Free Practice Questions for the Salesforce Developer Slack-Dev-201 Exam (2026 Updated)

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

Option D accurately reflects Slack Connect behavior. Slack's official developer guidance explicitly states that messages sent through an incoming webhook into a Slack Connect channel are visible to all members of that shared channel, including users participating from external organizations. Option A is incorrect because the Events API can deliver events generated by external users participating in Slack Connect channels. Developers must therefore design applications to recognize that the actor may belong to another workspace. Option B is also incorrect: Slack specifically documents that shared channels do not cause duplicate event callbacks merely because the channel spans multiple workspaces. Developers should instead inspect authorization information in event payloads to determine where the application has authorization. Option C is overly broad. Incoming webhooks can send direct messages only under specific installation-team constraints; they cannot simply DM every external participant in a shared channel. Slack Connect therefore changes assumptions about workspace ownership, user identities, channel membership, and application authorization. Applications must distinguish the workspace where the app is installed from external workspaces represented in the shared conversation. This question belongs to Apps in the Slack Platform, particularly Slack Connect architecture and app behavior in externally shared channels.

Slack specifically recommends testing applications in an Enterprise organization sandbox because Enterprise environments introduce behaviors that cannot always be reproduced accurately in a standalone workspace. Slack's Developer Program provides fully featured Enterprise organization sandboxes specifically for development and testing. Applications must also account for workspace migration periods. During migration into an Enterprise organization, Web API and other platform interactions may temporarily become unavailable. Slack provides the grid_migration_started and grid_migration_finished Events API events so applications can detect this lifecycle transition. Official guidance recommends pausing relevant API/platform activity when migration begins and resuming it after migration finishes. Discarding an existing application is unnecessary because ordinary Slack applications can be adapted for Enterprise behavior. Polling channel IDs is not an appropriate migration strategy. Likewise, reinstalling applications solely to obtain new access tokens is not the fundamental requirement when a workspace becomes part of an Enterprise organization. The critical architectural principle is to test Enterprise-specific behavior and implement migration-aware event handling instead of assuming a standalone-workspace environment will remain stable throughout migration. This directly addresses Design for Scale, especially Enterprise organizations, migration resilience, and testing applications under Enterprise-specific conditions.

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

Socket Mode requires an app-level token carrying the `connections:write` scope. App-level tokens conventionally begin with `xapp-` and represent the application itself rather than a particular workspace bot installation. The application uses this credential with `apps.connections.open` to obtain the dynamically generated WebSocket URL required for Socket Mode communication. A bot token may still be necessary for subsequent Web API actions, such as posting messages, but a bot token alone does not establish the Socket Mode connection. Slack's current documentation explicitly identifies `connections:write` as supporting app-level tokens and being compatible with `apps.connections.open`. Legacy tokens are not the required credential, and Socket Mode certainly does not operate without authentication. Therefore, B is the only correct token type among the supplied options.

App Home is the dedicated Slack application surface associated with an app and accessible through Slack's sidebar and search. Within App Home, an application can provide a customizable Home tab containing Block Kit layouts and interactive functionality tailored to each user. Slack describes App Home as a private, one-to-one space shared between a user and an application. The Home tab can retain its state until the application updates it and can be dynamically published through the `views.publish` Web API method. A modal is a temporary focused surface layered over Slack rather than a persistent dedicated application area. Message attachments belong inside conversations, while workflow steps represent automation components rather than the application's sidebar surface. Therefore, B correctly identifies App Home as the relevant dedicated Slack application surface.

The `section` block is one of the primary Block Kit components for presenting textual content. Slack defines a section as a block that can contain a text object, an array of fields, and optionally a compatible accessory such as a button, image, date picker, or select menu. This makes it appropriate for ordinary explanatory text, headings combined with content, structured information, and interactive message sections. A `divider` block simply produces a visual separation between adjacent blocks and does not carry ordinary text content. An `image` block is intended primarily for image presentation, while a `context` block displays secondary contextual information using text and images in a compact format. For a straightforward textual block in a Slack message, modal, or Home-tab layout, the section block is therefore the standard choice. Accordingly, B is correct.

