Free Practice Questions for the Salesforce Developer Slack-Dev-201 Exam (2026 Updated)

conversations.history is Slack's current unified Web API method for retrieving message history from conversations. With the relevant OAuth scopes, a bot token can retrieve message history from conversations in which the bot is a member. Public-channel history requires channels:history, while private-channel history requires groups:history. Therefore, the app must be present in the applicable channels and possess the corresponding history scopes. Option C relies on legacy methods. Slack consolidated historically separate channel APIs into the Conversations API, making conversations.history the supported method for both public and private conversation history. The Events API can deliver newly occurring message events, but it does not independently provide the historical messages already stored in the conversation. Therefore, A does not meet the requirement to read both existing and subsequent message history. The Discovery API is a specialized Enterprise security and compliance capability and is inappropriate for an ordinary internal application. The source question and marked answer are therefore consistent with current Slack behavior. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly conversation membership, history scopes, and the unified Conversations API.

The Home tab is the correct surface because Slack defines App Home as a persistent, private, one-to-one workspace between an individual user and an application. Unlike transient messages or task-focused modals, the Home tab can present personalized information that users repeatedly return to and can be updated dynamically through the views.publish method. For an interview-management application, the Home tab can display upcoming interviews, completed interview sessions, outstanding feedback tasks, candidate summaries, and interactive controls such as buttons for opening feedback forms or managing assignments. Slack specifically identifies dashboards, personalized user data, application settings, and persistent workflow entry points as appropriate Home-tab use cases. A modal is better for a focused temporary interaction, such as submitting one interview evaluation, rather than maintaining the overall interview-management dashboard. Shortcuts are invocation mechanisms rather than persistent information surfaces. Messages are useful for notifications and conversational workflows but do not provide the same stable, personalized workspace. Therefore, the application's principal summary and management interface should be implemented through App Home, with modals or messages used as complementary surfaces when appropriate. This maps directly to Design a Great User Experience, particularly selecting the correct Slack surface based on persistence and workflow requirements.

The `slack run` command starts a Slack app in the local development environment and supports the install-and-test workflow against a selected workspace. Slack CLI uses the project's configuration to run the application locally, and current development tooling can watch supported source files and restart the running process when code changes. This enables an iterative development cycle in which the developer edits code, runs or reloads the local app, and immediately tests behavior inside Slack. `slack deploy` serves a different lifecycle purpose for supported hosted applications, while `slack start` and `slack serve` are not the standard commands documented for this workflow. Consequently, B is correct: `slack run` is the command Slack's quickstarts use to run the application locally and make it available for live workspace testing.

users.info provides the information required for both localization dimensions. Slack's user object contains timezone properties including tz, tz_label, and tz_offset. These values allow an application to schedule or render time-sensitive functionality according to the user's configured timezone rather than assuming the server's timezone or attempting to derive timezone information from HTTP headers. For language localization, users.info supports the include_locale=true parameter. When requested, Slack can include the user's locale, represented by an IETF language code. The app can then select translated strings and culturally appropriate presentation based on that locale. users.profile.get is intended for retrieving profile information and custom profile fields; it is not the preferred mechanism described by Slack for this combined localization requirement. HTTP request headers are also inappropriate for determining the Slack user's configured timezone because they represent network/request metadata rather than the user's Slack preference. Accordingly, D combines the appropriate API method with the two relevant user attributes. In implementation, the developer must remember to request locale explicitly using include_locale=true. This aligns with Design a Great User Experience, especially internationalization, localization, time-zone awareness, and tailoring application behavior to the individual Slack user.

Slack requires an application using HTTP Events API delivery to acknowledge an event request with an HTTP `2xx` response within three seconds. If Slack does not receive a successful acknowledgment in that period, the delivery attempt is treated as unsuccessful and Slack may retry the event. Slack recommends responding with `HTTP 200 OK` as rapidly as possible and separating event ingestion from potentially slow business processing. A robust production architecture typically acknowledges the request immediately, places the event on a queue, and performs downstream processing asynchronously. This prevents expensive API calls, database operations, or external-service dependencies from delaying acknowledgment and producing duplicate deliveries. Returning Block Kit content is unnecessary for acknowledgment, while user logout and scope requests are unrelated. Therefore, A is correct and represents an important Slack scalability and reliability pattern.

