Salesforce Slack-Dev-201 Salesforce Certified Slack Developer Exam Practice Test

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

A Slack application created for use exclusively inside its associated workspace does not need public distribution or a multi-workspace OAuth installation architecture. Slack classifies such an application as an undistributed or single-workspace app. It can be installed directly into its associated development workspace through the app-management configuration. Because the IT manager needs access to the app's configuration, adding that person as an application collaborator provides the appropriate administrative access. The collaborator can then install the application to the Business Operations workspace through the app dashboard. Option A unnecessarily enables distribution to other workspaces. Once public distribution is activated, Slack provides a shareable installation URL intended for multi-workspace installations. Option C similarly introduces OAuth infrastructure that is required when distributing an application beyond its associated workspace but is unnecessary for this internal single-workspace scenario. Option D is even broader because Slack Marketplace publication is intended for externally distributed applications that have completed Slack's review process. Slack's current lifecycle documentation confirms that newly created apps reside in an associated workspace and can be installed there directly without building a separate authorization flow. This belongs to Distribute Your App, particularly understanding single-workspace versus distributed application models.

Slack's current documentation names this capability the Slack MCP and Skills Plugin. It is designed to improve AI-assisted and agent-assisted Slack development by supplying coding agents with specialized Slack development skills and, on supported clients, a connection to the Slack MCP Server. The skills provide focused instructions and references for tasks such as scaffolding Slack apps, validating Block Kit objects, composing messages, calling Web API methods, and using Slack CLI functionality. The MCP Server can additionally allow supported AI tools to interact with workspace data, including searching channels, sending messages, and managing canvases. Slack documents support for tools such as Claude Code, Codex, Cursor, and other coding agents, with capabilities varying by client. It does not replace Slack CLI or exist solely for OAuth. Therefore, A is correct.

Slack workflows can begin from multiple types of triggers rather than being limited to scheduled execution. Workflow Builder supports event-driven automation, and available triggers can include Slack activity, user-invoked links or shortcuts, scheduled execution, webhook-based initiation, and other supported events. Slack's developer examples specifically demonstrate workflows starting when an emoji reaction is applied, while Workflow Builder documentation describes combining supported triggers with workflow steps to create automations. The precise trigger choices available can vary by workflow architecture, workspace plan, and evolving Workflow Builder capabilities, but the central concept remains that workflows can start from many different events or user actions. Therefore, options A, C, and D are overly restrictive. Among the supplied answers, B best represents Slack's event-driven and scheduled workflow-trigger model and is the correct answer.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

The `divider` block is the Block Kit component specifically designed to create a visual horizontal separation between adjacent pieces of content. Slack describes it as a content divider comparable to an HTML horizontal rule, allowing developers to organize messages, modals, and Home tabs into clearly separated visual sections. Its JSON representation is intentionally simple and normally requires only `"type": "divider"`, although a `block_id` can optionally be supplied. The alternatives `separator`, `line`, and `rule` are not valid Slack Block Kit block types. Dividers should be used where visual grouping improves readability rather than as substitutes for meaningful content structure. Slack officially supports divider blocks across messages, modals, and Home tabs. Therefore, A is the verified answer.

Slack shortcuts provide explicit entry points that users can invoke to start application functionality. Slack supports two principal shortcut types: global shortcuts and message shortcuts. Global shortcuts can initiate functionality without requiring an existing message context, while message shortcuts are attached to individual messages and appear in the message context menu. When a shortcut is invoked, Slack sends an interaction payload to the application containing contextual information and a `trigger_id`, which can be used to open a modal or continue another interactive flow. Webhooks are message-delivery mechanisms rather than user action entry points. OAuth scopes define permissions, while manifests describe application configuration. Consequently, Shortcuts is the Slack feature specifically designed to let users invoke application actions from Slack UI locations.

