch". ADFS metadata specifies RSA-SHA256 but Liberty expects SHA1.

Required samlGlobalIdpMetadata.xml override?

ADFS auto-negotiates signature algorithm with SP

server.xml: <samlSP signatureAlgorithm="RSA_SHA256"/>

Liberty defaults to SHA256, update ADFS metadata

94. For monitoring internetwork dependencies represented as EXTERNAL job streams in the plan using HCL Workload Automation 10.2 conman, the command to display their status is?

showjobs @#EXTERNAL/*

showdeps type=internet

showsched @#EXTERNAL;full

showexternal

listinternet

95. A security officer requires that a group of users have read-only access to specific workload monitoring views in the Dynamic Workload Console but no ability to modify jobs, calendars, or scheduling objects. The HCL Workload Automation administrator plans to configure this using console capabilities rather than database-level permissions.

Which configuration action should the administrator perform to meet this requirement?

Disable conman access for those users while leaving console permissions unchanged

Create a custom role in the Manage Roles page with only monitoring permissions and assign it to the target users

Restrict access by removing the users’ db.user privileges in the HWA database

Edit localopts for those users to remove any write-related parameters

96. Scenario: After replacing default certificates with custom CA-signed ones on the MDM in HCL Workload Automation 10.2, dynamic agents fail to register with error "SSL peer certificate validation failed". The agents are at version 10.2.1.

Which commands and steps are required on the agents to resolve this without reinstallation? (Select three)

Convert agent keystores from CMS to JKS format if using older GSKit

Manually import the new CA certificate into the agent's TWSClientTrustFile.jks using keytool

Restart the agent after copying updated keystores from MDM

Update the agent's ita.ini [ITA SSL] section with verify_cn_string matching the new CN

Run AgentCertificateDownloader --tdwbhostname <MDM> --tdwbport 31116 to fetch updated trust

97. Scenario: Custom variable tables differentiate prod and test values.

How to switch tables for testing?

Delete and recreate

Rename tables

Change global default

Assign different table to test folder or job streams

Use composer replace

98. planman unlock is crucial when?

Before event deployment

Only on backups

Daily maintenance

For agent resets

After interrupted planman/JnextPlan leaving database locks

99. To enable SSL encryption for DWC-to-MDM communication using automatic configuration during fresh installation in HCL Workload Automation 10.2, which twsinst/dwcinst parameters are critical? (Select two)

--tdwbhostname and --tdwbport for connection details

--acceptlicense yes with --agent dynamic

--sslkeysfolder pointing to a directory with custom PEM files

--jwt true for token-based auth override

--sslpassword to set a common password for generated keystore/truststore

100. In an HCL Workload Automation 10.2 environment with strict compliance requirements, the security team mandates that Global Settings on Job Streams enforce time zone consistency across all engines, but regional offices report discrepancies in earliest start time calculations.

To synchronize global time zone enforcement without modifying individual job stream definitions, which Global Settings configuration using the security file achieves this?

Set enTimeZoneRestriction=UTC in Global Options via conman

Configure [Global] timezone=UTC in the engine's security configuration

Define TWS_TIMEZONE="UTC" in the Security.txt file under global section

Add global.timezone=UTC to masterdomainmgr.Security file

Page 11 of 26

101. Broker server configuration file location in HCL Workload Automation 10.2?

etc/broker

TWSDATA/broker config

Liberty deployed app

Dynamic agent config

<TWA_HOME>/TWS/broker/BrokerWorkstation.properties

102. In HCL Workload Automation 10.2, which process handles internetwork dependency resolution across different TWS networks?

netman

monman

mailman

jobman

batchman

103. Scenario: In HCL Workload Automation 10.2 with federated LDAP, users from a secondary domain fail bind due to referral chasing issues.

Which ldapRegistry parameters enable proper cross-domain resolution? (Select two)

referral="follow"

queryPageSize="200"

chaseReferral="true"

sslRef="ldapSSL"

connectTimeout="30s"

104. Using HCL Workload Automation 10.2 templates to deploy standardized fault-tolerant job streams across 20 fault domains, template expansion fails with "unresolved @FAULTDOMAIN_ID".

To configure templates that dynamically resolve fault domain membership during composer import for automatic workload distribution, which template variable substitution leverages engine topology?

TEMPLATE FAULT @PARAM(domain="${@fault.id()}")

@VAR FAULTDOMAIN_ID="${resolve('domain.fault.id')}"

DEFINE TEMPLATE FAULT vars="#faultdomain.query()"

#INCLUDE TEMPLATE fault_std vars="@domain_fault()"

105. HCL HWA 10.2 IBM i agent installation completes but QSYSWRK job TWSSBM01 *INZ fails MCH1202 decimal data error. DSPJOBLOG shows "Job table not found". AS/400 library creation missing.

Required pre-installation CL command?

ADDLIBLE LIBL(TWSAGENT) POSITION(*FIRST)

CHGJOBLOG OUTPUT(*SYSLOG *NOBRD)

CRTLIB LIB(TWSSBM) TEXT('HCL Workload Automation Agent') CRTAUT(*ALL)

CRTUSRPRF USRPRF(TWSAGENT) TEXT('TWS Agent User')

106. Dynamic Workload Console Advanced Settings throttle API calls at 100/min globally, but bursts fail legit queries.

To smooth via token bucket, which property configures?

dwc.api.smooth=token100

advanced.api.bucket=100

api.throttle.bucket=100; refill=1/s in overrides.properties

Set api.rate.global=100 under Advanced Throttle

107. In Orchestration CLI model commands for HCL Workload Automation 10.2, to delete a deprecated job definition "OLDJOB", the command is?

ocli model drop job OLDJOB

ocli model delete job --name OLDJOB

ocli plan kill OLDJOB

ocli composer delete OLDJOB

ocli model remove OLDJOB

108. Which twsinst parameters are used to authenticate to the master domain manager during dynamic agent installation in HCL Workload Automation 10.2 when not using JWT?

-master <mdm_name>

-wapassword <password>

-tdwbport <port>

-wauser <user>

-tdwbhostname <host>

109. In a high-availability HWA 10.2 setup, primary MDM at TWA_HOME=/opt/hwa/mdm1 fails over to backup MDM. Upon startup, backup reports "Installation paths mismatch: TWS_Eclipse_Install=/opt/hwa/mdm1_eclipse".

What installation path property was incorrectly configured during backup MDM install?

backup.eclipse.path=/opt/hwa/mdm2_eclipse

Use shared filesystem for Eclipse workspace

tws.eclipse.local=true on backup only

TWS_Eclipse_Install must match primary exactly

110. HCL HWA 10.2 monman trace TWS_home/trace/monman.20260107.trc shows "edwa connection timeout=180s" blocking event processor during Dynamic Workload Broker resource events. Audit trails show 18000 events/hour.

What trace+audit correlation diagnoses broker event storm?

conman "showmonitor"; netstat -an | grep event

localopts T(monmanPoll)=5; trace jobman

planman resyncplan /EVENTS

Page 12 of 26

111. Planman UPGRDJSTREAM processing 3200 final streams during HCL HWA 10.2 production cycle shows 29% "Symphony locked" failures across mixed FTA/dynamic pool.

What sequence guarantees upgrade completion?

conman "flushq all"; planman create

conman "stopmonitor"; planman symreq all; planman UPGRDJSTREAM /FORCE

planman resyncplan all /FORCE; upgrade

planman extend 24h; retry upgrade

112. Scenario: An administrator observes intermittent SSL handshake failures between fault-tolerant agents upgraded to 10.2 and an MDM using custom certificates post-10.2.1.

What specific considerations apply to FTA certificate propagation? (Select two)

Use twsinst with sslkeysfolder and sslpassword during upgrade

Automatic propagation via linkage only for dynamic agents

Run make secure after linkage for FTAs

Manual certificate installation required on FTAs below 10.2 linked to newer MDM

Update localopts SSL CA certificate path to custom trust file

113. Which parameter in the server installation of HCL Workload Automation 10.2 allows generation of default SSL certificates?

keystorePassword only

Provide password for default certificates

certman generate

sslkeysfolder path

enableCustomCert=true

114. Scenario: You need to uninstall a backup master domain manager in a high-availability setup for HCL Workload Automation 10.2 after promoting it temporarily.

What prerequisites must be met before uninstallation? (Select All that Apply)

Drop the shared database

Ensure no active plan references the backup

Remove workstation definition from database

Stop all processes on the backup using shutdown commands

Switch back to the primary master using switchmgr

115. HCL Workload Automation 10.2 server installation on IBM Power10 EC45 enterprise server (256 cores/4TB RAM) for mainframe hybrid scheduling encounters J9JIT24 fatal error during makprod of z/OS job streams. Java 11.0.19 installed. AIX 7.3 TL2.

Which server installation JVM sizing using precise -X options prevents JIT compilation OOM?

TWS_JAVA_OPTS="-Xms16g -Xmx96g -XX:+UseContainerSupport -XX:MaxRAMPercentage=75 -Xjit:count=50000"

JAVA_OPTS="-Xaggressive -Xcomp:multi 4 -Xtune:virtualized -Xjit:disableAsyncCompilation"

tws_env JAVA_MAX_RAM=75%; export IBM_JAVACOREDIR=/TWS/java_cores; ulimit -c unlimited

JobManager.ini [JVM] heapSize=96G newSize=16G survivorSize=2G

116. HCL HWA 10.2 batchman PlanBox.msg/Server.msg desync during 2500-job symreq with T (bm check file) =150 and 800 file dependencies. Courier.msg jobman 92% capacity.