Block Kit Builder is Slack's official visual prototyping environment for designing and previewing Block Kit interfaces. Developers can use it to assemble blocks, configure their properties, rearrange components, inspect the resulting structured payload, and preview how the interface will appear within supported Slack surfaces. Slack's Block Kit documentation specifically recommends using Block Kit Builder to experiment with available blocks before incorporating the generated structures into an application. This is especially useful when designing complex messages, modals, and Home tabs because developers can validate visual hierarchy and component compatibility interactively rather than repeatedly modifying application code. Slack Studio, Bolt Designer, and Surface Editor are not the official Block Kit prototyping tools described in Slack Developer documentation. Consequently, option A is the only answer that corresponds to Slack's documented visual interface-development tooling.

The required inputs map directly to three Block Kit element types. First, a datetime picker allows a user to select both a date and a time and therefore provides substantially more suitable information for an absence period than a time-only picker. Slack defines the datetimepicker element specifically for selecting a date and a time of day. Second, descriptive information is unstructured text, making a plain-text input the appropriate component. Plain-text input elements can collect single-line or multiline free-form information inside an input block. Third, the manager should be represented as a Slack user identity rather than an arbitrary number. Slack provides the users_select element, which automatically populates the selectable options using users visible in the current workspace. The resulting value is a Slack user ID, providing a stable identifier suitable for subsequent API calls and workflow processing. Options A and D incorrectly use a number input for the manager. Option C uses the correct user selector but supplies only a time picker, which cannot capture the required calendar component. This directly tests Design the Interactive Flow of Your App, specifically constructing modal interfaces using appropriate Block Kit elements.

A and C are the two choices that best align with the current official Slack design guidance. Slack emphasizes concise, easily processed content. Applications should communicate clearly and minimize unnecessary cognitive load so users can understand information quickly rather than reading lengthy or overly complex interfaces. This supports the principle represented by option A. Slack's Block Kit design guidance also recommends simplifying suitable information with pictures. For example, faces may communicate user identity more efficiently than lists of names, and maps can sometimes communicate location more effectively than text. Images must still be accessible through appropriate alt_text; the recommendation is not to remove essential textual meaning indiscriminately. Option B is incorrect under current official guidance. Slack explicitly states that shortcut names should start with a verb, not a noun. Option D conflicts with Slack's recommendation to avoid excessive notifications, while option E is directly contrary to the guidance to reduce complexity by progressively revealing controls and information. The supplied document marks A and B, but B conflicts with Slack's published developer guidance and therefore should not be retained as the verified answer. This question belongs under Design a Great User Experience.

When a Bolt project is being developed locally through the current Slack CLI, `slack run` can watch application files and automatically restart the local application development server when supported source files change. Slack documents this behavior for Bolt for Python and Bolt for JavaScript projects. Python projects normally watch `.py` files, while JavaScript projects watch `.js` files unless the developer customizes the watch configuration. This live-reload capability shortens the development cycle because developers can modify application logic and have the running process restarted without manually stopping and relaunching it after every edit. The Slack workspace itself is not restarted, the user's browser is unaffected, and OAuth tokens are not regenerated merely because source code changes. Therefore, B is correct.

admin.conversations.rename belongs to Slack's Admin API and is available for Enterprise organizations. Current Slack documentation requires a user token containing the appropriate administrative scope—in this case admin.conversations:write. The application must be installed at the Enterprise-organization level rather than merely in one individual workspace. An Org Admin is therefore the appropriate role among the listed choices. Slack currently allows an Enterprise Org Admin or Org Owner, subject to applicable Channel Management permissions, to install an app requesting relevant Admin API scopes. Because Org Owner is not presented as an option, B is the correct selection. A Workspace Admin's authority ordinarily applies to a specific workspace and does not provide organization-level authorization for Admin API operations that span an Enterprise organization. Compliance Admin and Audit Log-related roles address different governance or monitoring responsibilities and do not provide the channel-management authorization required here. Current Slack documentation additionally emphasizes that the installing Org Admin or Owner must possess the applicable Channel Management permissions, including access to the relevant public/private channel types. This maps directly to APIs for Managing Your Slack, particularly Admin APIs, Enterprise-level OAuth installation, administrative scopes, and organization-wide channel management.

