Slack-Dev-201 Salesforce Certified Slack Developer Questions and Answers

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

Message shortcuts operate in the contextual action menu of an existing Slack message. Slack's official shortcut documentation specifies that message shortcuts appear in the context menus of non-ephemeral messages. Therefore, an ephemeral message cannot serve as the source message for a message shortcut, making B correct. This restriction follows from the underlying interaction model. Message shortcuts preserve context from the source message so an application can perform an action based on that message—for example, creating a ticket, escalating an incident, or sending content to an external system. Ephemeral messages have restricted visibility and lifecycle behavior and are excluded from this shortcut surface. Option D is incorrect because every shortcut invocation must be acknowledged promptly, regardless of how many shortcuts the app defines. Current Slack UX guidance requires shortcut requests to be acknowledged with an HTTP 200 response within three seconds. Option C is not a general rule; follow-up notification mechanics depend on the interaction payload and workflow. A's fixed limit of three message shortcuts is not the applicable platform rule represented here. This belongs to Design the Interactive Flow of Your App, particularly message shortcuts and contextual interactions.

A Slack app manifest is a reusable, declarative representation of an application's configuration. Slack describes manifests as portable configurations that can define major application settings, including display information, features, OAuth scopes, event subscriptions, interactivity settings, and other platform capabilities. A manifest can be used to create, configure, copy, and reproduce Slack applications without manually re-entering every setting through the app-management interface. This is particularly useful for teams maintaining multiple environments or applications with similar configurations. Manifests can also be stored in source control so collaborators can review and track configuration changes alongside application code. They are unrelated to billing invoices, API error logs, or Slack user permission groups. Therefore, option B accurately captures both the declarative nature and primary purpose of a Slack app manifest.

When using the HTTP delivery model for the Events API, Slack sends subscribed events as HTTP POST requests containing JSON payloads to the application's configured Request URL. That URL must be a publicly reachable HTTPS endpoint capable of receiving and acknowledging Slack requests. Slack currently provides two event-delivery architectures: HTTP Request URLs and Socket Mode. Socket Mode replaces the public Request URL with a WebSocket connection, so the question's phrase “by default” is slightly imprecise under current documentation. Nevertheless, among the available options, A is unequivocally the intended and technically valid Events API delivery mechanism. Email, desktop notifications, and SMS are not mechanisms Slack uses to deliver application Events API payloads. Applications using HTTP should also verify Slack request signatures before processing the payload.

Slack requires applications to verify inbound HTTP requests by using the application's signing secret. Slack generates an X-Slack-Signature header for signed requests. The application reconstructs the signature locally from the request timestamp and raw request body using HMAC-SHA256 together with its signing secret, then compares the calculated signature with the signature Slack supplied. This mechanism provides cryptographic integrity and origin verification. If an attacker alters the payload in transit, the locally calculated signature no longer matches Slack's signature. Implementations should also validate the X-Slack-Request-Timestamp and reject sufficiently old requests to reduce replay-attack risk. IP-address validation is not the recommended authentication mechanism because infrastructure addresses can change and network origin alone does not cryptographically establish message integrity. The Audit Logs API serves Enterprise monitoring and investigation rather than inbound-request authentication. Restricting server access is useful operational security but does not prove that an individual request came unmodified from Slack. Therefore, D directly implements Slack's prescribed request-verification architecture. This belongs to Design for Security, covering signing secrets, request integrity, authentication of Slack-originated traffic, and replay protection.

A Slack application distributed across multiple independent workspaces must implement an OAuth installation flow. Slack explicitly states that enabling installation on other workspaces allows the application to generate access tokens for each workspace and applicable user authorization. Bolt's current OAuth documentation likewise explains that each app installation issues unique access tokens and installation information that the application must store securely and retrieve when processing requests. This is fundamentally different from a single-workspace application, which can receive one access token through direct installation without implementing the full distributed OAuth flow. Independent workspaces do not normally share one universal token. Organization-wide Enterprise installations are a distinct model and can use an organization-level authorization, but that does not invalidate the standard multi-workspace distribution behavior tested here. Therefore, A is correct.