Slack supports unlisted distributed applications specifically for scenarios such as pilots, early customer testing, and beta validation before a Marketplace submission. To install an application outside its original workspace, the developer must configure the required OAuth flow and enable distribution through the application's Manage Distribution settings. After activating public distribution, Slack provides a Shareable URL that initiates the app's installation process. The developer can send this URL directly to beta testers at other organizations. Those users can install and test the application subject to their own workspace's app-management policies. Once testing is complete and the application meets Slack's quality, functionality, privacy, security, and distribution requirements, it can be submitted for Slack Marketplace review. A Marketplace listing is not available as a substitute for pre-review beta distribution. Creating cloned versions for every customer is unnecessary and creates configuration-management problems. Inviting external beta testers into the developer's own workspace would also fail to test the critical multi-workspace OAuth and installation behavior. Current Slack documentation explicitly identifies unlisted distribution as appropriate for early-customer pilots before broader Marketplace publication. This belongs to Distribute Your App, covering public distribution, OAuth installations, beta testing, Shareable URLs, and Marketplace submission.

The Slack CLI is Slack's official command-line development tool for creating, running, and managing Slack app projects. It supports the standard local development workflow used in Slack's current quickstarts, including creating a project from a template, authenticating with a development workspace, running the app locally, and opening app configuration. The command-line workflow is integrated with supported Slack SDKs and Bolt starter projects, so developers can move from scaffolding to testing without manually assembling the entire project structure. The alternatives listed are not Slack's official app-development command-line tool: there is no standard npm create-slack or pip slack-init workflow, and Bolt Studio is not the CLI product. Therefore, A correctly identifies Slack CLI as the official tool for command-line app development.

Slack defines every Audit Logs API event around four principal components: action, actor, entity, and context. The action specifies what occurred—for example, a user login, application installation, role change, or file-related administrative event. The actor identifies the user, application, or system responsible for performing the action. The entity represents the Slack resource affected by that action. The context provides environmental information surrounding the event, such as the location, workspace, organization, or session-related information relevant to interpreting what happened. Slack summarizes this relationship conceptually as an actor taking an action on an entity within a context. This structured model enables security teams to ingest Slack audit data into SIEM, monitoring, anomaly-detection, and forensic-analysis systems. Option A substitutes the vague terms “event” and “user,” which do not reflect Slack's formal audit schema. Option B incorrectly replaces entity with team, and D omits context. For certification purposes, these four fields are foundational because Audit Logs API workflows depend on understanding who performed an activity, what activity occurred, which resource was affected, and the surrounding operational context. This question belongs to APIs for Managing Your Slack, specifically the Audit Logs API data model.

Slack's app approval and app-management controls allow administrators to govern application installation and usage. Workspace Owners can enable app approval, pre-approve applications, restrict applications, and determine whether members can request unapproved apps. In Enterprise organizations, Org Owners can establish organization-level app-management policies that enable app approval across workspaces and control which applications may be installed or used. Enterprise administrative interfaces also support approving, restricting, installing, and distributing apps across selected workspaces. Block Kit Builder is a UI-design utility, Socket Mode is an event-delivery mechanism, and the Events API delivers Slack activity notifications; none of those features governs app installation policy. Therefore, option A is the correct administrative control for determining which applications users are allowed to install or request within managed Slack environments.

 member_joined_channel (often referred to as member_joined in event grouping contexts): This event is triggered when a standard user joins a public or private channel. Subscribing to this allows your bot to see whenever someone joins #it-help and instantly send them the welcome overview and resources guide.

 channel_joined: This event is specifically sent to your application when the bot user itself is added to a channel. Subscribing to this ensures your bot knows it has been successfully added to #it-help so it can begin its duties or send an initial greeting.

 app_mention: This event explicitly handles instances where users mention the bot (e.g., @ITHelpBot how do I connect to the VPN?). Subscribing to this lets the bot listen for and respond to specific user queries without needing access to read every single regular message in the channel.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Slack's documented macOS and Linux installation method uses the official shell installer hosted on Slack's downloads domain. The command `curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bash` retrieves the installer securely and runs it through Bash, installing the Slack CLI and making the `slack` command available for development. Slack's current CLI installation documentation presents this command as the supported installation path for macOS and Linux. The alternatives do not represent the official installation command in the Slack Developer documentation: Slack CLI is not installed through the listed npm or pip commands, and `brew install slack` does not correspond to Slack's documented CLI installer. Therefore, option B is the verified installation command for the environments named in the question.