The `divider` block is the Block Kit component specifically designed to create a visual horizontal separation between adjacent pieces of content. Slack describes it as a content divider comparable to an HTML horizontal rule, allowing developers to organize messages, modals, and Home tabs into clearly separated visual sections. Its JSON representation is intentionally simple and normally requires only `"type": "divider"`, although a `block_id` can optionally be supplied. The alternatives `separator`, `line`, and `rule` are not valid Slack Block Kit block types. Dividers should be used where visual grouping improves readability rather than as substitutes for meaningful content structure. Slack officially supports divider blocks across messages, modals, and Home tabs. Therefore, A is the verified answer.

Slack explicitly requires an OAuth token containing the admin scope to access the SCIM API. Therefore, C is directly supported by the current SCIM documentation. For an Enterprise organization, Org Owners and Org Admins can perform SCIM operations after the app has been established, but Slack specifically states that only an Org Owner can install the SCIM app. That makes A insufficiently accurate as written if interpreted as independently establishing the SCIM integration. Slack also enforces privilege boundaries. A token generated from an Admin account can operate on members and other Admins with equal or lower privileges, but it cannot modify Owner accounts. Therefore B is false. SCIM requests must send the access token in an HTTP Authorization header using the Bearer scheme. Slack does not prescribe placing the SCIM credential in a URL query string; doing so would also be an inferior security practice because URLs are more likely to be logged by intermediaries. On Enterprise, the SCIM token must be obtained from installing the application at the organization level, not merely within one workspace. This question maps directly to APIs for Managing Your Slack, particularly SCIM authentication and Enterprise provisioning.

A clear privacy policy is a mandatory requirement for applications listed in what Slack now calls the Slack Marketplace. Slack requires the application's public landing page to provide a clear link to that privacy policy. The policy must explain, at minimum, what third-party data is collected, how that information is used, how long it is retained, and how individuals can request access, transfer, or deletion of their information. It must also provide a means of contacting the service regarding data-related requests. Slack specifically notes that even applications that do not actively use certain received data may nevertheless receive identifiers or other information through platform payloads, and this handling must be disclosed. Bank-account information is not a universal Marketplace submission requirement. A security assessment or penetration-testing report may become relevant for certain applications or review circumstances but is not the general listing requirement represented here. Slack also does not require every Marketplace description to be translated into every supported language. Therefore, B is correct. This belongs to Distribute Your App, specifically Marketplace listing requirements, privacy governance, and public application documentation.

A bot token represents the bot identity associated with a Slack app installed in a workspace and is the standard credential used by many Slack applications when calling Web API methods. Modern bot tokens use Slack's granular permission model, meaning their actual capabilities are determined by the bot scopes approved during installation. Bot tokens conventionally begin with `xoxb-`. They differ fundamentally from app-level tokens, which represent the application itself across installations and are limited to specific application-level functionality such as Socket Mode connectivity. A session cookie is not an application API credential. A refresh token is used when token rotation is enabled to obtain replacement access tokens rather than serving as the ordinary credential for API operations. Consequently, among the available choices, the bot token is the correct token type for routine workspace application API operations.

