Scenario: During an audit, it is discovered that dynamic agents in HCL Workload Automation 10.2 are using default certificates post-upgrade from 9.5, leading to potential manin- the-middle risks. The upgrade used default settings. What post-upgrade actions are necessary to enforce custom SSL encryption across all agents without reinstalling them?
(Select all that apply)

• A. Execute AgentCertificateDownloader on each agent with updated parameters
• B. Deploy custom PEM files via Kubernetes secrets if containerized
• C. Manually update agent localopts with custom SSL key and certificate paths
• D. Run certman generate on MDM and propagate to agents
• E. Convert default certificates using the conversion utility before applying custom ones

During a security hardening review of an HCL Workload Automation 10.2 environment, the security team mandates that the database password for the master domain manager must be rotated quarterly without exposing the clear text password in any file and without restarting the Dynamic Workload Console or master domain manager services. The workload automation administrator decides to use the vendor-provided secure script to encrypt the new password and then update only the relevant configuration so that both the engine and the Dynamic Workload Console use the new credential seamlessly. Which action best satisfies these requirements while minimizing downtime?

• A. Run the secure password script to encrypt the new password, update db.password and restart both the master domain manager and Dynamic Workload Console servers to reload the encrypted credential
• B. Edit the db.password property in both the master domain manager and Dynamic Workload Console configuration files with the clear text password and rely on the JVM's internal obfuscation during startup
• C. Run the secure password script to encrypt the new password and update only the db.password property in the master domain manager's properties file, leaving the Dynamic Workload Console configuration unchanged
• D. Run the secure password script to encrypt the new password, update db.password in the master domain manager properties and the corresponding JDBC URL password in the Dynamic Workload Console overrides configuration, and then reload only the affected web application context

Installing Backup MDM in HWA 10.2 cluster: Primary MDM uses TLS with custom CA cert. twsAudit.sh on backup fails "Certificate verify failed". During backup install, which property ensures SSL interoperability?

• A. Copy /etc/pki/tls/certs/ca-bundle.crt from primary
• B. Set localopts SSL_KEYSTORE=/shared/keystore.p12
• C. twsinst -backup -copy_ssl_certs true
• D. Generate self-signed certs on backup separately

In a complex HCL Workload Automation 10.2 environment with a Master Domain Manager (MDM) upgraded to version 10.2.5 and multiple Dynamic Workload Consoles (DWC), you plan to replace the default self-signed certificates with CA-signed certificates for enhanced security in communications between MDM and DWC. Which of the following steps are mandatory to ensure seamless bidirectional trust after importing the new CA-signed server certificate into the MDM's TWSServerKeyFile.jks keystore?
(Select three)

• A. Run the AgentCertificateDownloader utility on the DWC to propagate the new certificates
• B. Restart the WebSphere Liberty server on the MDM and DWC after keystore modifications
• C. Import the CA root certificate into the TWSServerTrustFile.jks on the MDM using keytool -importcert command with -trustcacerts option
• D. Update the SSL protocol settings in the server.xml file on the DWC to reference the new keystore password if changed
• E. Copy the updated TWSServerKeyFile.jks and TWSServerTrustFile.jks from the MDM to all DWC installations, overwriting existing files

Scenario: During production plan rollover, incomplete jobs with "carry forward" not set are lost. To ensure critical high-priority jobs always carry forward in future cycles in HCL Workload Automation 10.2, what configurations are required? (Select All that Apply)

• A. Set global carryforward = all
• B. Set carryforward attribute in individual job definitions
• C. Enable enCarryForward = yes in global options
• D. Define run cycles with carry forward enabled on job streams
• E. Use planman carryforward command post-rollover