Under the current Block Kit specification, C is the technically valid answer, correcting the supplied key of A. A section block supports an accessory field containing one compatible Block Kit element. That accessory can be an overflow-menu element, and the overflow menu itself can contain multiple selectable options. Consequently, a section block containing an overflow menu can validly offer the user several choices while preserving a compact layout. Option A is structurally invalid as written because the accessory field is a single object, not an array of multiple button elements. When several independent buttons need to appear together, Slack's proper construct is an actions block, whose elements array can contain multiple buttons and other interactive elements. However, B incorrectly describes the actions block as a mechanism for displaying contextual images and text; its purpose is to hold interactive controls. A file block is unrelated to presenting user choices and D also incorrectly associates it with this decision-oriented use case. Therefore, based on current official Slack Block Kit definitions, C replaces the document's marked A answer. This belongs to Design the Interactive Flow of Your App, specifically selecting appropriate blocks and interactive elements.

Message shortcuts are Slack app shortcuts specifically associated with an existing message. Slack distinguishes them from global shortcuts: global shortcuts can be initiated independently of message or channel context, whereas message shortcuts appear in an individual message's context menu and provide the app with information about that message. This makes message shortcuts particularly appropriate for operations such as creating a task from a message, escalating content, saving information to an external system, or launching a modal pre-populated with message context. Invoking the shortcut generates an interaction payload that the application processes. Message shortcuts are not keyboard-navigation commands, recurring-message schedulers, or administrator-only operations. Their distinguishing characteristic is that they provide an application action tied directly to the message selected by the user. Therefore, A is correct.

Slack's current Agent quickstart guides developers through creating an AI-powered Slack agent. The official quickstart uses a sample support agent named Casey and demonstrates building the application with the Slack CLI and Bolt frameworks while integrating supported AI agent frameworks such as the Claude Agent SDK, OpenAI Agents SDK, or Pydantic AI. The resulting agent can interact through direct messages, app mentions, App Home, modals, reactions, and threaded responses. Developers begin by installing the Slack CLI, authenticating with a workspace, and creating the agent project using the provided sample template. This is application-development guidance for Slack's AI agent platform, not billing, workspace theming, or Block Kit Builder extensions. Therefore, B precisely matches the purpose of the Agent quickstart.

Workflow Builder is intentionally designed as a no-code automation environment, so ordinary workspace members can create workflows without being software developers. Slack currently states that, by default, all regular members can access Workflow Builder and create workflows, although owners and administrators can restrict who has permission to do so. In Enterprise organizations, Org Owners and Org Admins can similarly establish organization-level policies governing workflow creation. Workflow Builder therefore enables business users to automate routine processes using triggers, forms, Slack actions, connector steps, and other visual components. It is not restricted to Slack employees, certified developers, or Enterprise Grid owners. The important qualification in option B is “with the appropriate permissions,” because administrative policies can narrow the default access. Therefore, B is the correct answer.

Installing an organization-ready Slack application at the Enterprise organization level does not automatically add the application to every workspace in that organization. Slack explicitly separates organization-level installation from workspace access. After installation at the organization level, an Org Admin must grant the application access to one or more individual workspaces—or all workspaces—before members in those workspaces can actually use it. This architecture allows centralized authorization and token management while retaining administrative control over where the application is available. Option B is therefore incorrect because organization-level installation alone does not make the application immediately operational in every workspace. Option C incorrectly describes the requirement as installation “to a channel.” Applications are granted to workspaces; channel membership may subsequently matter for specific APIs or event subscriptions, but that is a separate issue. Application collaborators manage application configuration and development access and are not required merely to activate an organization-installed application. Slack identifies simplified token storage and centralized policy as major advantages of organization-ready installation while retaining workspace-level access control. This aligns directly with Design for Scale, especially Enterprise organization deployment and organization-ready applications.