A and C are the two choices that best align with the current official Slack design guidance. Slack emphasizes concise, easily processed content. Applications should communicate clearly and minimize unnecessary cognitive load so users can understand information quickly rather than reading lengthy or overly complex interfaces. This supports the principle represented by option A. Slack's Block Kit design guidance also recommends simplifying suitable information with pictures. For example, faces may communicate user identity more efficiently than lists of names, and maps can sometimes communicate location more effectively than text. Images must still be accessible through appropriate alt_text; the recommendation is not to remove essential textual meaning indiscriminately. Option B is incorrect under current official guidance. Slack explicitly states that shortcut names should start with a verb, not a noun. Option D conflicts with Slack's recommendation to avoid excessive notifications, while option E is directly contrary to the guidance to reduce complexity by progressively revealing controls and information. The supplied document marks A and B, but B conflicts with Slack's published developer guidance and therefore should not be retained as the verified answer. This question belongs under Design a Great User Experience.

A is the current technically correct answer, replacing the uploaded bank's marked C. Slack's current token taxonomy does not define an “Admin” token type. Slack officially distinguishes token types such as bot tokens, user tokens, workflow tokens, and configuration tokens. Administrative authority is expressed through admin.* OAuth scopes attached to a user token, rather than through a separate token type called “Admin.” For example, Slack's official documentation for admin.conversations:read, admin.apps:read, and related Admin API scopes explicitly lists the supported token type as User. To obtain a user token imbued with Admin API scopes, the application must be installed at the entire Enterprise organization level by an authorized Org Admin or Org Owner. The resulting user access token can then call the applicable admin.* methods. Creating, inviting members to, and archiving channels require the appropriate administrative conversation scopes, particularly admin.conversations:*, subject to the installer having the corresponding Channel Management permissions. Therefore, under current Slack documentation, User is the correct token type. “Admin token” is outdated/imprecise terminology because admin describes the permission scope, not a distinct token class. This maps directly to APIs for Managing Your Slack.

A Slack application distributed across multiple independent workspaces must implement an OAuth installation flow. Slack explicitly states that enabling installation on other workspaces allows the application to generate access tokens for each workspace and applicable user authorization. Bolt's current OAuth documentation likewise explains that each app installation issues unique access tokens and installation information that the application must store securely and retrieve when processing requests. This is fundamentally different from a single-workspace application, which can receive one access token through direct installation without implementing the full distributed OAuth flow. Independent workspaces do not normally share one universal token. Organization-wide Enterprise installations are a distinct model and can use an organization-level authorization, but that does not invalidate the standard multi-workspace distribution behavior tested here. Therefore, A is correct.

Slack Web API responses conventionally include a top-level Boolean `ok` property indicating whether the requested operation succeeded. A normal successful response contains `"ok": true` together with any method-specific data, such as a user object, channel information, timestamps, or other returned values. When an API operation fails, Slack generally returns `"ok": false` together with an `error` field identifying the failure condition. Slack explicitly advises callers to evaluate the `ok` value rather than assuming that a syntactically valid response represents success. For example, the official `users.info` method documentation shows a successful response containing `"ok": true` and an unsuccessful response containing `"ok": false`. Slack Web API operations do not normally return CSV files, redirects, or HTML documents as their standard JSON success response. Therefore, A is correct.

In Bolt for Python, `@app.message(...)` registers a listener for messages matching specified text or a regular-expression pattern. For example, `@app.message("hello")` can invoke a listener when an incoming message contains the expected text. Bolt handles the event routing and supplies useful listener arguments such as the message payload, `say`, `client`, and other context values. By contrast, `@app.event` is used to subscribe a listener to a specific Slack event type rather than to filter messages by text. `@app.listen` and `@app.on_message` are not the standard Bolt for Python decorators documented for this use case. Therefore, B is correct: `@app.message` is the framework feature specifically intended for listening to message content that matches a configured string or pattern.

When using the HTTP delivery model for the Events API, Slack sends subscribed events as HTTP POST requests containing JSON payloads to the application's configured Request URL. That URL must be a publicly reachable HTTPS endpoint capable of receiving and acknowledging Slack requests. Slack currently provides two event-delivery architectures: HTTP Request URLs and Socket Mode. Socket Mode replaces the public Request URL with a WebSocket connection, so the question's phrase “by default” is slightly imprecise under current documentation. Nevertheless, among the available options, A is unequivocally the intended and technically valid Events API delivery mechanism. Email, desktop notifications, and SMS are not mechanisms Slack uses to deliver application Events API payloads. Applications using HTTP should also verify Slack request signatures before processing the payload.