What dual optimization cascade resolves?

enLimitedJobManSemaphores=NO

T (bmNetmanPoll) =120; netman sync

evtsize PlanBox.msg, Courier.msg 28M

T (bm check file) =50; conman "limitdep 300"

117. Which twsinst parameter specifies the language for installation messages in HCL Workload Automation 10.2?

-acceptlicense yes

-language <code>

-displaylang <code>

-lang en

-locale <code>

118. For advanced conman usage in HCL Workload Automation 10.2 with JWT authentication in batch mode for scripting, the invocation is?

conman -timeout 3600 "cmd"

conman -host mdm "cmd"

conman -jwt token "command && command"

conman -user tws -pwd pwd "cmd"

conman -protocol https "cmd"

119. Scenario: Server installation in HCL Workload Automation 10.2 detects existing instance.

What role is assigned to the new one?

Standalone broker

Z-controller

Dynamic domain manager

Fault-tolerant agent

Backup master domain manager

120. Azure AKS HCL HWA 10.2 HA certificate rotation across 4 MDMs fails zero-downtime; kubectl rollout restart triggers all StatefulSets simultaneously causing workstation "SSL unavailable".

What rolling strategy ensures HA certificate continuity?

Helm upgrade --atomic --wait --timeout=20m all charts

kubectl rollout restart statefulset wa-waserver-mdm1; sleep 120; repeat mdm2-4

Blue-green deployment new namespace; cutover DNS

RollingUpdate maxSurge=0 maxUnavailable=1 per namespace

Page 13 of 26

121. Production HCL HWA 10.2 MDM shows monstop process hung during maintenance window. conman "stopmon" returns immediately but ps -ef |grep monstop shows PID running.

What forceful recovery sequence restarts engine preserving current plan?

conman "delp @;end"; ./tws_shutdown; ./tws_start

pstack $(pgrep monstop) |grep DB; conman startmon @

strace -p $(pgrep monstop) -e trace=file; kill -HUP

kill -9 $(pgrep monstop); conman startmon

122. Which global options managed by optman require a JnextPlan execution to take effect? (Select All that Apply)

enAutomaticFailover

enTimeZone

startOfDay

carryStates

enCarryForward

123. Failed HCL HWA 10.2 backup DDM uninstall leaves Kubernetes Service tws-bddm-svc type LoadBalancer active. kubectl delete svc fails "cannot delete due to finalizers".

Force Service deletion preserving LoadBalancer IP?

kubectl delete svc tws-bddm-svc --cascade=orphan; kubectl delete svc --force --grace-period=0

Release LoadBalancer IP manually via cloud provider console first

kubectl patch svc tws-bddm-svc -p '{"metadata":{"finalizers":null}}' --type='merge'

Backup uninstall kubectl delete removes Services automatically

124. HCL Workload Automation 10.2 automatic failover between geo-dispersed MDM/BDM pair experiences 3-minute DNS propagation delay for dynamic agents.

To accelerate agent reconnection post-failover using local DNS cache override, which agent JobManager.ini parameter bypasses DNS propagation?

[Netman] failover.fastdns=true cache=5m

[Gateway] auto.dnsbypass=true

[ITA] failover.dns.cache=300s directConnect=true

[Dynamic] reconnect.bdmDNS=BDM_HOST override=true

125. Production audit trails HCL HWA 10.2 show auditbox.msg rotation gaps during MDM failover; 2800 critical conman commands lost across 120 FTAs. DWC compliance gap 2 hours.

What HA audit configuration ensures continuity?

Liberty audit replication cluster-wide

localopts enAuditReplication=YES;auditSyncInterval=30;backupAuditPath=/ha/audit

globalopts AUDIT_HA=SYNC; secondary MDM config

conman "starthaaudit all"; failover test

126. HCL HWA 10.2 standard agent (no batchman) shows mailman unable to route jobman Mailbox.msg abend statuses due to pobox backlog for 50 unlinked peer workstations. Netman fills NetReq.msg with UNLINK cycles. Jobman Courier.msg processing normal.

What command drains pobox selectively without full mailman disruption?

rm -rf pobox/*; mailman recycle

conman "flushq wsname"; full startup

evtsize Mailbox.msg, pobox 20M; netman stop

conman "cleanpobox wsname"; tune T(netmanRetryInterval)=60

127. Commands to stop dynamic agent specifically in 10.2.

ShutDownLwa

ShutdownAgent

stopagent.sh

stopJm

conman stop @!@

128. HWA 10.2 uninstallation scenario: Failed MDM upgrade leaves orphaned DB2 tablespace TS_HWA_INDX. tws_uninst.sh completes but conman shows stale jobs.

What manual uninstall step cleans database completely?

db2move drop db2mdm1 all

db2 "DROP TABLESPACE TS_HWA_INDX"

rm -rf $TWS_DATA_DIR; db2stop

db2 "CONNECT TO HWADB; DROP DB HWADB"

129. Scenario: After network outage recovery, a fault-tolerant agent relinks but jobs remain stuck. Logs show mailman running but no activity in jobman.

Which queue likely contains pending job launches?

Intercom.msg

Jobmanbox.msg

Serverbox.msg

Courier.msg

Mailbox.msg

130. HCL HWA 10.2 backup dynamic domain manager uninstall leaves conman connection from DWC to localhost:31114 active. netstat -an |grep 31114 shows TIME_WAIT.

Primary MDM cannot switchmgr. Manual port cleanup?

rm -f /tmp/.X11-unix/*; netstat -an |grep TIME_WAIT auto-clears

ss -tanp |grep 31114 |awk '{print $2}' |cut -d: -f1 |xargs kill -HUP

lsof -i :31114 |grep LISTEN |awk '{print $2}' |xargs kill -9

iptables -D INPUT -p tcp --dport 31114; systemctl restart netman

Page 14 of 26

131. Automatic failover latency testing reveals HCL Workload Automation 10.2 BDM event rules process 40% slower due to missing resource pool inheritance.

To configure automatic resource pool synchronization across failover pair, which domain setting propagates pool limits?

alter domain failover.respool.sync=true

conman "failover pools=auto BDM"

switchmgr respool.preserve=true

[ResPool] failover.sync=true

132. HCL HWA 10.2 DWC SAML 2.0 integration installation fails metadata validation: "Signature validation failed for entityID". Liberty server.xml idpMetadata.xml imported but signature verification disabled.

Required security configuration?

keytool -import -alias idp-signing -file idp-public.crt -keystore saml-keystore.jks -storepass tws

SAML signature validation optional for test environments

server.xml: <sslDefault id="sslDefaults" sslProtocol="TLSv1.3" clientAuthenticationSupported="true"/>

133. Which global options influence production plan carryforward behavior most significantly in complex cycles?

enPlanAudit and mm resolve master

enForecastStartOfDay

enCarryForward and carryforward types

startOfDay and enLegacyStartOfDayEvaluation

tiebreaker and priority

134. Telecommunications provider performs typical HCL Workload Automation 10.2 installation but post-reboot master domain manager fails startup with "maximum open files exceeded". ulimit -n shows 1024 despite /etc/security/limits.conf configured. Production plan contains 75, 000 job streams.

Which permanent file descriptor limit configuration using systemd override resolves server startup for high-complexity workloads?

prlimit --pid $TWSM_PID --nofile=65536 before monman startup

echo "* soft nofile 65536" >> /etc/security/limits.conf; reboot

Override /etc/systemd/system/tws.service: LimitNOFILE=65536; systemctl daemon-reload

ulimit -n 65536 in /opt/hwa/TWS/bin/tws_env profile only

135. Dynamic Workload Broker HCL HWA 10.2 ResourceAdvisorConfig.properties networkLatencyWeight=0.15 insufficient for 4200 low-latency trading jobs/hour across 165 multi-region agents yielding 33% high-latency allocations.

What weighting prioritizes network proximity?

ResourceAdvisorConfig.properties networkLatencyWeight=0.75

ResourceAdvisorConfig.properties enLatencyFence=YES

JobDispatcherConfig.properties networkTier=1

BrokerWorkstation.properties latencySensitivity=CRITICAL

136. HCL HWA 10.2 conman monitoring script tracks SLA violations: jobs due 14:00 running 14:30. conman "dj @-due=1400" returns empty.

Correct syntax for overdue jobs?

conman "overdue @"

conman "dj @-state=exec -due=+90m"

conman "dj @+state=exec;due>now-90m"

conman "dj @-late"

137. A Windows cluster environment is being set up to host an HCL Workload Automation agent that must be highly available. The administrator selects a node in the cluster and logs in with a Domain Administrator account to perform the installation.

In addition to installing on a specific virtual server or clustered role, what must the administrator verify about the node name to ensure end-to-end network configuration works correctly from the master domain manager?

The node name must be resolvable by DNS and its IP address must respond to ping from the master domain manager

The node name must match the database server hostname used by the master domain manager

The node name must be identical to the Windows domain NetBIOS name

The node name must be configured as the same as the Dynamic Workload Console hostname

138. Troubleshooting HCL HWA 10.2 Dynamic Workload Broker shows ResourceAdvisorConfig.properties agentHealthScoreDecay=0.95 causing 31% healthy agent exclusion during 4800 allocations/hour ramp-up. 142 agents available.