The `slack create` command is used to create a new Slack application project from a supported template. Slack CLI can prompt the developer to choose a starter project, or a template can be supplied directly, after which the command creates the local project directory and required project files. Slack's current quickstarts use `slack create` as the standard starting point for Bolt-based development in JavaScript or Python. This command is distinct from `slack run`, which executes the application locally, and from deployment or configuration commands used later in the lifecycle. `slack init`, `slack new`, and `slack bootstrap` are not the documented Slack CLI commands for scaffolding a new project. Therefore, option C correctly identifies the supported project-creation command.

Slack's standard Bolt quickstart supports starter projects for Python and JavaScript. The Slack CLI workflow lets a developer create a sample application using Bolt for Python or Bolt for JavaScript and then run that project in a development workspace. Both frameworks provide higher-level abstractions for common Slack application patterns, including event listeners, interactive actions, Web API clients, acknowledgments, and context-aware utilities. Slack also maintains Bolt for Java as an official framework, but the particular starter-template choice described by the standard quickstart is Python or JavaScript. Ruby, Go, C#, PHP, Rust, and Swift are not the two out-of-the-box starter choices represented in this question. Therefore, B correctly identifies Python and JavaScript as the standard Bolt starter-template languages in the Slack CLI quickstart.

Slack's current architecture guidance explicitly favors HTTP Request URLs for production applications when Socket Mode is not required. WebSockets are stateful, which makes them more complex to scale horizontally and more susceptible to connection interruptions, network partitions, and transient disconnections. Slack describes Socket Mode as particularly convenient for local development, on-premises integrations, environments behind firewalls, or applications unable to receive inbound HTTP traffic. For maximum application-connectivity reliability, Slack recommends HTTP for production applications and advises developers to continue using HTTP request URLs when their deployment does not specifically require Socket Mode. Socket Mode also does not replace the Web API; applications commonly receive events over Socket Mode and then invoke Web API methods to perform actions. Therefore, B accurately reflects Slack's present production-scale guidance.

Slack's `admin.conversations.*` methods provide Enterprise administrators with programmatic control over channels across an organization. Official Slack documentation lists methods for creating, deleting, archiving, unarchiving, and renaming channels, inviting users, searching channels, and changing channel visibility. For example, `admin.conversations.rename` can rename public or private channels, `admin.conversations.invite` adds users to channels, and `admin.conversations.search` searches conversations across an Enterprise organization. These methods require appropriate Admin API scopes and organization-level authorization and may additionally depend on the installing administrator's Channel Management permissions. They do not compile Bolt application code, construct Block Kit layouts, or issue app-level tokens; those functions belong to entirely different parts of Slack's developer platform. Therefore, A accurately represents the administrative channel-management capabilities of this API family.

Option A is the correct answer from the supplied choices. Slack historically exposed its complete Web API method reference at `api.slack.com/methods`, and that address currently redirects to Slack's modern developer documentation under the Methods reference at `docs.slack.dev/reference/methods/`. The reference contains Slack's available method families, including `admin.*`, `apps.*`, `auth.*`, `chat.*`, `conversations.*`, `files.*`, `users.*`, `views.*`, and many others. Each individual method page identifies supported access mechanisms, OAuth scopes, parameters, response structures, errors, and rate-limit information. The pricing and legal pages are unrelated to API-method documentation, while `app.slack.com/methods` is not Slack's developer method reference. Therefore, A remains valid, although the current canonical documentation location is Slack Developer Docs.

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.

Slack locale information is explicitly opt-in at the API-request level. For a conversation, an application can call conversations.info and set include_locale=true. For an individual member, it can call users.info with the same parameter. Slack then includes the applicable locale field in the returned object. The locale is represented using an IETF language identifier such as en-US or another supported language-region combination. Slack's design guidance recommends using a conversation's locale for content published publicly within that conversation and using the individual user's locale for private or personalized interactions. Option C is incorrect because locale is not included automatically by default. The application must explicitly request it. Option A incorrectly treats locale retrieval as an app-dashboard configuration toggle rather than a Web API argument. Option D refers to API methods that do not exist; Slack uses established methods such as users.info and conversations.info. Applications should also retrieve current locale information when preparing content rather than permanently assuming a user's language preference, because those preferences may change. This directly aligns with Design a Great User Experience, particularly internationalization and localization of Slack application content.