A Slack application created for use exclusively inside its associated workspace does not need public distribution or a multi-workspace OAuth installation architecture. Slack classifies such an application as an undistributed or single-workspace app. It can be installed directly into its associated development workspace through the app-management configuration. Because the IT manager needs access to the app's configuration, adding that person as an application collaborator provides the appropriate administrative access. The collaborator can then install the application to the Business Operations workspace through the app dashboard. Option A unnecessarily enables distribution to other workspaces. Once public distribution is activated, Slack provides a shareable installation URL intended for multi-workspace installations. Option C similarly introduces OAuth infrastructure that is required when distributing an application beyond its associated workspace but is unnecessary for this internal single-workspace scenario. Option D is even broader because Slack Marketplace publication is intended for externally distributed applications that have completed Slack's review process. Slack's current lifecycle documentation confirms that newly created apps reside in an associated workspace and can be installed there directly without building a separate authorization flow. This belongs to Distribute Your App, particularly understanding single-workspace versus distributed application models.

Interactive buttons are the appropriate component because the approval action is directly associated with an existing Slack message. Slack specifically recommends making notification messages actionable when the recipient is expected to perform an immediate follow-up activity. Approval scenarios are a canonical example: a message can contain Approve/Reject buttons, and the resulting interaction payload can be processed by the application backend. After the manager selects Approve, the application can persist the approval to the external vacation-management service and then modify the Slack message to represent the new state. Slack's chat.update method is explicitly designed to update previously posted, non-ephemeral messages and is suitable for reflecting state changes after an interactive action. Interactive messages therefore provide both the decision mechanism and a clean method for maintaining visible state. A reaction could signal intent but does not provide the same structured interactive workflow. Global shortcuts and slash commands are primarily workflow entry points and are unnecessary when the actionable business object is already represented by a message. This aligns directly with Design the Interactive Flow of Your App, including interactive message components and updating application surfaces after user actions.

Slack officially provides Bolt framework implementations for Python, JavaScript, and Java. Bolt supplies higher-level abstractions for common Slack application functionality, including event listeners, interactive-component handling, OAuth-related patterns, API client access, acknowledgments, and middleware. Slack's platform documentation explicitly identifies Bolt for Python, Bolt for JavaScript, and Bolt for Java as the supported implementations. These frameworks use Slack's corresponding lower-level SDK capabilities underneath while presenting a more application-oriented programming model. Other languages can still interact with Slack because the Web API and Events API use standard HTTP-based mechanisms, and third-party libraries may exist for additional ecosystems. However, Ruby, Go, PHP, C++, Kotlin, and Swift are not the three officially maintained Bolt implementations specified by Slack. Therefore, A is the fully correct answer.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

The application currently needs only two capabilities: detect messages containing “hello” in public channels where it is already present, and post a response. Receiving public-channel message events requires the channels:history scope when subscribing to the message.channels event. Sending a response as the application requires chat:write. Therefore, D provides exactly the permissions required by the functionality available at release. The planned capabilities to independently join public channels and add reactions are explicitly scheduled for the following year. Slack's least-privilege principle requires applications to request only permissions required by functionality that presently exists. Requesting channels:join or reactions:write before those capabilities are implemented would unnecessarily expand the application's authorization footprint. Current Slack Marketplace guidance reinforces this requirement and states that applications should not submit scopes intended only for future functionality. Therefore, the correct release-time scopes are chat:write and channels:history. Additional scopes should be requested later when the associated features are implemented and ready for use. This maps to Design for Security, particularly granular OAuth scopes, least privilege, Events API authorization, and permission lifecycle management.

The legacy Slack term group historically referred to what the modern platform calls a private channel. Slack's current Group object documentation explicitly directs developers to the Conversation object documentation for private channels and explains that older private channels were historically known as “private groups.” Modern Slack development uses the unified Conversations API. A conversation can represent a public channel, private channel, direct message, multi-person direct message, or other supported conversational surface. Developers can inspect properties such as is_private, is_im, and is_mpim rather than relying on older resource naming. A Group DM is instead represented as an MPIM and is conceptually different from a private channel. A direct message is a one-to-one conversation, while a User Group is an administrative grouping of workspace members used for functions such as mentions and organizational categorization. Therefore, D correctly translates the legacy term in the context of Slack API objects. This question maps to Apps in the Slack Platform, particularly the modern Conversations API object model and interpretation of legacy Slack documentation.