What decay adjustment includes healthy agents?

JobDispatcherConfig.properties healthScoreThreshold=0.4

BrokerWorkstation.properties rampupGracePeriod=3600

ResourceAdvisorConfig.properties agentHealthScoreDecay=0.75

ResourceAdvisorConfig.properties enRampupMode=YES

139. Scenario: Post-LDAP configuration in HCL Workload Automation 10.2 federated repositories, group memberships are not resolving correctly for role assignments in Manage Workload Security.

What advanced ldapRegistry attributes resolve nested group lookups in Active Directory? (Select two)

groupFilter="(&(cn=%v)(objectclass=group))"

searchPageSize="1000"

memberAttributes="memberOf" with nestedGroupSupport

recursiveSearch="true"

groupMemberAttributes="uniqueMember"

140. HCL HWA 10.2 multi-language message file corruption: msg/en_US/MSGS.trn overwritten by msg/pt_BR during locale switch. conman garbles Portuguese error codes.

What command recovers English catalog from backup preserving translations?

msgcat -rollback en_US; optman mod_MSG_LANGUAGE=en_US

rm -rf msg/pt_BR; msgcat -switch en_US

msgcat -restore en_US /backup/msg/en_US; msgcat -install en_US

cp -p /backup/msg/en_US/* msg/en_US/; msgcat -rebuild en_US

Page 15 of 26

141. HCL Workload Automation 10.2 container deployment on ECS EC2 launch type with EBS gp3 volumes encounters "iothreads exhausted" during configureDb despite 3000 IOPS provisioned. CloudWatch metrics show QueueLength 50+. Task definition cpu: 4096 memory: 8192.

Which container deployment EBS configuration using precise task definition volumes resolves I/O throttling?

launchTemplate: blockDeviceMappings: [{deviceName: "/dev/xvdb", ebs: {volumeSize: 500, volumeType: "io2", iops: 100000}}]

storageType: io2 size: 1000Gi iopsPerGB: 1000 multiAttachEnabled: true encrypted: true kmsKeyId: alias/hwa-key

volume: name: tws-data volumeType: gp3 size: 500 iops: 16000 throughput: 1000 deleteOnTermination: false

ebs: volumeSize: 500 provisionedIOPS: 3000 throughput: 250MiB/s encrypted: true volumeType: gp3

142. Monitoring HCL HWA 10.2 job failure patterns reveals 90% ABEND S0J123 on Windows agents. conman "dj @-abend=S0J*" syntax incorrect.

Correct pattern matching syntax?

conman "dj @-abend='S0J*'"

conman "dj @-state=abend -abend=S0J*"

conman "abends @ S0J*"

conman "dj @+abend=S0J123"

143. HCL HWA 10.2 MDM installation specifies custom installation properties in silent response file: TWS_JAVA_OPTS="-Xmx16g -XX:MaxMetaspaceSize=512m". Installation completes but Netman crashes on startup with OutOfMemoryError.

What property adjustment is required?

TWS_JAVA_OPTS must exclude Xmx parameter

Set JAVA_HOME to /opt/ibm/java-x86_64-11

Increase TWS_HEAP_MAX to 20g in localopts

Add -XX:+UseG1GC to TWS_JAVA_OPTS

144. Scenario: A domain manager in HCL Workload Automation 10.2 shows high CPU usage. Analysis reveals mailman is consuming excessive resources while processing a large number of internetwork dependencies.

Which inter-process communication mechanism is primarily involved in forwarding jobs to subordinate agents?

Courier.msg queue

Intercom.msg

Mailbox.msg

Batchmanbox.msg

Symphony.msg

145. In dwcinst for DWC 10.2, which parameter specifies the console administrator user?

-uname <user>

-consoleadmin <user>

-dwcuser <user>

-adminuser <user>

Automatic from OS

146. In a multi-user environment, excessive concurrent queries cause console slowdowns.

Which configuration helps enforce control limits?

Enabling cache on the engine side

Setting task limits in user preferences

Configuring global limits in console settings

Adjusting WebSphere heap size

147. To enable comprehensive auditing in HCL Workload Automation 10.2 for compliance, capturing all plan and database changes, which global options and additional steps are required? (Select All that Apply)

Run optman chg to apply changes and restart processes

Configure separate audit databases for storage

Set enDbAudit = yes in global options

Enable sidecar containers for audit log forwarding in container deployments

Set enPlanAudit = yes in global options

148. HCL HWA 10.2 workstation reset required after FTA corruption shows batchman reading stale PlanBox.msg from previous symreq (version mismatch), jobman semaphore exhaustion on Courier.msg, monman ignoring Moncmd.msg UPGRADE. Netman NetReq.msg stable.

What architecture-complete reset sequence preserves running jobs while rebuilding message files?

kill -9 all processes; TWS_home clean install

conman "resetws wsname"; preserve Courier.msg; netman recycle

evtsize all 20M; conman "flushq wsname"

conman "stop wsname#batchman, jobman, monman"; rm msg/*.msg; startup wsname#batchman

149. You are configuring full SSL encryption for communications between the Dynamic Workload Console (DWC) and a distributed network of dynamic agents in HCL Workload Automation 10.2.

To enforce the strongest possible encryption while maintaining compatibility with agents at version 10.2.2, which cipher suites and protocols should you prioritize in the localopts and SSL settings? (Select two)

Set SSL Encryption Cipher = HIGH:MEDIUM in the agent localopts to allow fallback

Enable TLSv1.3 exclusively with cha-cha20-poly1305 cipher suites for forward secrecy

Disable TLSv1.0 and TLSv1.1 explicitly in the WebSphere Liberty server.xml

Use RSA key exchange ciphers to ensure backward compatibility with older fault-tolerant agents

Configure the MDM and DWC to use only ECDHE-RSA-AES256-GCM-SHA384 and similar GCM ciphers

150. In a scenario where DB2 is configured in HADR for high availability reporting in Dynamic Workload Console connected to HCL Workload Automation 10.2, which datasource parameter enables automatic client reroute to the secondary database?

clientRerouteAlternateServerName and clientRerouteAlternatePortNumber in the jndiEntry URL

hadrConnection=true in localopts

enableHADR=true in the template file

failoverMode=HADR in datasource_DB2.xml

secondaryDbUrl in global options

Page 16 of 26

151. HCL HWA 10.2 DWC SSL encryption configuration disables HTTP/2: browser shows "ERR_SPDY_PROTOCOL_ERROR". Liberty server.xml access log confirms HTTP/1.1 only.

What sslProtocol setting enables HTTP/2 with TLS 1.3?

jvm.options: -Dcom.ibm.ws.transport.http2.enabled=true

server.xml: <featureManager><feature>transportSecurity-1.0</feature></featureManager>

sslProtocol="TLSv1.3"; alpn="h2, http/1.1"

152. A multinational financial institution deploying HCL Workload Automation 10.2 with Dynamic Workload Console (DWC) on a mainframe environment observes intermittent connection timeouts during peak trading hours when connecting to a DB2 for z/OS database. The DBA confirms adequate buffer pools (BP32K) and location (LOC1) exist, but the configureDb command fails with "zlocationname mismatch" errors during DWC database population.

Which parameter combination must be precisely specified in the configureDb.sh command to successfully create and populate the DWC schema on DB2 for z/OS while avoiding buffer pool contention?

--rdbmstype DB2Z --zlocationname LOC1 --zbufferpoolname BP32K --dbuser DWCUSER --dbhostname DB2HOST

--rdbmstype DB2Z --zlocationname DWCDB --zbufferpoolname BP16K --dbuser DB2ADMIN --dbhostname MAINFRAME

--rdbmstype DB2 --zlocationname LOC1 --zbufferpoolname BP32K --dbuser DWCADMIN --dbhostname ZSYSNAME

--rdbmstype DB2 --locationname LOC1 --bufferpool BP32K --dbuser SYSDBA --dbhostname DB2PORT

153. What are the impacts of running conman resetfta on a busy FTA in HCL Workload Automation 10.2? (Select All that Apply)

Triggers full Symphony resync

Clears stale job states and forces recovery

Stops and restarts agent processes automatically

Initiates agent recovery procedure as per troubleshooting guide

Requires manual relink if unlinked

154. Monitoring HCL HWA 10.2 reveals jobstream PAYROLL#20260107 in HOLD due to unmet prompt dependency "TAPE001". conman "prompts" shows 10 pending.

What conman command satisfies specific prompt releasing jobstream?

conman "delprompt TAPE001; rjs PAYROLL#"

conman "rjp TAPE001"

conman "satisfy prompt TAPE001"

conman "reply prompt TAPE001 YES @"

155. To display successors of a held job stream including cross-dependencies in HCL Workload Automation 10.2 conman, the command is?

showsched STREAM;succ

listsched STREAM;full

listsucc schedselect=STREAM;deps

showjobs STREAM;succ

showdeps succ

156. Database Installation for HWA 10.2 SQL Server 2019 Always On AG. twsinst fails "Cannot connect to listener port 1433". Primary replica listener configured but secondary unavailable.

Which db property enables HA failover?