Block Kit is Slack's UI framework for constructing structured and interactive application interfaces. It provides reusable blocks, block elements, and composition objects that developers combine to create messages, modal views, and App Home experiences. Blocks define major visual sections of an interface, while elements provide interactive controls such as buttons, menus, text inputs, date pickers, and other components. Slack applications represent these interfaces through structured payloads and can use them across supported Slack surfaces. Block Kit is therefore concerned with presentation, interaction, information hierarchy, and application user experience. It does not provide message encryption, administrative user-role management, or API rate-limiting functionality. Those responsibilities belong to separate security, administrative, and platform-control mechanisms. Option B precisely describes Block Kit's documented function as a framework for building rich and interactive Slack application layouts.

Option C provides the cleanest modal architecture because each required decision is represented independently: reservation date, permitted time block, and the user's stored vehicle. A select menu is specifically designed to present a controlled list of choices without consuming excessive modal space. Slack's Block Kit specification provides date pickers, time/datetime elements, and select menus for precisely these kinds of structured inputs. A static or externally populated select menu can represent the employee's saved vehicles while the displayed option text can include identifying information such as license plate and parking classification. Option B becomes progressively unusable as users store more vehicles because one button per vehicle increases visual clutter and competes for limited modal space. Slack's design guidance emphasizes reducing unnecessary choices and avoiding overloaded surfaces. Option D combines the date and time into a datetime picker, but the scenario requires users to select a date and a defined time range/block, making separate controls more appropriate. Option A automatically preselects the previous vehicle, which can encourage users to submit an unintended selection and is not required by the scenario. Therefore, C remains the most appropriate Block Kit modal layout. This maps to Design a Great User Experience, particularly concise forms and appropriate input controls.

Slack bot tokens use the `xoxb-` prefix. These tokens represent the application's bot identity within an installed Slack workspace and carry the granular bot OAuth scopes granted during installation. Slack's official token documentation explicitly states that bot token strings begin with `xoxb-`. Developers must treat these values as secrets because possession of a valid token can permit API operations authorized by its associated scopes. Credentials should therefore be stored in a secure secrets-management system or protected environment rather than embedded in source code or exposed in logs. The `xapp-` prefix belongs to app-level tokens, which are used for application-level functionality such as Socket Mode. The remaining prefixes do not represent the standard Slack bot token type described by this question. Therefore, option A is correct.

The correct answer is B. read, post, client, search:read (or rather, let's look closely at legacy vs modern scopes; wait, read, post, client, search:read are listed in Slack docs as legacy/restricted scopes that are not allowed or accepted for new Marketplace submissions!). Let's re-read snippet 1.5.1 / 1.2.4: "do not include functionality in Slack. use legacy/restricted scopes or methods... (admin.*, identity.*, search:read, read, post, client...)". Wait, option B says read, post, client, search:read, but those are restricted/legacy. Let's check which set of scopes would be allowed . Wait, granular scopes like admin:post, admin:read, admin:search, client:connect? Wait, let's check if D uses granular scopes or if none are allowed or if D is the correct choice because options A, B, C contain legacy broad scopes (read, post, client, search:read, admin). Option D uses granular scopes (admin:post, admin:read, admin:search, client:connect).

Slash commands are application entry points that allow users to invoke Slack app functionality directly from the message composer. A user enters a forward slash followed by the registered command—for example, `/todo`—and Slack routes the resulting command payload to the associated application. The payload includes contextual information and any text entered after the command. The application must acknowledge the request promptly and can respond through mechanisms such as `respond()`, `say()`, or subsequent Web API operations. Slack's official documentation explicitly describes slash commands as allowing users to invoke an app by typing a string into the message composer. They are unrelated to message encryption, workspace theme configuration, or general channel deletion. Therefore, B accurately describes the purpose of Slack slash commands.

Slack applications declare their requested OAuth permissions through application configuration. These permissions can be configured in the app settings under OAuth & Permissions or represented declaratively in an app manifest. Within a manifest, scopes reside under `oauth_config.scopes`, with separate fields for bot and user scopes. Slack's current platform also supports optional scopes through `bot_optional` and `user_optional`. The scopes determine what actions and data the application's tokens may access after authorization. Browser cookies do not define Slack app permissions, and the Slack CLI's local configuration is not the authoritative location for declaring the application's OAuth scope requirements. Scopes absolutely can—and normally should—be determined before installation so users and administrators can review the requested permissions during OAuth authorization. Therefore, A is correct.