A global shortcut is designed for exactly this entry-point requirement. Global shortcuts expose application functionality independently of a particular message or channel context, enabling users to launch an application's workflow from broadly accessible locations in Slack. Slack specifically describes global shortcuts as suitable for workflows that can operate without the context of an existing channel or message. After the shortcut is invoked, Slack sends the app an interaction payload containing a trigger_id. The application can acknowledge the invocation and use that trigger_id to open a modal. The modal can then present the required multi-question form. On submission, the application can process the captured fields, transmit the data to the backend system, and use Slack's messaging API to publish the appropriate information to #benefits-us. A message shortcut requires an existing message context, which this use case does not require. A reaction similarly depends on a message. An incoming webhook provides a mechanism for posting information into Slack but does not provide an application entry point for opening an interactive form. This is a direct example of Design the Interactive Flow of Your App, particularly selecting the correct user entry point and connecting shortcuts to modal workflows.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Socket Mode enables a Slack application to receive Events API payloads and interactive events over a WebSocket connection instead of exposing a publicly accessible HTTP Request URL. Slack's current documentation explicitly states that the WebSocket URL is not static. The application obtains the URL at runtime by invoking apps.connections.open, and Slack refreshes that URL periodically. This architecture is particularly useful for applications operating behind corporate firewalls, during local development, or in environments where exposing an inbound public HTTP endpoint is undesirable. Therefore, B precisely matches Slack's documented description: the application listens through a non-static WebSocket URL dynamically created while the application is running. There is, however, a defect in the supplied question: C is semantically equivalent to B. Slack itself uses the wording “created at runtime,” so C also describes the underlying behavior accurately. Because this is marked as a single-choice question, B should be retained as the intended exam answer, but the alternatives are not sufficiently differentiated to make B uniquely true. This belongs to Tools, particularly Socket Mode, WebSockets, apps.connections.open, and alternative event-delivery architecture.

Slack applications declare their requested OAuth permissions through application configuration. These permissions can be configured in the app settings under OAuth & Permissions or represented declaratively in an app manifest. Within a manifest, scopes reside under `oauth_config.scopes`, with separate fields for bot and user scopes. Slack's current platform also supports optional scopes through `bot_optional` and `user_optional`. The scopes determine what actions and data the application's tokens may access after authorization. Browser cookies do not define Slack app permissions, and the Slack CLI's local configuration is not the authoritative location for declaring the application's OAuth scope requirements. Scopes absolutely can—and normally should—be determined before installation so users and administrators can review the requested permissions during OAuth authorization. Therefore, A is correct.

The `slack app settings` command opens the selected app's configuration interface in a web browser. It provides a convenient transition from command-line development to Slack's web-based app management interface, where developers can inspect or modify app settings such as features, OAuth permissions, event subscriptions, interactivity, collaborators, and distribution configuration. Slack's CLI reference documents `slack app settings` specifically for opening app settings, making it the direct match for the behavior described in the question. `slack config open`, `slack edit`, and `slack dashboard` are not the documented Slack CLI commands for opening the app configuration page. Therefore, A is correct because `slack app settings` is the supported command for navigating from the CLI to the application's browser-based settings.

Slack's Direct Install URL is specifically intended to eliminate the extra step of routing prospective installers through the application's own landing page before starting OAuth. Current Slack Marketplace documentation states that when Slack sends an HTTP GET request to the configured Direct Install URL, that endpoint must respond with an HTTP 302 redirect to a fully qualified Slack OAuth authorization URL. For modern Slack applications, the redirect target follows the OAuth v2 authorization pattern: https://slack.com/oauth/v2/authorize. The URL includes the application's client ID and appropriate OAuth scope information. Slack then presents the authorization interface to the installing user. After consent, the normal OAuth authorization-code process continues through the application's configured redirect URI. Option B represents the conventional landing-page installation flow that Direct Install exists specifically to bypass. Option C confuses installation behavior with Slack's three-second acknowledgment requirement for interactive requests and Events API deliveries. A slack:// deep link is not the required Direct Install target. Therefore, D is precisely supported by current Slack Marketplace documentation. The question's older phrase Slack App Directory should now be read as Slack Marketplace. This maps directly to Distribute Your App.

