Pass the Salesforce Developer Slack-Dev-201 Questions and answers with Dumpstech

Slack uses OAuth scopes to define and grant specific permissions to applications. Each scope authorizes access to a defined category of data or actions—for example, reading particular conversation information, viewing user information, or posting messages. Slack applications have no general API access by default; their effective privileges are determined by the scopes associated with their access tokens. Bot scopes grant permissions to the application's bot identity, while user scopes allow appropriately authorized actions on behalf of a user. Although application manifests can declare the scopes an application requests, the manifest itself is not the authorization mechanism. IP allowlisting can supplement token security but does not grant Slack API permissions, and workspace passwords are unrelated to application authorization. Therefore, OAuth scopes are the correct mechanism, making B the verified answer.

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

An incoming webhook is a simple mechanism for sending messages from an external system into a predefined Slack destination. When an incoming webhook URL is created, Slack associates that URL with a specific user and a specific channel. Current documentation states explicitly that the generated URL is tied to one channel. The webhook therefore works particularly well when an external service has a straightforward requirement such as sending alerts, notifications, or status information into one predetermined channel. The integration makes an HTTP POST containing a JSON message payload to the webhook URL. Option A conflicts with the fundamental behavior of a single incoming webhook URL. To support multiple destinations, separate webhook URLs or more flexible Web API methods may be required. Option D is also incorrect because incoming webhooks intentionally provide less destination flexibility than methods such as chat.postMessage. Slack specifically notes that an incoming webhook cannot override its configured destination channel, username, or icon through the message payload. Consequently, C accurately represents the architectural reason for selecting an incoming webhook. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly choosing between webhooks and Web API messaging methods.

Slack workflows can begin from multiple types of triggers rather than being limited to scheduled execution. Workflow Builder supports event-driven automation, and available triggers can include Slack activity, user-invoked links or shortcuts, scheduled execution, webhook-based initiation, and other supported events. Slack's developer examples specifically demonstrate workflows starting when an emoji reaction is applied, while Workflow Builder documentation describes combining supported triggers with workflow steps to create automations. The precise trigger choices available can vary by workflow architecture, workspace plan, and evolving Workflow Builder capabilities, but the central concept remains that workflows can start from many different events or user actions. Therefore, options A, C, and D are overly restrictive. Among the supplied answers, B best represents Slack's event-driven and scheduled workflow-trigger model and is the correct answer.

Message shortcuts operate in the contextual action menu of an existing Slack message. Slack's official shortcut documentation specifies that message shortcuts appear in the context menus of non-ephemeral messages. Therefore, an ephemeral message cannot serve as the source message for a message shortcut, making B correct. This restriction follows from the underlying interaction model. Message shortcuts preserve context from the source message so an application can perform an action based on that message—for example, creating a ticket, escalating an incident, or sending content to an external system. Ephemeral messages have restricted visibility and lifecycle behavior and are excluded from this shortcut surface. Option D is incorrect because every shortcut invocation must be acknowledged promptly, regardless of how many shortcuts the app defines. Current Slack UX guidance requires shortcut requests to be acknowledged with an HTTP 200 response within three seconds. Option C is not a general rule; follow-up notification mechanics depend on the interaction payload and workflow. A's fixed limit of three message shortcuts is not the applicable platform rule represented here. This belongs to Design the Interactive Flow of Your App, particularly message shortcuts and contextual interactions.

Application governance in an Enterprise Slack organization is performed through administrative roles rather than ordinary channel members or application developers. Slack currently allows Org Owners, Org Admins, and appropriate administrative roles to view and manage applications at the organization level. Organization administrators can approve or restrict applications and establish policies that affect workspaces throughout the organization. At the workspace level, Workspace Owners and designated app managers can review requests and manage applications within the authority allowed by organization-wide policies. Slack support does not perform routine customer app approvals, and the original application developer does not control whether another organization's administrators permit installation. Although current Slack role models are more granular than the wording of the question, option B correctly represents the responsible administrative groups.

Block Kit Builder is Slack's official visual prototyping environment for designing and previewing Block Kit interfaces. Developers can use it to assemble blocks, configure their properties, rearrange components, inspect the resulting structured payload, and preview how the interface will appear within supported Slack surfaces. Slack's Block Kit documentation specifically recommends using Block Kit Builder to experiment with available blocks before incorporating the generated structures into an application. This is especially useful when designing complex messages, modals, and Home tabs because developers can validate visual hierarchy and component compatibility interactively rather than repeatedly modifying application code. Slack Studio, Bolt Designer, and Surface Editor are not the official Block Kit prototyping tools described in Slack Developer documentation. Consequently, option A is the only answer that corresponds to Slack's documented visual interface-development tooling.

Slack modals are opened through the `views.open` Web API method using Bolt's built-in API client. After a shortcut, slash command, button click, or another qualifying interaction, Slack supplies a `trigger_id`. The application acknowledges the incoming interaction and promptly exchanges that trigger through `views.open` together with a valid modal view payload. In Bolt for JavaScript, this is commonly represented through the client's `views.open` interface; Bolt for Python exposes the corresponding `client.views_open()` method. The important platform primitive is therefore `views.open`, regardless of the language-specific SDK naming convention. A `trigger_id` must be used quickly because it has a short validity period. Neither `app.modal()` nor `app.popup()` nor `client.modal.show()` is Slack's documented method for opening modal views. Therefore, B is the correct answer.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.