A is the current technically correct answer, replacing the uploaded bank's marked C. Slack's current token taxonomy does not define an “Admin” token type. Slack officially distinguishes token types such as bot tokens, user tokens, workflow tokens, and configuration tokens. Administrative authority is expressed through admin.* OAuth scopes attached to a user token, rather than through a separate token type called “Admin.” For example, Slack's official documentation for admin.conversations:read, admin.apps:read, and related Admin API scopes explicitly lists the supported token type as User. To obtain a user token imbued with Admin API scopes, the application must be installed at the entire Enterprise organization level by an authorized Org Admin or Org Owner. The resulting user access token can then call the applicable admin.* methods. Creating, inviting members to, and archiving channels require the appropriate administrative conversation scopes, particularly admin.conversations:*, subject to the installer having the corresponding Channel Management permissions. Therefore, under current Slack documentation, User is the correct token type. “Admin token” is outdated/imprecise terminology because admin describes the permission scope, not a distinct token class. This maps directly to APIs for Managing Your Slack.

A Slack app initially created for one development workspace cannot simply be installed into unrelated workspaces. To support multi-workspace installation, the application must implement the Slack OAuth authorization flow and enable distribution. A key prerequisite is configuring an OAuth Redirect URL. After an installing user authorizes the requested scopes, Slack returns a temporary authorization code to this redirect URI. The application's server then exchanges that code using oauth.v2.access for installation credentials. Slack's official distribution documentation also requires the developer to enable application distribution from the app-management interface. Historically the setting is described as Activate Public Distribution; current documentation may refer more generally to app distribution or unlisted distribution. Marketplace publication is not required merely to make an application installable by other workspaces. An unlisted distributed application can be shared directly with selected customers through its installation flow. Option C contains a serious security defect because workspace and user IDs must not be hard-coded. Option D does not establish multi-workspace authorization. Therefore, A provides the minimum architecture required for cross-workspace installation. This maps directly to Distribute Your App, particularly OAuth, redirect URLs, and distributed installations.

When a Bolt project is being developed locally through the current Slack CLI, `slack run` can watch application files and automatically restart the local application development server when supported source files change. Slack documents this behavior for Bolt for Python and Bolt for JavaScript projects. Python projects normally watch `.py` files, while JavaScript projects watch `.js` files unless the developer customizes the watch configuration. This live-reload capability shortens the development cycle because developers can modify application logic and have the running process restarted without manually stopping and relaunching it after every edit. The Slack workspace itself is not restarted, the user's browser is unaffected, and OAuth tokens are not regenerated merely because source code changes. Therefore, B is correct.

The `plain_text_input` element is specifically intended to collect free-form textual information from users. Slack allows the element to accept either single-line or multiline text and commonly places it inside an `input` block when constructing a modal form. The application receives the entered value when the modal generates a `view_submission` payload, allowing the backend to validate and process the submitted information. A button initiates an action rather than collecting text. A `static_select` element presents predefined choices, while an overflow menu provides a compact collection of predefined actions or selections. Neither alternative allows unrestricted textual entry. Slack's Block Kit element reference explicitly identifies the plain-text input element as the component for entering free-form data. Therefore, B is the correct element for collecting textual input inside a modal.