Slack uses OAuth scopes to define and grant specific permissions to applications. Each scope authorizes access to a defined category of data or actions—for example, reading particular conversation information, viewing user information, or posting messages. Slack applications have no general API access by default; their effective privileges are determined by the scopes associated with their access tokens. Bot scopes grant permissions to the application's bot identity, while user scopes allow appropriately authorized actions on behalf of a user. Although application manifests can declare the scopes an application requests, the manifest itself is not the authorization mechanism. IP allowlisting can supplement token security but does not grant Slack API permissions, and workspace passwords are unrelated to application authorization. Therefore, OAuth scopes are the correct mechanism, making B the verified answer.

admin.conversations.rename belongs to Slack's Admin API and is available for Enterprise organizations. Current Slack documentation requires a user token containing the appropriate administrative scope—in this case admin.conversations:write. The application must be installed at the Enterprise-organization level rather than merely in one individual workspace. An Org Admin is therefore the appropriate role among the listed choices. Slack currently allows an Enterprise Org Admin or Org Owner, subject to applicable Channel Management permissions, to install an app requesting relevant Admin API scopes. Because Org Owner is not presented as an option, B is the correct selection. A Workspace Admin's authority ordinarily applies to a specific workspace and does not provide organization-level authorization for Admin API operations that span an Enterprise organization. Compliance Admin and Audit Log-related roles address different governance or monitoring responsibilities and do not provide the channel-management authorization required here. Current Slack documentation additionally emphasizes that the installing Org Admin or Owner must possess the applicable Channel Management permissions, including access to the relevant public/private channel types. This maps directly to APIs for Managing Your Slack, particularly Admin APIs, Enterprise-level OAuth installation, administrative scopes, and organization-wide channel management.

Slack explicitly recommends applying the principle of least privilege when choosing OAuth scopes. An application should request only the minimum permissions required to perform its intended functionality. Every unnecessary scope expands the data or operations available to the application and therefore increases the potential impact of credential compromise, implementation defects, or inappropriate application behavior. Slack's security guidance recommends defining minimal scope sets and auditing requested permissions regularly. Marketplace guidance reinforces the same principle because users and administrators may reject applications that request excessive access to sensitive Slack data. Slack does not charge applications according to their number of scopes, and narrower scopes do not exist primarily to improve performance. Broad scopes have not simply been universally deprecated; rather, developers are expected to justify and minimize permissions. Therefore, B accurately captures Slack's security model and recommended application-design practice.

Enterprise Grid is Slack's enterprise architecture for organizations that need centralized governance across multiple Slack workspaces. Workspaces can exist within one Enterprise organization while organization-level administrators manage identity, policies, applications, security, and other administrative functions across the broader environment. Slack's current Enterprise documentation continues to describe Enterprise Grid organizations as containing multiple workspaces, and migration tooling allows standalone workspaces to be incorporated into an Enterprise organization. Enterprise functionality also enables organization-level application installation, Admin APIs, centralized app-management policies, and other large-scale administrative capabilities. Enterprise Grid is therefore not a pricing utility, UI theme, or authentication token type. Among the available options, B correctly captures its architectural purpose as Slack's offering for large organizations operating multiple managed workspaces.