One of the strongest benefits of Slack app manifests is that application configuration becomes portable, reviewable, and reproducible. Slack explicitly recommends storing manifests in version-control systems such as GitHub, where collaborators can understand application setup and track configuration changes over time. A manifest can then be reused to create or configure apps consistently instead of manually reproducing settings through the web interface. This significantly reduces configuration drift between development, testing, and related application environments. A manifest is not the only mechanism for enabling bot functionality, does not eliminate OAuth authorization requirements, and does not automatically publish an application to the Slack Marketplace. Distribution and Marketplace publication remain separate lifecycle processes with their own requirements. Therefore, the version-controlled and repeatable configuration benefit described in B is precisely aligned with Slack's manifest documentation.

A private channel is represented through Slack's unified conversation-object model. Slack's Conversations API consolidates several historically separate object categories into the conversation abstraction. Depending on its properties, a conversation object can represent a public channel, private channel, direct message, multi-person direct message, and other conversation-oriented constructs. For a private channel, the conversation object exposes properties such as is_private. Slack's modern APIs therefore avoid requiring developers to treat every channel type through entirely separate legacy APIs. Older terminology such as group survives in some legacy documentation and fields, but private channels are now handled through the Conversations API. A public message is not itself a conversation; it is content contained inside a conversation. A message reaction is metadata or an event associated with a message. A file attachment similarly represents content attached to or referenced from a message rather than a conversation container. The distinction matters when using methods such as conversations.info, conversations.list, conversations.history, and other Conversations API operations because the same core object model can represent multiple Slack conversation types. This maps to Apps in the Slack Platform, specifically understanding Slack's object model and the unified Conversations API.

The Audit Logs API is designed to provide security and administrative visibility into activities occurring across an Enterprise organization. Option B contains two valid examples of such activity: file downloads and changes involving Slack applications. Slack's Audit Logs API includes audit actions such as file_downloaded, allowing security teams or SIEM platforms to investigate potentially suspicious download behavior. It also records application lifecycle and authorization activity. Supported actions include app_installed and app_scopes_expanded, the latter indicating that an application has been granted additional OAuth access. The API is primarily read-only monitoring infrastructure. It retrieves audit events and supports filtering by properties such as action, actor, entity, and time range. Therefore, option D is incorrect because the API itself does not control whether applications are approved; administrative APIs and workspace/org controls perform those actions. The Audit Logs API is also not a general message-content surveillance API for detecting arbitrary keywords, making C incorrect. Subscription billing and plan-user accounting are likewise outside its intended purpose. This aligns directly with APIs for Managing Your Slack, specifically Enterprise security monitoring and administrative event visibility through the Audit Logs API.

A Slack app initially created for one development workspace cannot simply be installed into unrelated workspaces. To support multi-workspace installation, the application must implement the Slack OAuth authorization flow and enable distribution. A key prerequisite is configuring an OAuth Redirect URL. After an installing user authorizes the requested scopes, Slack returns a temporary authorization code to this redirect URI. The application's server then exchanges that code using oauth.v2.access for installation credentials. Slack's official distribution documentation also requires the developer to enable application distribution from the app-management interface. Historically the setting is described as Activate Public Distribution; current documentation may refer more generally to app distribution or unlisted distribution. Marketplace publication is not required merely to make an application installable by other workspaces. An unlisted distributed application can be shared directly with selected customers through its installation flow. Option C contains a serious security defect because workspace and user IDs must not be hard-coded. Option D does not establish multi-workspace authorization. Therefore, A provides the minimum architecture required for cross-workspace installation. This maps directly to Distribute Your App, particularly OAuth, redirect URLs, and distributed installations.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