Use port 5022 for AG listener

sqlserver.ag.mode=read_write

jdbc:sqlserver://listener-ag.hwa.com:1433;databaseName=HWADB;multiSubnetFailover=true

Set TWS_DB_FAILOVER=true

157. Scenario: In HCL Workload Automation 10.2 containers, custom certificates must include which files in the mounted directory for automatic processing? (Select three)

server.key.pem

password.stash

TWSServerKeyFile.jks

server.cert.pem

ca.cert.pem

158. Scenario: During an audit, it is discovered that dynamic agents in HCL Workload Automation 10.2 are using default certificates post-upgrade from 9.5, leading to potential manin- the-middle risks. The upgrade used default settings.

What post-upgrade actions are necessary to enforce custom SSL encryption across all agents without reinstalling them? (Select all that apply)

Run certman generate on MDM and propagate to agents

Convert default certificates using the conversion utility before applying custom ones

Deploy custom PEM files via Kubernetes secrets if containerized

Execute AgentCertificateDownloader on each agent with updated parameters

Manually update agent localopts with custom SSL key and certificate paths

159. An administrator wants to restrict resource-intensive operations in the Dynamic Workload Console.

Which limits can be configured globally? (Select All that Apply)

Maximum concurrent monitor tasks per user

Maximum number of engine connections per console

Maximum report execution time

Maximum number of objects returned in a single query

160. During Dynamic Workload Console installation in 10.2 using dwcinst, which parameter skips the system prerequisite checks?

-prereq false

-skipprereq true

-checkprereq false

-noprereqcheck

-skipcheckprereq true

Page 17 of 26

161. Production automatic failover in HCL Workload Automation 10.2 completes in 45 seconds but event rule processing stalls on BDM due to missing event processor designation.

To configure automatic event processor failover with workload continuity, which domain parameter designates BDM as hot standby event processor?

conman "configure failover event=auto BDM"

alter domain failover.eventproc=true backup=BDM_HOST

[EventProc] failover.automatic=true in BDM config

Set domain eventproc.backup=BDM_HOST auto=true

162. In HCL Workload Automation 10.2 troubleshooting, primary engine log and trace files using CCLog are located in which directory structure?

<TWA_DATA_DIR>/CCLog/<date>/<component>

Agent-specific JavaExt/logs

<TWA_DATA_DIR>/stdlist/logs/<yyyy.mm.dd>/<process_name>.log

<TWA_HOME>/TWS/logs/<date>/traces

WebSphere Liberty logs directory

163. HCL HWA 10.2 critical path CP=19h32m stalls on FTA batchman Intercom.msg read failure from mailman during production cycle symreq. Jobman Courier.msg launches fault-tolerant.

What reset isolates batchman-mailman dependency preserving production?

planman resyncplan wsname /MAILMAN

conman "resetws wsname --mailman"

evtsize Intercom.msg 30M; batchman recycle

conman "stop wsname#batchman, mailman"; startup wsname#netman

164. In HCL Workload Automation 10.2, which directories contribute to the disk space calculation required for backing up or upgrading the installation, excluding the full TWA_home overhead?

TWA_HOME/wastools

TWA_HOME/TDWB

TWA_HOME/ssl

TWA_HOME/properties

TWA_HOME/TWS

165. Financial trading workload customization requires VT.MARKET.OPEN="NYSE:0930-1600" with automatic DST adjustment. Current carry forward ignores timezone changes.

Which VT directive implements market-hours automation with DST awareness?

@MARKET @AUTO_DST

#VT MARKET @DST @CARRYTZ

VT MARKE

OPEN="NYSE:0930-1600" @DST(aware) @CARRY(tz)

TABLE MARKET OPEN="NYSE:0930-1600" DST=true

166. HCL HWA 10.2 dynamic agent in Kubernetes shows JobManager unable to report statuses despite agent.dynamic.gateway.port=31114 correct, with ssmagent flooding Monbox.msg file events. Netman cycles NetReq.msg LINK retries but gateway remains responsive. Monman edwa connection timeout=180s logs appear.

What environment variable misconfiguration causes this JobManager-monman linkage failure?

T(ssmCheckFile)=300 excessive polling

agent.dynamic.gateway.jmFullyQualifiedHostname mismatch

edwa connection timeout=90 too restrictive

enEventProcessorHttpsProtocol=NO setting

167. HCL HWA 10.2 HA certificate management synchronizes keystores via shared storage but backup MDM shows "truststore alias mismatch". Primary rotated certificate, backup stale.

What automated certificate propagation ensures HA consistency?

Create /shared/ssl symlink to NFS keystore.jks; localopts SSL_KEYSTORE=/shared/ssl/keystore.jks

rsync -av /opt/hcl/twa/TWS_eclipse/ssl/ root@backup-mdm:/opt/hcl/twa/TWS_eclipse/ssl/

conman "syncssl @backup-mdm"; cron job every 5 minutes

Backup MDM reads certificates from primary via heartbeat sync

168. Combining topics: In a typical installation planning for high-availability with containers in HCL Workload Automation 10.2, hardware must support multiple instances.

What is key for backup master?

Lower CPU than primary

Shared database access and sufficient swap

Container-only restriction

No additional disk needed

Independent schema creation

169. Scenario: In a large enterprise HCL Workload Automation 10.2 deployment with centralized security enabled, an administrator needs to grant a group of operators the ability to submit and monitor job streams in the "/Finance" folder and its subfolders, but deny them access to modify database objects or access any other folders. Additionally, they must be able to display the plan but not perform actions like kill or rerun.

Which advanced security file entries achieve this granular control? (Select three)

PLAN ACCESS=DISPLAY

CPU=@+FOLDER="/Finance/*" ACCESS=DISPLAY, SUBMIT

RESOURCE NAME=@ ACCESS=DISPLAY

FOLDER NAME="/Finance/*" ACCESS=USE

JOBSTREAM NAME=@+FOLDER="/Finance/*" ACCESS=DISPLAY, SUBMIT, MONITOR

170. Scenario: Inter-process communication issues are suspected on the master domain manager in HCL Workload Automation 10.2, with messages not propagating between batchman and mailman. To diagnose, you need to check message queue files for corruption or overflow.

Which message files are critical for local IPC? (Select three)

Jobmanbox.msg

Batchmanbox.msg

Mailbox.msg

Monmanbox.msg

Appserverbox.msg

Page 18 of 26

171. Scenario: In a large-scale deployment, hardware requirements vary by component.

What additional consideration applies for Dynamic Workload Console in HCL Workload Automation 10.2?

Minimum 4 GB RAM fixed

Shares exact master requirements

Separate hardware recommendations in its own requirements report

No swap space needed

Only container-specific

172. Scenario: planman crt hangs indefinitely. Diagnosis points to database lock. Resolution sequence?

Restart master processes

Check Liberty logs only

planman resync first

Switchmanager and retry

planman showinfo ; planman unlock ; retry crt

173. Backup MDM HWA 10.2 installation with certificate pinning: Primary rotates SSL cert, backup fails Symphony sync "Peer certificate untrusted".

Property to refresh truststore?

conman "refreshssl @/@"

twsinst -backup -regenerate_ssl

keytool -import -trustcacerts -alias newca -file newca.crt -keystore $TWA_HOME/ssl/truststore

Certs auto-sync on Netman heartbeat

174. Scenario: An administrator is troubleshooting plan access issues after a DB2 password change for the HCL Workload Automation 10.2 user.

Which file requires updating with the encrypted new password?

Security file on the master

JobManager.ini on dynamic agents

localopts on the master domain manager

datasource_DB2.xml in the Liberty server resources

TdwcGlobalSettings.xml in the console overrides

175. HCL HWA 10.2 workstation architecture shows FTA batchman stalled on Intercom.msg reads from mailman during MDM partition fence (split-brain); jobman Courier.msg launches continue fault-tolerant. NetReq.msg empty.

What reset isolates partition recovery preserving autonomous execution?

evtsize Intercom.msg 25M; force batchman slide

conman "resetws wsname --fence-only"; preserve Courier.msg

conman "stop wsname#batchman, mailman"; startup wsname#netman

Full workstation unlink/link sequence

176. In a complex HCL Workload Automation 10.2 environment with a Master Domain Manager (MDM) upgraded to version 10.2.5 and multiple Dynamic Workload Consoles (DWC), you plan to replace the default self-signed certificates with CA-signed certificates for enhanced security in communications between MDM and DWC.

Which of the following steps are mandatory to ensure seamless bidirectional trust after importing the new CA-signed server certificate into the MDM's TWSServerKeyFile.jks keystore? (Select three)

Update the SSL protocol settings in the server.xml file on the DWC to reference the new keystore password if changed

Copy the updated TWSServerKeyFile.jks and TWSServerTrustFile.jks from the MDM to all DWC installations, overwriting existing files

Restart the WebSphere Liberty server on the MDM and DWC after keystore modifications

Run the AgentCertificateDownloader utility on the DWC to propagate the new certificates

Import the CA root certificate into the TWSServerTrustFile.jks on the MDM using keytool -importcert command with -trustcacerts option

177. HCL HWA 10.2 Orchestration CLI deployment fails container orchestration: ocli create template containerized_app.yaml returns "ORCH_UNKNOWN_TYPE". YAML specifies kubernetes pod spec.

What prerequisite ocli command registers Kubernetes orchestrator?

ocli create domain ORCH_K8S type=kubernetes endpoint=k8s-master:6443

ocli setup kubernetes -namespace hwa-orchestration -serviceaccount hwa-controller

ocli configure provider kubernetes --kubeconfig /root/.kube/config

ocli register orchestrator kubernetes -endpoint k8s-master:6443 -token $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

178. A HCL Workload Automation administrator is asked to explain why granting a user the ability to log into the Dynamic Workload Console does not automatically give that user the right to modify scheduling objects. The environment uses a mix of built-in and custom roles.