A distributed Slack app uses the OAuth 2.0 authorization-code flow to obtain authorization for each installation. The process begins by redirecting the installing user to Slack's authorization endpoint: https://slack.com/oauth/v2/authorize. The authorization request contains the application's Client ID together with the permissions being requested. Bot scopes are supplied using the scope parameter, while user scopes can be supplied through user_scope. The application's Client Secret must not be exposed in the browser-facing authorization request. After the user approves installation, Slack sends a temporary authorization code to the application's configured redirect URI. The backend then securely combines that temporary code with the application's client credentials when calling oauth.v2.access to exchange the code for access credentials. This distinction invalidates A and B because oauth.v2.access is the backend token-exchange API endpoint, not the user-facing authorization endpoint. D is incorrect because it would expose the Client Secret in a user redirect, violating OAuth security architecture. This question maps directly to Distribute Your App, particularly multi-workspace distribution, OAuth installation flows, requested scopes, and secure handling of Slack application credentials.

GovSlack is a separate Slack environment specifically designed for U.S. public sector organizations and their security and compliance requirements. Slack states that GovSlack enables agencies, contractors, citizens, and partners to collaborate through an environment designed for stringent public-sector operational requirements. GovSlack operates separately from commercial Slack on the `slack-gov.com` domain, with data isolated from the commercial Slack environment. It runs in AWS GovCloud-certified infrastructure and supports compliance requirements including FedRAMP High. Developers making commercial Slack apps available in GovSlack must separately configure and deploy them for that environment and follow GovSlack-specific API, OAuth, credential, and Marketplace requirements. It is therefore neither a personal free-workspace product nor a Marketplace testing environment. Answer A is correct.

Slack modals are opened through the `views.open` Web API method using Bolt's built-in API client. After a shortcut, slash command, button click, or another qualifying interaction, Slack supplies a `trigger_id`. The application acknowledges the incoming interaction and promptly exchanges that trigger through `views.open` together with a valid modal view payload. In Bolt for JavaScript, this is commonly represented through the client's `views.open` interface; Bolt for Python exposes the corresponding `client.views_open()` method. The important platform primitive is therefore `views.open`, regardless of the language-specific SDK naming convention. A `trigger_id` must be used quickly because it has a short validity period. Neither `app.modal()` nor `app.popup()` nor `client.modal.show()` is Slack's documented method for opening modal views. Therefore, B is the correct answer.

Slack's `admin.conversations.*` methods provide Enterprise administrators with programmatic control over channels across an organization. Official Slack documentation lists methods for creating, deleting, archiving, unarchiving, and renaming channels, inviting users, searching channels, and changing channel visibility. For example, `admin.conversations.rename` can rename public or private channels, `admin.conversations.invite` adds users to channels, and `admin.conversations.search` searches conversations across an Enterprise organization. These methods require appropriate Admin API scopes and organization-level authorization and may additionally depend on the installing administrator's Channel Management permissions. They do not compile Bolt application code, construct Block Kit layouts, or issue app-level tokens; those functions belong to entirely different parts of Slack's developer platform. Therefore, A accurately represents the administrative channel-management capabilities of this API family.

Slack's current quickstart recommends using a developer sandbox when a developer does not already have a suitable Slack workspace for application development. A developer sandbox provides an isolated environment where an app can be installed, tested, and iterated without disrupting a production workspace. Slack CLI includes sandbox-related tooling, and the quickstart treats the sandbox as the preferred development environment for users who lack an existing workspace. A paid Slack plan, Enterprise Grid organization, or verified domain is not a prerequisite simply to begin a Slack CLI project. Strictly speaking, Slack documentation frames the sandbox as the recommended development workspace rather than a universal technical requirement in every circumstance; however, among the supplied choices, B is unequivocally the intended and correct answer.

conversations.history is Slack's current unified Web API method for retrieving message history from conversations. With the relevant OAuth scopes, a bot token can retrieve message history from conversations in which the bot is a member. Public-channel history requires channels:history, while private-channel history requires groups:history. Therefore, the app must be present in the applicable channels and possess the corresponding history scopes. Option C relies on legacy methods. Slack consolidated historically separate channel APIs into the Conversations API, making conversations.history the supported method for both public and private conversation history. The Events API can deliver newly occurring message events, but it does not independently provide the historical messages already stored in the conversation. Therefore, A does not meet the requirement to read both existing and subsequent message history. The Discovery API is a specialized Enterprise security and compliance capability and is inappropriate for an ordinary internal application. The source question and marked answer are therefore consistent with current Slack behavior. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly conversation membership, history scopes, and the unified Conversations API.

