Salesforce Slack-Dev-201 Dumps Questions Answers

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.