Which mechanism controls what actions a user can perform within the console once authenticated?

The db.user account associated with the engine database

Operating system group memberships on the master domain manager host

Role-based permissions defined through custom roles in the Manage Roles page

Command history stored in the HWA database

179. To uninstall an agent silently in HCL Workload Automation 10.2 on UNIX, which twsinst flag is used?

-silent yes

-quiet

-unattended

-noninteractive

--prompt no

180. HCL Workload Automation 10.2 Global Options enforce earliest start time skew correction, but multi-timezone streams desync.

To enable timezone-normalized globals, which setting activates?

modify global est.normalizeTZ=true; refresh

alter global est.timezoneNormalize=true; unlock global

alter global timeSkew.global=true; commit

set global skew.timezone=true; apply

Page 19 of 26

181. Dynamic Workload Broker shows ResourceAdvisorConfig.properties locationWeight=0.2 insufficient for 3800-job EU→US cross-region allocations costing 42% premium. 145 agents available.

What broker parameter prioritizes geolocation?

JobDispatcherConfig.properties regionPreference=EU

ResourceAdvisorConfig.properties locationWeight=0.8

ResourceAdvisorConfig.properties enGeoFence=YES

BrokerWorkstation.properties geoAffinity=REQUIRED

182. HCL HWA 10.2 MDM certificate customization with ECDSA P-384 fails agent handshake: "javax.net.ssl.SSLHandshakeException: no cipher suites in common". Agents use RSA-only crypto.

Required localopts cipher suite configuration?

SSL_ENABLED_CIPHERS=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

localopts ENBSSL_SECURITY=YES; SSL_CIPHER_SUITE=ALL:!aNULL:!eNULL:!MD5

jvm.args: -Djdk.tls.server.cipherSuites=TLS_AES_256_GCM_SHA384

optman mod_HTTPS_CIPHER_SUITE="ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"

183. To implement a custom login banner or additional styling not covered by default branding in Dynamic Workload Console 10.2, which approach is recommended?

Modify the JazzSM dashboard templates directly

Use custom CSS overrides in the customization directory

Edit the core application JSP files

No additional styling is supported beyond logo and favicon

184. Which troubleshooting step addresses broker CLI failures to contact the server in containerized HCL Workload Automation 10.2 deployments?

Restart broker container

Set Broker.Workstation.host to pod IP

Additional configuration for Broker CLI environment variables

Update BrokerWorkstation.properties with service name

Use helm values to expose broker port

185. To automate production cycle extension every 48 hours in HCL Workload Automation 10.2 using the FINAL job stream, which modifications to the sample Sfinal are necessary? (Select two)

Include FINALPOSTREPORTS with CHECKSYNC job

Adjust run cycle in FINAL job stream to every 48 hours

Modify JnextPlan script directly for duration

Add planman deploy in FINAL

Set MakePlan invocation with -for 48:00 in FINAL

186. HCL HWA 10.2 agent installation using SSL with custom CA on SLES15 fails certificate validation: "PKIX path building failed". /opt/hcl/twa/TWS_eclipse/ssl shows empty truststore.

What twsinst parameter during agent install imports primary MDM CA certificate?

twsinst -acceptselfsignedcerts -mdmname PRIMARY_MDM

twsinst -copy_ssl_certs from_primary_MDM

twsinst -ssl_keystore /shared/ssl/agent-keystore.p12 -truststore /shared/ssl/ca-truststore.jks

Export MDM cert via keytool, manual import to agent truststore post-install

187. To support TLS 1.3 on dynamic agents in HCL Workload Automation 10.2.2 and later, which new parameters were introduced? (Select All that Apply)

ssl_config file

enableTLS13

ssl_cipher_suites

fipsMode

188. HCL HWA 10.2 monstop process panic during memory pressure: core dump 50GB fills $TWA_HOME. conman showmon shows engines stopped.

Safe recovery preserving core for analysis?

gdb $TWA_HOME/bin/monstop $TWA_HOME/core immediately

cp $TWA_HOME/core* /diag/core.$(date +%Y%m%d); truncate -s 0 $TWA_HOME/core.*

conman delp @; rm $TWA_HOME/core*; JnextPlan -for 0100

ulimit -c 0; echo "* hard core 0" >> /etc/security/limits.conf; conman startmon

189. Scenario: Planning hardware for a master domain manager in HCL Workload Automation 10.2.

Which additional base space is needed excluding scheduling data and RDBMS software?

500 MB for Liberty

579 MB on /usr

2 GB

600 MB for IMShared

1 GB temporary

190. Scenario: Backup master promoted via switchmgr, but event-driven actions delayed. To switch event processor without full JnextPlan, use?

conman "switchevtproc NEWMASTER"

planman deploy -switchevt

switcheventprocessor NEWMASTER

optman change evtproc=NEWMASTER

switchmgr evtproc;NEWMASTER

Page 20 of 26

191. Scenario: Fault-tolerant agent stop command in 10.2 for standalone FTA’.

StopAgent.sh

No specific, use OS kill

conman stop

ShutDown

conman shutdown

192. In HCL Workload Automation 10.2, to clear and reset inter-process message queues on the master if corrupted message files are blocking plan updates, which actions from command line? (Select two)

Restart netman to recreate queues

Stop all processes with StopWa

Delete contents of TWS_home/Mailbox.msg and Batchmanbox.msg

Use conman flushmsg

Run make -f Makefile cleanmsg

193. HCL Workload Automation 10.2 container deployment on GKE autopilot with workload identity federation fails database connectivity citing "SSL certificate verify failed". Vaultinjector annotates secrets correctly. Workload identity role lacks RDS CA access.

Which container deployment IAM configuration using precise annotations resolves SSL validation?

metadata: annotations: iam.gke.io/gcp-service-account: [email protected] runAsUser: 2000

serviceAccountName: hwa-server-sa annotations: "iam.gke.io/gcp-service-account": "[email protected]"

workloadIdentity: enabled: true gcpServiceAccount: [email protected]

securityContext: {gcpServiceAccountEmail: "[email protected]"} volumes: - name: ca secret: ca-cert

194. HCL HWA 10.2 workstation architecture shows batchman PlanBox.msg desync with MDM engine during symreq (5000 jobs); jobman Courier.msg launches fault-tolerant, netman stable. DWC reports "Plan out of sync".

What selective reset synchronizes PlanBox.msg preserving jobman queue?

rm PlanBox.msg; batchman recycle

conman "stop wsname#batchman"; evtsize PlanBox.msg 0; startup wsname#batchman

conman "resetsymreq wsname"; full msg rebuild

conman "flushq wsname#batchman"; monitor sync

195. HCL HWA 10.2 configuring authentication with RADIUS MFA fails 2FA challenge: "RADIUS ACCESS-REJECT". FreeRADIUS configured but Liberty auth_radius_config.xml missing challenge-response.

Required configuration?

server.xml: <jaasLoginModule loginModuleRef="radiusMFA" challengeResponse="true"/>

FreeRADIUS handles MFA challenge automatically

RADIUS MFA unsupported in Liberty, use SAML instead

196. Scenario: An organization chooses a typical installation path for HCL Workload Automation 10.2 components.

Which additional disk space is required beyond the base installation files?

600 MB on the file system where IMShared directory is located

1 GB for temporary container volumes

500 MB for Liberty profile updates

2 GB swap space minimum

579 MB on /usr file system

197. Scenario: Uninstalling the Dynamic Workload Console in HCL Workload Automation 10.2 fails due to locked files.

What is the most likely cause and immediate resolution step?

Pending jobs in plan; cancel them first.

Active user sessions; log out all users.

Insufficient privileges; run as root/admin.

Database connection open; disconnect from DB2/Oracle.

WebSphere Application Server Liberty Base still running; stop it first.

198. A multinational HCL Workload Automation 10.2 setup enforces Global Settings using Security file to restrict job stream deadlines to business hours per region, but Asia-Pacific streams ignore the restriction due to missing region mapping.

Which security file configuration implements region-aware deadline enforcement?

[GlobalDeadlineRules] APA

maxDeadline="18:00"; E

maxDeadline="17:00"

global.regionDeadline.APAC=18:00; EU=17:00

Define region.deadline.APAC=18:00 in [SecurityGlobal]

[Regions] APAC=18:00 under global deadline section

199. Scenario: In a high-availability HCL Workload Automation 10.2 environment with master and backup dynamic domain managers, after performing a switchmanager to the backup, dynamic jobs fail to submit with AWSJOM177E error indicating the workload broker server is unreachable for pool workstations.

What are the root causes and required corrective actions? (Select three)

Broker.Workstation.PortSSL property mismatch between primary and backup

Manual update of dynamic domain manager database to reflect new broker workstation

Restart WebSphere Liberty on both master and backup to force replication

Database fields in PPS_PRODUCT_PROPERTIES table not updated correctly after switch

Temporary switch does not propagate broker configuration automatically

200. planman deploy is required after event rule changes because?

Rules remain in draft until deployed

Integrates with database resync

Non-draft rules need manual deployment for activation

Deploys to all agents immediately

Automatic only on JnextPlan

Page 21 of 26

201. HCL HWA 10.2 certificate customization audit reveals default IBM CA still active alongside corporate CA. keytool -list shows 15 aliases.