Slack's current architecture guidance explicitly favors HTTP Request URLs for production applications when Socket Mode is not required. WebSockets are stateful, which makes them more complex to scale horizontally and more susceptible to connection interruptions, network partitions, and transient disconnections. Slack describes Socket Mode as particularly convenient for local development, on-premises integrations, environments behind firewalls, or applications unable to receive inbound HTTP traffic. For maximum application-connectivity reliability, Slack recommends HTTP for production applications and advises developers to continue using HTTP request URLs when their deployment does not specifically require Socket Mode. Socket Mode also does not replace the Web API; applications commonly receive events over Socket Mode and then invoke Web API methods to perform actions. Therefore, B accurately reflects Slack's present production-scale guidance.

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

Installing an organization-ready Slack application at the Enterprise organization level does not automatically add the application to every workspace in that organization. Slack explicitly separates organization-level installation from workspace access. After installation at the organization level, an Org Admin must grant the application access to one or more individual workspaces—or all workspaces—before members in those workspaces can actually use it. This architecture allows centralized authorization and token management while retaining administrative control over where the application is available. Option B is therefore incorrect because organization-level installation alone does not make the application immediately operational in every workspace. Option C incorrectly describes the requirement as installation “to a channel.” Applications are granted to workspaces; channel membership may subsequently matter for specific APIs or event subscriptions, but that is a separate issue. Application collaborators manage application configuration and development access and are not required merely to activate an organization-installed application. Slack identifies simplified token storage and centralized policy as major advantages of organization-ready installation while retaining workspace-level access control. This aligns directly with Design for Scale, especially Enterprise organization deployment and organization-ready applications.

Workflow Builder is intentionally designed as a no-code automation environment, so ordinary workspace members can create workflows without being software developers. Slack currently states that, by default, all regular members can access Workflow Builder and create workflows, although owners and administrators can restrict who has permission to do so. In Enterprise organizations, Org Owners and Org Admins can similarly establish organization-level policies governing workflow creation. Workflow Builder therefore enables business users to automate routine processes using triggers, forms, Slack actions, connector steps, and other visual components. It is not restricted to Slack employees, certified developers, or Enterprise Grid owners. The important qualification in option B is “with the appropriate permissions,” because administrative policies can narrow the default access. Therefore, B is the correct answer.

A Slack application created for use exclusively inside its associated workspace does not need public distribution or a multi-workspace OAuth installation architecture. Slack classifies such an application as an undistributed or single-workspace app. It can be installed directly into its associated development workspace through the app-management configuration. Because the IT manager needs access to the app's configuration, adding that person as an application collaborator provides the appropriate administrative access. The collaborator can then install the application to the Business Operations workspace through the app dashboard. Option A unnecessarily enables distribution to other workspaces. Once public distribution is activated, Slack provides a shareable installation URL intended for multi-workspace installations. Option C similarly introduces OAuth infrastructure that is required when distributing an application beyond its associated workspace but is unnecessary for this internal single-workspace scenario. Option D is even broader because Slack Marketplace publication is intended for externally distributed applications that have completed Slack's review process. Slack's current lifecycle documentation confirms that newly created apps reside in an associated workspace and can be installed there directly without building a separate authorization flow. This belongs to Distribute Your App, particularly understanding single-workspace versus distributed application models.

Message shortcuts are Slack app shortcuts specifically associated with an existing message. Slack distinguishes them from global shortcuts: global shortcuts can be initiated independently of message or channel context, whereas message shortcuts appear in an individual message's context menu and provide the app with information about that message. This makes message shortcuts particularly appropriate for operations such as creating a task from a message, escalating content, saving information to an external system, or launching a modal pre-populated with message context. Invoking the shortcut generates an interaction payload that the application processes. Message shortcuts are not keyboard-navigation commands, recurring-message schedulers, or administrator-only operations. Their distinguishing characteristic is that they provide an application action tied directly to the message selected by the user. Therefore, A is correct.