Slack Marketplace publication is not automatic. Applications must satisfy Slack's Marketplace guidelines and pass Slack's submission and review process. Slack evaluates areas including functionality, installation and OAuth behavior, user experience, requested scopes, security controls, privacy documentation, support readiness, and application quality. As of September 2026, Slack also requires new Marketplace submissions to maintain at least 10 installations on active workspaces throughout review, subject to stated exceptions such as qualifying security and compliance partners. However, installation count alone does not qualify an application for publication; the complete Marketplace review requirements still apply. Enterprise Grid is likewise not required merely to publish an app. Therefore, B is the comprehensive correct answer because it encompasses Slack's review, eligibility, security, quality, distribution, and current submission requirements.

A and C are the two choices that best align with the current official Slack design guidance. Slack emphasizes concise, easily processed content. Applications should communicate clearly and minimize unnecessary cognitive load so users can understand information quickly rather than reading lengthy or overly complex interfaces. This supports the principle represented by option A. Slack's Block Kit design guidance also recommends simplifying suitable information with pictures. For example, faces may communicate user identity more efficiently than lists of names, and maps can sometimes communicate location more effectively than text. Images must still be accessible through appropriate alt_text; the recommendation is not to remove essential textual meaning indiscriminately. Option B is incorrect under current official guidance. Slack explicitly states that shortcut names should start with a verb, not a noun. Option D conflicts with Slack's recommendation to avoid excessive notifications, while option E is directly contrary to the guidance to reduce complexity by progressively revealing controls and information. The supplied document marks A and B, but B conflicts with Slack's published developer guidance and therefore should not be retained as the verified answer. This question belongs under Design a Great User Experience.

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

Application governance in an Enterprise Slack organization is performed through administrative roles rather than ordinary channel members or application developers. Slack currently allows Org Owners, Org Admins, and appropriate administrative roles to view and manage applications at the organization level. Organization administrators can approve or restrict applications and establish policies that affect workspaces throughout the organization. At the workspace level, Workspace Owners and designated app managers can review requests and manage applications within the authority allowed by organization-wide policies. Slack support does not perform routine customer app approvals, and the original application developer does not control whether another organization's administrators permit installation. Although current Slack role models are more granular than the wording of the question, option B correctly represents the responsible administrative groups.

A modal is a focused application surface that appears over the Slack interface and maintains the user's attention until it is submitted or dismissed. Slack describes modals as alert boxes, pop-ups, or dialog-style interfaces used for focused interactions. Applications commonly use them to collect structured information, present temporary details, configure settings, or guide a user through a task. Modal content is constructed using Block Kit blocks and interactive elements, including text inputs, select menus, buttons, and date pickers. Modals are typically opened after an explicit user interaction by calling `views.open` with a valid `trigger_id`. They are not scheduled background processes, authentication tokens, or organization-wide announcement mechanisms. Therefore, option B accurately describes the purpose and presentation model of a Slack modal.

Slack uses OAuth scopes to define and grant specific permissions to applications. Each scope authorizes access to a defined category of data or actions—for example, reading particular conversation information, viewing user information, or posting messages. Slack applications have no general API access by default; their effective privileges are determined by the scopes associated with their access tokens. Bot scopes grant permissions to the application's bot identity, while user scopes allow appropriately authorized actions on behalf of a user. Although application manifests can declare the scopes an application requests, the manifest itself is not the authorization mechanism. IP allowlisting can supplement token security but does not grant Slack API permissions, and workspace passwords are unrelated to application authorization. Therefore, OAuth scopes are the correct mechanism, making B the verified answer.