Slack's response_url provides a temporary callback mechanism that lets an application send additional responses after receiving a slash command or supported interactive-action payload. Current Slack documentation specifies that the URL can be used up to five times within 30 minutes after the application receives the original payload. That makes B the precise platform restriction. A response_url does not require the app to attach a bot or user OAuth token. Slack treats the URL itself as an authorized response pathway associated with the originating interaction. It can therefore bypass ordinary channel posting permissions for that response context. Option C is incorrect because global shortcuts do not inherently provide a response_url; their primary payload contains a trigger_id, which can be used to open a modal. Option A is also incorrect because interaction responses can modify or replace originating messages where the interaction type supports such behavior. If an app needs to communicate after the 30-minute response window or after exhausting the permitted responses, it should use standard messaging APIs such as chat.postMessage. This maps directly to Design the Interactive Flow of Your App, particularly slash commands, interaction acknowledgments, and asynchronous responses.

Slack Marketplace publication is not automatic. Applications must satisfy Slack's Marketplace guidelines and pass Slack's submission and review process. Slack evaluates areas including functionality, installation and OAuth behavior, user experience, requested scopes, security controls, privacy documentation, support readiness, and application quality. As of September 2026, Slack also requires new Marketplace submissions to maintain at least 10 installations on active workspaces throughout review, subject to stated exceptions such as qualifying security and compliance partners. However, installation count alone does not qualify an application for publication; the complete Marketplace review requirements still apply. Enterprise Grid is likewise not required merely to publish an app. Therefore, B is the comprehensive correct answer because it encompasses Slack's review, eligibility, security, quality, distribution, and current submission requirements.

Slack's Direct Install URL is specifically intended to eliminate the extra step of routing prospective installers through the application's own landing page before starting OAuth. Current Slack Marketplace documentation states that when Slack sends an HTTP GET request to the configured Direct Install URL, that endpoint must respond with an HTTP 302 redirect to a fully qualified Slack OAuth authorization URL. For modern Slack applications, the redirect target follows the OAuth v2 authorization pattern: https://slack.com/oauth/v2/authorize. The URL includes the application's client ID and appropriate OAuth scope information. Slack then presents the authorization interface to the installing user. After consent, the normal OAuth authorization-code process continues through the application's configured redirect URI. Option B represents the conventional landing-page installation flow that Direct Install exists specifically to bypass. Option C confuses installation behavior with Slack's three-second acknowledgment requirement for interactive requests and Events API deliveries. A slack:// deep link is not the required Direct Install target. Therefore, D is precisely supported by current Slack Marketplace documentation. The question's older phrase Slack App Directory should now be read as Slack Marketplace. This maps directly to Distribute Your App.

Enterprise Grid is Slack's enterprise architecture for organizations that need centralized governance across multiple Slack workspaces. Workspaces can exist within one Enterprise organization while organization-level administrators manage identity, policies, applications, security, and other administrative functions across the broader environment. Slack's current Enterprise documentation continues to describe Enterprise Grid organizations as containing multiple workspaces, and migration tooling allows standalone workspaces to be incorporated into an Enterprise organization. Enterprise functionality also enables organization-level application installation, Admin APIs, centralized app-management policies, and other large-scale administrative capabilities. Enterprise Grid is therefore not a pricing utility, UI theme, or authentication token type. Among the available options, B correctly captures its architectural purpose as Slack's offering for large organizations operating multiple managed workspaces.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.