Slack recommends making help accessible where users naturally interact with an application. For conversational applications, Slack's onboarding guidance specifically recommends replying when users request help in the application's DM and responding appropriately when the app is @mentioned. An app mention often indicates that a user either intends to invoke the application or needs guidance, making B directly aligned with Slack's recommendations. The application's Home tab is also an appropriate persistent location for support information and interactive help controls. Current Slack Marketplace UX guidance explicitly recommends making help and support easily accessible as part of the application experience and specifically cites placing support information in the app Home tab. Because Home tabs support Block Kit interactivity, a help button can provide an obvious, reusable entry point to assistance, making C appropriate. A feedback workflow does not directly provide operational help. Message shortcuts are intended primarily for actions associated with an existing message rather than general application assistance. Sending users unsolicited DMs containing prominent external URLs is also less consistent with Slack's preference for helpful, contextual, non-spammy onboarding. This maps to Design a Great User Experience, covering onboarding, discoverability, App Home, and contextual support.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Slack explicitly recommends applying the principle of least privilege when choosing OAuth scopes. An application should request only the minimum permissions required to perform its intended functionality. Every unnecessary scope expands the data or operations available to the application and therefore increases the potential impact of credential compromise, implementation defects, or inappropriate application behavior. Slack's security guidance recommends defining minimal scope sets and auditing requested permissions regularly. Marketplace guidance reinforces the same principle because users and administrators may reject applications that request excessive access to sensitive Slack data. Slack does not charge applications according to their number of scopes, and narrower scopes do not exist primarily to improve performance. Broad scopes have not simply been universally deprecated; rather, developers are expected to justify and minimize permissions. Therefore, B accurately captures Slack's security model and recommended application-design practice.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.

Slack requires a valid trigger_id when an application opens a modal through views.open. A trigger_id is generated in response to an explicit user interaction, including a global shortcut, slash command, button interaction, or supported interactive component. This requirement ensures that an application cannot arbitrarily display modal interfaces without recent user intent. When the user invokes the “Request Changes” global shortcut, Slack sends an interaction payload to the application. The application must acknowledge that request and use the contained trigger_id when calling views.open. Slack currently specifies that a trigger_id expires approximately three seconds after it is issued, so the application must use it promptly. A response_url is used to send follow-up responses for certain interactive requests and slash commands rather than to authorize modal opening. A callback_id is an application-defined identifier used to identify interaction flows in older or specific payload contexts. The payload's verification token is likewise not a modal-opening credential. Therefore, D is correct. This is a core Design the Interactive Flow of Your App concept involving shortcuts, interaction payloads, modal invocation, and views.open.

Bolt provides a higher-level application framework that uses Slack's language SDKs underneath. Slack's platform overview explains that the Bolt frameworks for Python, JavaScript, and Java use the corresponding Slack SDKs to handle lower-level development details. The SDK layer exposes primitives such as Web API clients, authentication, HTTP requests, and API method implementations, while Bolt adds listener registration, middleware, context injection, interaction acknowledgment, event routing, and other application-development conveniences. This architecture allows developers to build Slack applications without repeatedly implementing platform plumbing themselves. Bolt and the SDKs therefore are not unrelated, nor do the SDKs automatically replace Bolt. Conversely, Bolt depends on the capabilities supplied by its underlying language ecosystem rather than functioning independently of them. Option B most accurately describes the documented architectural relationship between these components.

Adding additional app collaborators is the appropriate lifecycle-management practice because application administration should not depend exclusively on one individual's Slack account. Slack provides collaborator management specifically so multiple authorized developers or maintainers can manage an application. Current Slack tooling supports adding, listing, and removing collaborators, and Slack's application lifecycle documentation recognizes creator/collaborator status when determining application continuity in certain installation circumstances. There is an important modern-platform nuance. With granular-permission Slack apps, deactivation of an installing user does not necessarily invalidate a bot installation in the same way older Slack application models did. Nevertheless, relying on a single owner still creates an administrative single point of failure. Adding collaborators preserves access to configuration and maintenance functions when the original developer leaves or becomes deactivated. Source-code version control is essential engineering practice but does not itself transfer Slack application ownership or management rights. Storing tokens securely is a security requirement, not an ownership-continuity mechanism. Visiting App Home has no effect on app administrative ownership. This therefore remains A and aligns directly with Apps in the Slack Platform, whose certification objective includes identifying when a team should be established to collaborate on a Slack application.