What cleanup sequence removes deprecated certificates safely?

for alias in $(keytool -list |grep IBM |awk '{print $2}'); do keytool -delete -alias $alias -keystore keystore.jks; done

rm -rf TWS_eclipse/ssl/*.jks; regenerate default certificates via twscert

keytool -delete -alias ibm-* -keystore keystore.jks -storepass tws; keytool -list -v |grep -i expired

Only active alias used by serverKeyAlias matters, ignore others

202. A production HCL Workload Automation 10.2 MDM installation on RHEL9 fails during twsinst -new -mdm with error "SSL certificate validation failed for database connection". The DBA confirms DB2 11.5 is configured with TLS 1.3 only.

Which installation property must be added to the response file to bypass this during initial setup?

db.ssl.truststore=/opt/IBM/db2/ssl/truststore.jks

ignore.db.ssl.validation=true

use.db.tls12.compatibility=false

tws_db_ssl_enabled=false

203. In Orchestration CLI 10.2 extended with model commands, to create a new workstation definition from JSON file "new_agent.json" in the database, the command is?

ocli model import workstation.json

ocli plan addcpu new_agent.json

ocli model add --json new_agent.json

ocli model create workstation --file new_agent.json

ocli composer add new_agent.json

204. In HCL Workload Automation 10.2, configuring SSL encryption for the netman process on the MDM requires updates to which files and parameters for high-strength ciphers? (Select two)

Symphony file encryption separately via optman

HTTPOPTS with HTTPS keyword for console connections

server.xml in Liberty for feature ssl-1.0 and strong ciphers list

ita.ini on agents with SSL Encryption Cipher = EXPORT

localopts with nm SSL port set and cipher = HIGH:!aNULL

205. In deploying with containers for HCL Workload Automation 10.2 on OpenShift, what is the minimum high-availability configuration?

2 servers and 2 consoles

Z-centric only

Single server with backup agent

Standalone console

1 master and multiple dynamic agents

206. Scenario: In a HCL Workload Automation 10.2 production plan, a critical job stream "PROD_DAILY" on workstation "MDM" has multiple jobs in HOLD state due to resource dependencies, and you need to release specific jobs while adding a temporary priority without affecting successors.

Which conman commands achieve this precisely? (Select three)

submit adhl;adhoc=MDM#PROD_DAILY;priority=hi

alter job;jobselect=MDM#PROD_DAILY(0800 01/07/2026).JOB1;priority=100

limit cpu;cpu=MDM;limit=50 followed by rerun

reply prompt;promptselect=@#CRIT_PROMPT;answer=yes

release job;jobselect=MDM#PROD_DAIL

JOB2;deps

207. Scenario: Need real-time console messages for jobman processes on a remote FTA during linkage troubleshooting in HCL Workload Automation 10.2. From MDM conman, how?

fence console

console cpu=FTA01;level=4;to terminal

showlogs cpu=FTA01

start console on FTA01

tellop cpu=FTA01 info

208. Scenario: Internetwork dependencies cause issues with external job streams not carrying forward.

Which global option resolves this?

enAllExternalCarry=1

carryExternal=yes

enInternetworkDepsCarryforward=yes

forwardInternetwork=all

globalExternalForward=yes

209. HCL HWA 10.2 Dynamic Scheduling 2500 rules across 4 rule processors shows uneven distribution (processor0=68%, others<10%) causing 22% timeout during 4000 events/minute ecommerce peak.

What StatefulSet annotation forces rule load balancing?

DWC workload designer rule redistribution manual

ruleProcessor.replicas=8; affinity.spreadNode=true

HorizontalPodAutoscaler targetCPUUtilizationPercentage=70

statefulset.spec.template.metadata.annotations."rule-balancer"=enabled

210. Deploying HCL HWA 10.2 ruleset UPDATE_AGENTS across fault-tolerant agent pool fails on Windows agents: "RULE_PARSE_ERROR". Unix agents accept successfully.

What conman command diagnoses platform-specific rule syntax errors?

conman "validate rule UPDATE_AGENTS"

conman "debugrule UPDATE_AGENTS"

conman "testrule UPDATE_AGENTS @WINDOWS"

conman "showrule UPDATE_AGENTS -syntax"

Page 22 of 26

211. Retail chain performs HCL Workload Automation 10.2 server installation for Black Friday peak but experiences monman OOM during makprod of 200K job streams. Htop shows 85GB RSS despite 128GB allocation. /proc/sys/vm/swappiness=60.

Which server installation memory tuning using precise sysctl parameters prevents OOM under peak seasonal workloads?

echo 1 > /proc/sys/vm/zone_reclaim_mode; sysctl vm.page-cluster=0 vm.stat_interval=10

ulimit -v unlimited; echo always > /proc/sys/vm/dirty_writeback_centisecs; sysctl vm.min_free_kbytes=1G

sysctl kernel.shmmax=0x80000000 kernel.shmall=2097152 vm.max_map_count=1048576

sysctl vm.overcommit_memory=1 vm.vfs_cache_pressure=50 vm.dirty_ratio=15 vm.swappiness=10; echo 3 > /proc/sys/vm/drop_caches

212. Production cycle HCL HWA 10.2 shows 42% dynamic agent plan desync during symreq peak (3600 jobs submitted). Gateway port 31114 responsive. FTA workstations stable.

What planman parameter forces dynamic workstation synchronization?

planman resyncplan all /DYNAMIC

conman "resetsymreq dynamic#*"

agent.dynamic.gateway.retry=10; symreq retry

planman symreq dynamic#* /WAIT=900 /FORCE

213. HWA 10.2 Installing MDM with Backup: Primary completes, backup twsinst -backup fails "MDM communication port 31115 blocked". netstat shows port open.

Which firewall property on backup node?

Use TLS port 4243 instead of cleartext 31115

Set TWS_COMMUNICATION_PORT=31116 in backup localopts

firewall-cmd --add-port=31115/tcp --permanent on primary only

Open bidirectional 31115/tcp between MDM/backup nodes

214. Scenario: Multiple jobs are stuck in WAIT state due to unavailable resources across domains.

To release resource dependencies selectively without affecting priorities in HCL Workload Automation 10.2, use?

alter resource;quantity=unlimited

release resource

fence resource

deldep job @#@ + state=wait;type=resource;confirm

limit resource;quantity=0

215. A command-line user needs to run conman monitoring commands such as showjobs and showresources against a remote master domain manager from a dedicated monitoring server. The administrator wants to avoid passing connection arguments on every command and to prevent storing the user’s password in scripts.

According to HCL Workload Automation 10.2 connection handling, which approach best satisfies these requirements?

Define connection parameters such as hostname and port as local options in the localopts file on the monitoring server, and rely on the logged-on user’s credentials for monitoring commands

Embed the connection parameters and password into an environment variable loaded from a script for each monitoring session

Store both username and password as plain text in the localopts file so that conman automatically logs in without user interaction

Configure the connection parameters exclusively as command-line arguments for each conman command and omit any local configuration

216. Creating HCL HWA 10.2 multi-domain hierarchy: EMEA domain DDM requires authentication to PARENT ASIA. composer create DOMAIN EMEA fails SEC_AUTH_REQUIRED.

What domain manager configuration establishes cross-domain trust?

On EMEA DDM: composer create link ASIA_DDM @; conman startnet ASIA_DDM

dumpsec -domaintrust add EMEA->ASIA; loadsec

On ASIA DDM: composer create security domain=EMEA access=submit; optman mod_CROSS_DOMAIN_AUTH=YES

optman mod_DOMAIN_TRUST_PARENT=ASIA; composer create workstation ASIA_DDM domain=ASIA

217. Which global option enables automatic activation of new security domains in the security file when created via Dynamic Workload Console?

enRoleBasedSecurityFileCreation

autoActivateDomains

securityDomainGlobal

enDomainAutoAdd

enAutoSecFileUpdate

218. AWS EKS HCL HWA 10.2 active-active HA certificate rotation fails; new wa-waserver certificates deployed but workstations report "SSL certificate verify failed". Old secrets remain. EKS IAM Roles for Service Accounts active.

What certificate rollout ensures zero-downtime rotation?

kubectl rollout restart statefulset wa-waserver-mdm1, wa-waserver-mdm2; kubectl rollout status

Helm upgrade --reuse-values --wait --timeout=600s

oc patch secret wa-pwd-secret --type merge -p '{"data.cert":"newvalue"}'

Delete old PVC data-hwa-waserver; force recreation

219. HCL HWA 10.2 backup MDM uninstallation rollback required after failed failover test leaves /var/spool/tws/workstation_name symlinks broken. Primary conman "addlink workstation_name" fails NLS. Manual symlink recreation path?

mkdir -p /var/spool/tws/workstation_name/{bin, logs, msg}; chown -R tws:twsgrp /var/spool/tws/workstation_name

rm -rf /var/spool/tws/*; conman "rnl @;delp @"

find /var/spool/tws -type l -delete; symlink recreated by JnextPlan

ln -s $TWA_HOME/methods /var/spool/tws/workstation_name/methods; ln -s $TWS_DATA_DIR $TWA_HOME/../TWS_data_dir

220. Typical HCL Workload Automation 10.2 installation on Ubuntu 22.04 LTS for DevOps encounters "AppArmor profile denied" blocking netman port 31114 bind despite ufw disabled. aa-status shows HWA profiles in enforce mode. Production requires dynamic agent connectivity.