The `divider` block is the Block Kit component specifically designed to create a visual horizontal separation between adjacent pieces of content. Slack describes it as a content divider comparable to an HTML horizontal rule, allowing developers to organize messages, modals, and Home tabs into clearly separated visual sections. Its JSON representation is intentionally simple and normally requires only `"type": "divider"`, although a `block_id` can optionally be supplied. The alternatives `separator`, `line`, and `rule` are not valid Slack Block Kit block types. Dividers should be used where visual grouping improves readability rather than as substitutes for meaningful content structure. Slack officially supports divider blocks across messages, modals, and Home tabs. Therefore, A is the verified answer.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

The `plain_text_input` element is specifically intended to collect free-form textual information from users. Slack allows the element to accept either single-line or multiline text and commonly places it inside an `input` block when constructing a modal form. The application receives the entered value when the modal generates a `view_submission` payload, allowing the backend to validate and process the submitted information. A button initiates an action rather than collecting text. A `static_select` element presents predefined choices, while an overflow menu provides a compact collection of predefined actions or selections. Neither alternative allows unrestricted textual entry. Slack's Block Kit element reference explicitly identifies the plain-text input element as the component for entering free-form data. Therefore, B is the correct element for collecting textual input inside a modal.

Slack Developer Tools is specifically designed to provide Slack-platform development assistance directly inside Slack. Its capabilities include inspecting existing Slack messages to understand how those messages were constructed and accessing Slack method documentation without leaving the workspace. The official Slack Developer Tools listing describes an Inspect action available from a message's menu. Developers can use it to examine the underlying structure of a message, making it useful for understanding Block Kit layouts and message payload composition. The tool also provides the /sdt docs [method name] command, which retrieves documentation and implementation information for Slack API methods. Postman is useful for constructing and testing HTTP requests against Slack's Web API, but it does not provide the same Slack-native message inspection function. Browser developer tools inspect browser-side behavior and network activity rather than Slack message structures as a dedicated platform feature. The Slack CLI provides significant development, deployment, and application-management functionality, but the option's claimed built-in debugger is not the specific tool described for this requirement. Therefore, A remains correct. This directly maps to the Tools objective of the Slack Developer curriculum.

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

Slack's OAuth 2.0 authorization-code flow issues a temporary authorization code after the installing user reviews and approves the permissions requested by the application. Slack redirects the user to the application's configured redirect URI with this temporary code. The application backend then sends the code to Slack's token-exchange endpoint together with the required application credentials. If the exchange succeeds, Slack returns the applicable access credentials, which can include bot or user tokens depending on the requested authorization. Slack explicitly summarizes the process as requesting scopes, receiving user approval, and exchanging a temporary authorization code for an access token. A workspace ID identifies the Slack workspace but is not exchanged for credentials. Application manifests describe configuration, and user passwords must never be collected as part of Slack OAuth. Therefore, B is correct.

users.info provides the information required for both localization dimensions. Slack's user object contains timezone properties including tz, tz_label, and tz_offset. These values allow an application to schedule or render time-sensitive functionality according to the user's configured timezone rather than assuming the server's timezone or attempting to derive timezone information from HTTP headers. For language localization, users.info supports the include_locale=true parameter. When requested, Slack can include the user's locale, represented by an IETF language code. The app can then select translated strings and culturally appropriate presentation based on that locale. users.profile.get is intended for retrieving profile information and custom profile fields; it is not the preferred mechanism described by Slack for this combined localization requirement. HTTP request headers are also inappropriate for determining the Slack user's configured timezone because they represent network/request metadata rather than the user's Slack preference. Accordingly, D combines the appropriate API method with the two relevant user attributes. In implementation, the developer must remember to request locale explicitly using include_locale=true. This aligns with Design a Great User Experience, especially internationalization, localization, time-zone awareness, and tailoring application behavior to the individual Slack user.

Slash commands are application entry points that allow users to invoke Slack app functionality directly from the message composer. A user enters a forward slash followed by the registered command—for example, `/todo`—and Slack routes the resulting command payload to the associated application. The payload includes contextual information and any text entered after the command. The application must acknowledge the request promptly and can respond through mechanisms such as `respond()`, `say()`, or subsequent Web API operations. Slack's official documentation explicitly describes slash commands as allowing users to invoke an app by typing a string into the message composer. They are unrelated to message encryption, workspace theme configuration, or general channel deletion. Therefore, B accurately describes the purpose of Slack slash commands.

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.