Option B provides the strongest Slack-platform architecture because the process requires individualized status tracking, integration with an external system of record, recurring reminders, and escalation when employees remain noncompliant. Slack apps are specifically intended to automate tasks and connect Slack with external business systems. The application can determine each employee's compliance state externally and send targeted Slack notifications only where action is required. A quarterly announcement workflow is insufficient because it treats every employee identically and cannot distinguish completed from outstanding obligations. It also lacks an escalation mechanism. Option C unnecessarily places compliance training and acceptance inside Slack even though the scenario identifies an external system of record. That creates duplicated state and introduces additional governance concerns around which system represents the authoritative acceptance record. Slack's application-design guidance also cautions against noisy broad notifications. Targeted communication is preferable where a service concerns an individual user, and manager escalation can be generated only for unresolved cases. This maps to Apps in the Slack Platform, particularly recommending how Slack applications can automate organizational operations and integrate existing business processes with external systems.

Workflow Builder is Slack's no-code environment for creating automated workflows directly within Slack. Authorized users can combine triggers, built-in actions, connector actions, forms, conditional logic, and other workflow steps to automate repeatable business processes without implementing a complete custom application. Slack describes Workflow Builder as a no-code way to build workflows in which users combine supported steps and triggers to create automations. Developers can extend these workflows by supplying custom workflow steps when business logic exceeds the built-in capabilities. Workflow Builder is not primarily an app-manifest editor, a Bolt compilation environment, or an OAuth-token management interface. Those responsibilities belong to Slack app configuration, development tooling, and authentication mechanisms respectively. Consequently, B accurately captures the principal role of Workflow Builder within Slack's automation architecture.

A message posted to an authorized conversation is a standard example of activity that can generate an Events API notification. Slack provides specific message event subscriptions for different conversation types, including `message.channels`, `message.groups`, `message.im`, and `message.mpim`. The exact events an application receives depend on its subscribed event types, granted OAuth scopes, and access to the relevant conversation. Slack's own Events API walkthrough uses a message posted in a channel containing a bot as a canonical example: Slack sends the event to the application, the server acknowledges it, and application logic can then respond using a Web API method such as `chat.postMessage`. A user's local clock, browser-tab changes, and ordinary billing renewal are not Events API event triggers represented by these developer subscriptions. Therefore, A is correct.

Adding additional app collaborators is the appropriate lifecycle-management practice because application administration should not depend exclusively on one individual's Slack account. Slack provides collaborator management specifically so multiple authorized developers or maintainers can manage an application. Current Slack tooling supports adding, listing, and removing collaborators, and Slack's application lifecycle documentation recognizes creator/collaborator status when determining application continuity in certain installation circumstances. There is an important modern-platform nuance. With granular-permission Slack apps, deactivation of an installing user does not necessarily invalidate a bot installation in the same way older Slack application models did. Nevertheless, relying on a single owner still creates an administrative single point of failure. Adding collaborators preserves access to configuration and maintenance functions when the original developer leaves or becomes deactivated. Source-code version control is essential engineering practice but does not itself transfer Slack application ownership or management rights. Storing tokens securely is a security requirement, not an ownership-continuity mechanism. Visiting App Home has no effect on app administrative ownership. This therefore remains A and aligns directly with Apps in the Slack Platform, whose certification objective includes identifying when a team should be established to collaborate on a Slack application.