Which AppArmor configuration using precise profile syntax permits server installation networking?

aa-complain /usr/lib/hwa/TWS/monman; systemctl restart snap.apparmor.hwa; aa-enforce /usr/sbin/netman

/etc/apparmor.d/disable/hwa-monman; update-apparmor-cache; systemctl restart monman

echo "|/usr/sbin/monman|" > /etc/apparmor.d/usr.lib.hwa.monman; echo "network tcp, " >> profile; apparmor_parser -r

ln -s /etc/apparmor.d/usr.sbin.netman /etc/apparmor.d/disable/; apparmor_parser -R

Page 23 of 26

221. HCL HWA 10.2 monman trace shows TWS_home/log/monman.trc "event rule SSL timeout=240s" to broker during 5200 dynamic events/hour. Monbox.msg 94% full.

What event trace isolates broker rule processing?

conman "starttrace wsname#monman RULE"

TWS_home/TWS/event.properties brokerDebug=YES

BrokerWorkstation.properties ruleTrace=VERBOSE

localopts TraceFlags=EVENTRULE, SSL; TraceLevel=DEBUG2

222. In HCL Workload Automation 10.2, customizing certificates for z/OS agents requires which specialized tools or formats? (Select two)

gskkyman or gskcapicmd for CMS keystore management

JKS conversion for Liberty compatibility

RACF keyring integration for SAF certificates

PKCS12 import directly into TWSServerKeyFile

ita.ini with FIPS-specific ciphers

223. To switch the event processor to a backup fault-tolerant agent "BKP_MDM" in HCL Workload Automation 10.2 during maintenance on the current master, ensuring minimal disruption to event-driven workload automation, which command is used?

switchmgr evtproc;BKP_MDM

switcheventprocessor BKP_MDM

optman sw evt=BKP_MDM

planman switchevt BKP_MDM

conman switchevtproc BKP_MDM

224. Customizing e-commerce workload in HCL Workload Automation 10.2, VT.PEAK.DISCOUNT=25% carries forward incorrectly post-Black Friday, inflating discounts.

To implement peak-season variable table with automatic reset post-event, which VT control prevents carry forward pollution?

#VT PEAK DISC="25%" carry=event reset=blackfriday

@VAR PEAK @CARRYLIMIT(event)

VT PEA

DISCOUNT="25%" @CARRY(event) @RESET(post)

TABLE PEAK DISC="25%" CARRY=PEAKONLY RESET=AUTOMATIC

225. Deploying HCL HWA 10.2 event rule across 200 agents fails partial deployment: 50 agents show "RULE_NOT_FOUND". conman "showrule BACKUP_START" inconsistent.

What conman command forces rule synchronization to all workstations?

conman "makerule BACKUP_START; JnextPlan"

conman "syncrule BACKUP_START @"

conman "rjs BACKUP_START @"

conman "deployrule BACKUP_START @/@"

226. Scenario: Hardware sizing for HCL Workload Automation 10.2 master with large plans. Beyond minimum, what is referenced for scaling?

Fixed 16 GB RAM

Liberty version dictates

No scaling needed

Container limits only

Supported Hardware document for deployment unit specifics

227. Scenario: Orchestration CLI configured with multiple contexts in config.yaml for dev and prod environments in HCL Workload Automation 10.2. To switch context and submit a critical job stream to production plan, sequence? (Select two)

ocli login prod

ocli plan submit --id CRIT_STREAM

ocli plan run --stream CRIT_STREAM;priority=100

ocli config switch prod

ocli context use prod

228. Scenario: To comply with organizational policy, all DWC sessions in HCL Workload Automation 10.2 must use HTTPS only, with HSTS enabled and no fallback to HTTP. Additionally, restrict console access to VPN IPs.

What Liberty configurations are needed? (Select three)

ssl element with hstsMaxAgeSeconds set to 31536000

remoteIPAddress filter with allow/deny lists

httpEndpoint with httpsPort only and httpPort="-1"

Add webAppSecurity with httpOnlyCookies="false" and HSTS headers

featureManager including transportSecurity-1.0 and servlet-5.0

229. HCL Workload Automation 10.2 templates for SAP integration fail @SAP.SID expansion across ECC/HANA systems.

To configure SAP-aware templates with dynamic system ID resolution from variable tables, which substitution leverages VT precedence?

@VAR SAP_SID="${resolve('vt.sap.sid')}"

DEFINE SAP @V

SID

TEMPLATE SAP @RESOLVE(sap)

#TEMPLATE SAP @SAPID()

230. In high-volume environments, to manage log growth while retaining traces:

External forwarding

In-memory only

Configure CCLog rotation limits and max files

Manual pruning

Disable non-critical traces

Page 24 of 26

231. Scenario: Mailbox.msg overflow on domain manager in HCL Workload Automation 10.2 causing command delays. To rotate or clear safely? (Select two)

Delete Mailbox.msg directly

Restart mailman to create new

Stop mailman process

Rename Mailbox.msg to .old

Use conman clearmsg

232. Scenario: An organization requires FIPS 140-2 compliance for all SSL communications in their HCL Workload Automation 10.2 deployment, including MDM-to-agent and DWC-to-MDM links. However, after enabling custom certificates, connections fail with handshake errors.

What are the most likely causes and required adjustments? (Select all that apply)

FIPS mode must be enabled separately in HTTPOPTS and agent ita.ini files

The custom certificates use ECDSA signatures incompatible with FIPS mode on Liberty

OpenSSL 3.0 libraries in version 10.2 do not fully support FIPS validation for P12 certificate formats

Default certificates must be converted to FIPS-compliant formats before custom replacement

TLSv1.3 is required for FIPS compliance and must be forced in server.xml

233. A security audit reveals that the db.user account used by HCL Workload Automation has been granted excessive privileges on the database, including schema modification rights that are not required for normal operations. The DBA wants to create a new restricted account with only the necessary permissions for HWA and update the engine configuration accordingly, while leaving the database name and host unchanged.

Which configuration changes in the HWA database properties are required to start using the restricted account?

Update db.user only, as the password will be retrieved automatically from the database

Update db.driver.path and db.sslConnection to restrict privileged operations

Update db.databaseName and db.portNumber to reference the restricted account schema

Update db.user and db.password to the new restricted account credentials, keeping db.databaseName and db.serverName unchanged

234. Configuring authentication HCL HWA 10.2 LDAP with nested groups fails role assignment: "User not member of TWSAdmins". Active Directory shows user in nested OU but Liberty basicRegistry ignores hierarchy.

Required Liberty configDropins/overrides/auth_LDAP_config.xml setting?

LDAP nested groups unsupported, flatten hierarchy in AD

auth_AD_config.xml: searchScope="subtree" groupMemberAttribute="member:uniqueName"

<ldapRegistry id="corpLDAP" ldapType="MicrosoftActiveDirectory" groupFilter="(&(member=%dn)(objectClass=group))"

235. Which version of Docker Compose is recommended for deploying HCL Workload Automation 10.2 containers?

Version 20.10 minimum

Version 2.3 or higher

Version 1.28 only

Docker Swarm mode

Latest podman-compose

236. Scenario: After upgrading to HCL Workload Automation 10.2, the existing customized FINAL job stream is not overwritten, but automated plan management behaves inconsistently.

How should the administrator upgrade the FINAL and FINALPOSTREPORTS job streams correctly?

Manually edit the MakePlan script to include new parameters

Export, modify, and reimport FINAL using composer

Run composer add Sfinal to incorporate updated sample job streams

Modify global options to disable automation and manage manually

Delete existing FINAL from database and recreate using Dynamic Workload Console

237. Workload security HCL HWA 10.2 prevents SQL injection in job parameters. Malicious job submits cmd="/bin/sh -c 'rm -rf /'; echo safe". Agent executes only "echo safe".

What security feature blocks command injection?

Methods scripts validate parameters before execution

JOB_PARAMETER_ESCAPING=YES in localopts

agent command parser strips shell metacharacters automatically

localopts PARAMETER_SANITIZATION=STRICT; CMD_INJECTION_PROTECTION=ENABLED

238. Scenario: You need to monitor real-time messages from batchman and mailman processes on the MDM for troubleshooting linkage issues in HCL Workload Automation 10.2.

Which conman command sequence? (Select two)

showlogs

console level=2

console off

console level=5;to terminal

tellop info

239. During the installation of a new HCL Workload Automation dynamic agent on an IBM i system, the administrator must specify the host that the agent will connect to, the installation directory, and other agent-related details. The target system will be part of an existing distributed environment, and the administrator wants to ensure the installer correctly registers the agent against the endpoint.

According to the IBM i agent installation parameters, which parameters are essential to correctly identify the host and installation directory?

db.serverName and db.databaseName parameters set in the engine configuration

db.portNumber and db.driver.path parameters supplied during installation

hostname and -inst_dir parameters supplied to the installation program

agent.dynamic.gateway.hostname and agent.dynamic.gateway.port parameters only

240. Certificates for z-centric agents in HCL Workload Automation 10.2 are handled how compared to distributed agents?

GSKit CMS

No certificates needed

Via system SAF keyring or endpoint configuration

Automatic propagation

Local JKS keystores

Page 25 of 26

241. Which parameters are used for broker connection during dynamic agent twsinst installation in 10.2?

-tdwbhostname <host>

-tdwbport <port>

-jmport <port>

-jmportssl true

-brokerport <port>

242. Automatic failover configuration testing in HCL Workload Automation 10.2 shows BDM assumes control successfully but workstation limits reset to defaults, violating SLA concurrency caps.