Slack's current documentation names this capability the Slack MCP and Skills Plugin. It is designed to improve AI-assisted and agent-assisted Slack development by supplying coding agents with specialized Slack development skills and, on supported clients, a connection to the Slack MCP Server. The skills provide focused instructions and references for tasks such as scaffolding Slack apps, validating Block Kit objects, composing messages, calling Web API methods, and using Slack CLI functionality. The MCP Server can additionally allow supported AI tools to interact with workspace data, including searching channels, sending messages, and managing canvases. Slack documents support for tools such as Claude Code, Codex, Cursor, and other coding agents, with capabilities varying by client. It does not replace Slack CLI or exist solely for OAuth. Therefore, A is correct.

Slack specifically recommends testing applications in an Enterprise organization sandbox because Enterprise environments introduce behaviors that cannot always be reproduced accurately in a standalone workspace. Slack's Developer Program provides fully featured Enterprise organization sandboxes specifically for development and testing. Applications must also account for workspace migration periods. During migration into an Enterprise organization, Web API and other platform interactions may temporarily become unavailable. Slack provides the grid_migration_started and grid_migration_finished Events API events so applications can detect this lifecycle transition. Official guidance recommends pausing relevant API/platform activity when migration begins and resuming it after migration finishes. Discarding an existing application is unnecessary because ordinary Slack applications can be adapted for Enterprise behavior. Polling channel IDs is not an appropriate migration strategy. Likewise, reinstalling applications solely to obtain new access tokens is not the fundamental requirement when a workspace becomes part of an Enterprise organization. The critical architectural principle is to test Enterprise-specific behavior and implement migration-aware event handling instead of assuming a standalone-workspace environment will remain stable throughout migration. This directly addresses Design for Scale, especially Enterprise organizations, migration resilience, and testing applications under Enterprise-specific conditions.

Slack officially provides Bolt framework implementations for Python, JavaScript, and Java. Bolt supplies higher-level abstractions for common Slack application functionality, including event listeners, interactive-component handling, OAuth-related patterns, API client access, acknowledgments, and middleware. Slack's platform documentation explicitly identifies Bolt for Python, Bolt for JavaScript, and Bolt for Java as the supported implementations. These frameworks use Slack's corresponding lower-level SDK capabilities underneath while presenting a more application-oriented programming model. Other languages can still interact with Slack because the Web API and Events API use standard HTTP-based mechanisms, and third-party libraries may exist for additional ecosystems. However, Ruby, Go, PHP, C++, Kotlin, and Swift are not the three officially maintained Bolt implementations specified by Slack. Therefore, A is the fully correct answer.

The application currently needs only two capabilities: detect messages containing “hello” in public channels where it is already present, and post a response. Receiving public-channel message events requires the channels:history scope when subscribing to the message.channels event. Sending a response as the application requires chat:write. Therefore, D provides exactly the permissions required by the functionality available at release. The planned capabilities to independently join public channels and add reactions are explicitly scheduled for the following year. Slack's least-privilege principle requires applications to request only permissions required by functionality that presently exists. Requesting channels:join or reactions:write before those capabilities are implemented would unnecessarily expand the application's authorization footprint. Current Slack Marketplace guidance reinforces this requirement and states that applications should not submit scopes intended only for future functionality. Therefore, the correct release-time scopes are chat:write and channels:history. Additional scopes should be requested later when the associated features are implemented and ready for use. This maps to Design for Security, particularly granular OAuth scopes, least privilege, Events API authorization, and permission lifecycle management.

Custom workflow steps expose application functionality as reusable building blocks that authorized users can incorporate directly into workflows through Workflow Builder. This provides a significant usability advantage for straightforward automation because end users can compose business processes visually rather than learning bot commands or interacting with a separate conversational interface. Slack allows developers to build custom steps and control who is permitted to add those steps to workflows, while administrators can impose additional restrictions. Custom steps do not eliminate app configuration or OAuth permission requirements, and they are not exclusive to Enterprise Grid environments. Their principal value is composability: application functionality becomes available alongside Slack-built and connector steps within the workflow-building experience. Therefore, B correctly identifies the architectural and user-experience advantage of using a custom workflow step for suitable automations.