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

Slack Marketplace publication is not automatic. Applications must satisfy Slack's Marketplace guidelines and pass Slack's submission and review process. Slack evaluates areas including functionality, installation and OAuth behavior, user experience, requested scopes, security controls, privacy documentation, support readiness, and application quality. As of September 2026, Slack also requires new Marketplace submissions to maintain at least 10 installations on active workspaces throughout review, subject to stated exceptions such as qualifying security and compliance partners. However, installation count alone does not qualify an application for publication; the complete Marketplace review requirements still apply. Enterprise Grid is likewise not required merely to publish an app. Therefore, B is the comprehensive correct answer because it encompasses Slack's review, eligibility, security, quality, distribution, and current submission requirements.

C# is the correct answer. Slack officially maintains the Bolt framework for JavaScript, Python, and Java. Bolt provides a higher-level application framework over Slack's underlying SDKs and handles substantial platform plumbing such as receiving and acknowledging events, routing interactive actions, authentication, authorization, token handling, and rate-limit-aware integration patterns. JavaScript is supported through Bolt for JavaScript. Python is supported through Bolt for Python. Java is supported through Bolt for Java and the Slack Java SDK. Slack's platform overview explicitly identifies these three languages as the supported Bolt implementations. C# applications can still interact with Slack because Slack's Web API is fundamentally HTTP-based. A developer can make HTTPS requests from C# and implement event endpoints, OAuth, request verification, and other Slack functionality manually or through third-party libraries. That does not make C# an officially supported Bolt framework implementation. The distinction is important for certification purposes: the question asks specifically which language Bolt does not support, rather than which languages can communicate with Slack APIs. This maps directly to the Tools objective, which requires candidates to understand when and how the Bolt development framework is used in Slack application development.

Public channels are the only conversation type among these choices for which Slack provides an explicit permission enabling an app to post without first becoming a member. The relevant permission is the chat:write.public scope, used together with chat:write. Slack describes chat:write.public as permitting a Slack app to send messages to public channels in which the application is not a member. Without that additional scope, an app normally must join the public channel or be invited before posting. Private channels require appropriate membership and authorization because allowing an app to post into a private conversation without membership would violate Slack's privacy model. Likewise, ordinary direct messages and multi-person direct messages have different membership and conversation-opening semantics and are not equivalent to posting freely into a public channel. The wording “by default” in the source is somewhat imprecise because granular-permission Slack apps do not automatically receive access to all public channels. They must request chat:write.public. Nevertheless, among the four conversation types, D represents the intended and technically supported capability. This question aligns with Design Your Workflows: Spotlight on Slack's APIs, particularly chat.postMessage, conversation membership, and OAuth scope behavior.

A bot token represents the bot identity associated with a Slack app installed in a workspace and is the standard credential used by many Slack applications when calling Web API methods. Modern bot tokens use Slack's granular permission model, meaning their actual capabilities are determined by the bot scopes approved during installation. Bot tokens conventionally begin with `xoxb-`. They differ fundamentally from app-level tokens, which represent the application itself across installations and are limited to specific application-level functionality such as Socket Mode connectivity. A session cookie is not an application API credential. A refresh token is used when token rotation is enabled to obtain replacement access tokens rather than serving as the ordinary credential for API operations. Consequently, among the available choices, the bot token is the correct token type for routine workspace application API operations.

Interactive buttons are the appropriate component because the approval action is directly associated with an existing Slack message. Slack specifically recommends making notification messages actionable when the recipient is expected to perform an immediate follow-up activity. Approval scenarios are a canonical example: a message can contain Approve/Reject buttons, and the resulting interaction payload can be processed by the application backend. After the manager selects Approve, the application can persist the approval to the external vacation-management service and then modify the Slack message to represent the new state. Slack's chat.update method is explicitly designed to update previously posted, non-ephemeral messages and is suitable for reflecting state changes after an interactive action. Interactive messages therefore provide both the decision mechanism and a clean method for maintaining visible state. A reaction could signal intent but does not provide the same structured interactive workflow. Global shortcuts and slash commands are primarily workflow entry points and are unnecessary when the actionable business object is already represented by a message. This aligns directly with Design the Interactive Flow of Your App, including interactive message components and updating application surfaces after user actions.