Block Kit is Slack's UI framework for constructing structured and interactive application interfaces. It provides reusable blocks, block elements, and composition objects that developers combine to create messages, modal views, and App Home experiences. Blocks define major visual sections of an interface, while elements provide interactive controls such as buttons, menus, text inputs, date pickers, and other components. Slack applications represent these interfaces through structured payloads and can use them across supported Slack surfaces. Block Kit is therefore concerned with presentation, interaction, information hierarchy, and application user experience. It does not provide message encryption, administrative user-role management, or API rate-limiting functionality. Those responsibilities belong to separate security, administrative, and platform-control mechanisms. Option B precisely describes Block Kit's documented function as a framework for building rich and interactive Slack application layouts.

Workflow Builder is intentionally designed as a no-code automation environment, so ordinary workspace members can create workflows without being software developers. Slack currently states that, by default, all regular members can access Workflow Builder and create workflows, although owners and administrators can restrict who has permission to do so. In Enterprise organizations, Org Owners and Org Admins can similarly establish organization-level policies governing workflow creation. Workflow Builder therefore enables business users to automate routine processes using triggers, forms, Slack actions, connector steps, and other visual components. It is not restricted to Slack employees, certified developers, or Enterprise Grid owners. The important qualification in option B is “with the appropriate permissions,” because administrative policies can narrow the default access. Therefore, B is the correct answer.

Interactive Block Kit components such as buttons generate interaction payloads when users activate them. Slack delivers the payload to the application through its configured interactivity request endpoint or through Socket Mode when that transport mechanism is enabled. The payload identifies the user, application, workspace, conversation context, and specific action through properties such as the component's `action_id`. The application should acknowledge the interaction promptly and can then perform business logic, update the original message, call a Web API method, or open another interface such as a modal. Clicking a button does not automatically delete its containing message or revoke the user's OAuth authorization. Slack also does not simply ignore a properly configured interactive action. Therefore, B accurately describes Slack's interactive-component processing architecture.

The legacy Slack term group historically referred to what the modern platform calls a private channel. Slack's current Group object documentation explicitly directs developers to the Conversation object documentation for private channels and explains that older private channels were historically known as “private groups.” Modern Slack development uses the unified Conversations API. A conversation can represent a public channel, private channel, direct message, multi-person direct message, or other supported conversational surface. Developers can inspect properties such as is_private, is_im, and is_mpim rather than relying on older resource naming. A Group DM is instead represented as an MPIM and is conceptually different from a private channel. A direct message is a one-to-one conversation, while a User Group is an administrative grouping of workspace members used for functions such as mentions and organizational categorization. Therefore, D correctly translates the legacy term in the context of Slack API objects. This question maps to Apps in the Slack Platform, particularly the modern Conversations API object model and interpretation of legacy Slack documentation.

Message shortcuts are Slack app shortcuts specifically associated with an existing message. Slack distinguishes them from global shortcuts: global shortcuts can be initiated independently of message or channel context, whereas message shortcuts appear in an individual message's context menu and provide the app with information about that message. This makes message shortcuts particularly appropriate for operations such as creating a task from a message, escalating content, saving information to an external system, or launching a modal pre-populated with message context. Invoking the shortcut generates an interaction payload that the application processes. Message shortcuts are not keyboard-navigation commands, recurring-message schedulers, or administrator-only operations. Their distinguishing characteristic is that they provide an application action tied directly to the message selected by the user. Therefore, A is correct.

Enterprise Grid is Slack's enterprise architecture for organizations that need centralized governance across multiple Slack workspaces. Workspaces can exist within one Enterprise organization while organization-level administrators manage identity, policies, applications, security, and other administrative functions across the broader environment. Slack's current Enterprise documentation continues to describe Enterprise Grid organizations as containing multiple workspaces, and migration tooling allows standalone workspaces to be incorporated into an Enterprise organization. Enterprise functionality also enables organization-level application installation, Admin APIs, centralized app-management policies, and other large-scale administrative capabilities. Enterprise Grid is therefore not a pricing utility, UI theme, or authentication token type. Among the available options, B correctly captures its architectural purpose as Slack's offering for large organizations operating multiple managed workspaces.