To preserve Global Options workstation limits across automatic failover without database replication, which failover parameter maintains configuration state?

Set switchmgr failover.configSync=globals workstation=true

conman "switchmgr auto preserve=globals workstationlimits"

alter domain failover.preserveGlobals=true backup=BDM_HOST

[Failover] globals.persistent=true in BDM JobManager.ini

243. Deploying HCL HWA 10.2 ruleset to 1000 Kubernetes ephemeral agents fails scalability. conman "deployrule" timeouts.

What bulk deployment optimization?

conman "deployrule -async BATCH_RULES @KUBE_*"

conman -threads 50 "deployrule BATCH_RULES @"

conman "groupdeploy KUBE_RULES"

conman "deployrule BATCH_RULES @KUBE_* -parallel"

244. DevOps team deploys HCL Workload Automation 10.2 Docker containers via docker-compose for microservices integration testing. Container exits with "license validation failed" despite valid LIC file mounted. docker-compose.yml exposes port 31114 correctly.

Which Docker deployment configuration using precise volume mount syntax and environment resolves license acceptance for containerized installation?

environment: LIC_PATH=/lic/TW

lic volumes: - ./license:/lic:ro -TWS_data:/TWS_data

docker run -e ACCEPT_LICENSE=yes -v licdir:/opt/ibm/TWS/lic --name hwa-server hwa-image

volumes: - /host/lic:/lic - ./TWS:/TWS_data:rw env: LICENSE_ACCEPTED=true

environment: - TWS_ACCEPT_LICENSE=yes volumes: - ./TWS/lic/TW

lic:/opt/hwa/TWS/lic/TW

lic:ro

245. HCL HWA 10.2 Liberty SSL troubleshooting for Dynamic Workload Broker shows appservman.*.trc "javax.net.ssl.SSLHandshakeException: No trusted certificate found". List files show 52-agent pool but DWC 28 agents. wa-pwd-secret mismatch suspected.

What certificate validation confirms broker isolation?

conman "testssl broker"; DWC refresh

openssl x509 -in wa-pwd-secret.crt -checkend 365; netstat -ltnp | grep 55443

BrokerWorkstation.properties: sslTruststorePath verification

keytool -list -v -keystore $TWS_HOME/TWS/certs/truststore.jks | grep -i broker; openssl s_client -connect localhost:55443

246. Which planman command replicates the active production plan data from Symphony file to the database after a manual plan modification in HCL Workload Automation 10.2?

planman showinfo

planman deploy

planman unlock

planman checksync

planman resync

247. Restrict HCL HWA 10.2 access to production plans only for operators. Test plans prefixed TEST_ accessible.

What database trigger enforces plan prefix security at Symphony load?

RBAC enforces plan access at application layer

localopts PLAN_PREFIX_RESTRICTION=PROD_

composer create security plan PROD_* access=Operator

CREATE TRIGGER restrict_plans BEFORE INSERT ON SYSTW

PLAN_INSTANCES FOR EACH ROW WHEN (NE

PLAN_NAME NOT LIKE 'PROD_%') SIGNAL SQLSTATE '72000'

248. During HCL HWA 10.2 installation on AIX 7.2, the administrator sets TWA_HOME=/usr/lpp/twas and TWS_DATA_DIR=/dbdata/twas_data exceeding 4TB total with joblog archiving enabled. twsinst reports "Insufficient disk space in TWS_DATA_DIR".

What is the precise calculation for minimum required space in TWS_DATA_DIR?

TWA_HOME size x 2 + 20% for database growth

1.5x TWA_HOME + log retention period in days x 100MB

2x TWA_HOME size + 10GB per 1000 jobs/day

TWA_HOME size + 500MB per CPU core + swap space

249. Master domain manager failover during HCL HWA 10.2 production cycle leaves 75 FTAs with stale Symphony causing planman UPGRDJSTREAM "version mismatch" for 2400 final streams. Secondary MDM Symphony sync complete.

What production cycle recovery synchronizes workstations?

conman "startup fta75#"; planman resyncplan

Secondary MDM planman create; primary extend

planman symreq fta75#; planman UPGRDJSTREAM /FORCE

conman "resetsymreq fta75#*"; upgrade manually

250. HCL HWA 10.2 DWC high availability installation across 2 WebSphere Liberty nodes fails session affinity: users logged out after Liberty node1 -> node2 failover. http_session properties misconfigured.

Correct server.xml memstore setting?

memstore-1.0 feature with <memStore id="defaultMemstore" maxInMemorySessions="100000"/>

sessionManager sticky sessions via load balancer cookie JSESSIONID

Page 26 of 26

251. Scenario: Multiple variable tables with overlapping names in HCL Workload Automation 10.2. Resolution order is critical.

What determines priority?

Table creation date

Default always last

Size of table

Alphabetical name

Assignment sequence: job overrides stream overrides folder

252. HCL HWA 10.2 DWC SSL encryption with mTLS fails agent registration: "client certificate authentication failed". Liberty truststore missing agent CA.

Correct keytool command sequence for chain trust?

keytool -importcert -alias agent-root-ca -file agent-ca.crt -keystore dwc-truststore.jks -noprompt

Liberty auto-imports agent certificates from MDM truststore

keytool -importkeystore -srckeystore agent-ca.p12 -destkeystore server.xml truststore -srcalias agent-ca

server.xml: <sslClientAuth trustStoreRef="agentTrust" clientAuthEnabled="true"/>

253. Scenario: An event rule monitoring file creation has been updated to include additional actions, saved as non-draft, but agents are not detecting events due to outdated configuration.

How to force redeployment in HCL Workload Automation 10.2?

planman deploy -force

planman deploy -update

planman deploy -reload

planman deploy -scratch

planman deploy -reset

254. An HCL Workload Automation 10.2 security policy mandates that Global Settings on Job Streams prohibit external file dependencies for production streams via the security file.

Developers bypass this by using UNC paths.

Which security file entry blocks all external file dependencies globally?

Define NO_EXTERNAL_DEPS=true under [Global]

global.fileDep.external=deny in [Security]

[Dependencies] externalFiles=disabled

[GlobalStreamSettings] allowExternalFiles=false

255. Which planman command syntax is correct for creating an intermediate production plan (Symnew) spanning exactly 36 hours starting from a specific timestamp, accounting for timezone in a HCL Workload Automation 10.2 distributed environment?

planman crt -from 01/07/2026 00:00 -for 36:00

planman extend -for 36:00

planman crttrial Symnew -for 36:00 -days 1

planman create -from 01/07/26 0000 -to 01/08/26 1200

planman crt -from 01/07/2026 00:00 timezone UTC -for 36:00

256. To enable Single Sign-On using LTPA tokens between the Dynamic Workload Console and Master Domain Manager in HCL Workload Automation 10.2, which steps are mandatory after generating shared keys? (Select three)

Restart Liberty servers on both DWC and MDM

Enable SPNEGO for Kerberos fallback

Copy the ltpa.keys file to <TWA_HOME>/usr/servers/engineServer/resources/security on MDM

Configure <ltpa keysFileName="ltpa.keys" keysPassword="encoded"/> in server.xml

Run wa_create_ltpa_keys.sh with matching password on one instance and propagate

257. Scenario: To enable auditing of database changes in HCL Workload Automation 10.2, an administrator uses optman.

Which option and value should be set?

optman chg auditDb=enabled

optman chg dbAuditEnabled=yes

optman chg enDbAudit=1

optman chg auditStore=database

optman chg enPlanAudit=1

258. HCL HWA 10.2 audit trail troubleshooting shows auditbox.msg 95% capacity during Liberty failover (5200 conman Appserverbox.msg commands/hour). Batchman Courier.msg stable. DWC audit viewer truncated. TWS_home/log/audit.trc missing.

What audit trail parameter prevents Liberty overflow?

BrokerWorkstation.properties auditRetention=14d

globalopts AUDITFILESIZE=200M; Liberty auditLevel=INFO

conman "flushaudit wsname#appservman"

localopts AuditBoxSize=250M; enAuditCompression=YES

259. In HCL Workload Automation 10.2, configuring workload security to allow a user to list and display reports but deny submission of ad-hoc reports or deletion, which security file entries are required? (Select two)

FILE NAME=@ ACCESS=DISPLAY

REPORT ACCESS=LIST, DISPLAY

QUERY NAME=@ ACCESS=USE

REPORT ACCESS=SUBMIT=NO

REPORT ACCESS=DELETE=NO

260. Orchestration CLI HCL HWA 10.2 canary deployment validates 5% traffic: ocli deploy canary-app.yaml --strategy canary --weight 5 fails "ORCH_CANARY_UNSUPPORTED".

What prerequisite controller installation?

ocli configure strategy canary -orchestrator kubernetes

ocli plugin install kubernetes/canary --version 2.0.1

kubectl apply -f hwa-canary-controller.yaml

Canary strategy uses istio by default

HCL-HWA-ADM-102 HCLSoftware Certified Administrator- HWA 10.2 Exam Preparation Resources

HCL-HWA-ADM-102 HCLSoftware Certified Administrator- HWA 10.2 Exam Preparation Resources

Share this post

Leave a Reply Cancel reply

Related Posts

HCL-BF-PRO-10 HCLSoftware U Certified Professional-BigFix Platform 10 Online Dumps