Slack-Dev-201 Salesforce Certified Slack Developer Free Practice Exam Questions (2026 Updated)

The Audit Logs API is designed to provide security and administrative visibility into activities occurring across an Enterprise organization. Option B contains two valid examples of such activity: file downloads and changes involving Slack applications. Slack's Audit Logs API includes audit actions such as file_downloaded, allowing security teams or SIEM platforms to investigate potentially suspicious download behavior. It also records application lifecycle and authorization activity. Supported actions include app_installed and app_scopes_expanded, the latter indicating that an application has been granted additional OAuth access. The API is primarily read-only monitoring infrastructure. It retrieves audit events and supports filtering by properties such as action, actor, entity, and time range. Therefore, option D is incorrect because the API itself does not control whether applications are approved; administrative APIs and workspace/org controls perform those actions. The Audit Logs API is also not a general message-content surveillance API for detecting arbitrary keywords, making C incorrect. Subscription billing and plan-user accounting are likewise outside its intended purpose. This aligns directly with APIs for Managing Your Slack, specifically Enterprise security monitoring and administrative event visibility through the Audit Logs API.

Slack applies OAuth authorization at the API-method level. If an access token does not contain the scope required by the requested Web API operation, Slack rejects the call rather than silently granting additional privileges or returning unauthorized data. A common response is the `missing_scope` error, which indicates that the token lacks the specific scope permissions necessary to complete the operation. Slack's permissions model therefore enforces least privilege: an application's token can perform only the actions authorized through its granted scopes. Adding a scope to app configuration does not automatically upgrade an already issued token; existing installations may need reauthorization when new required scopes are introduced. Slack also does not normally email an administrator merely because an API request lacks a scope. Therefore, B accurately represents Slack's authorization behavior.

Slack modals support a view stack containing up to three views, while only one view is displayed to the user at any particular moment. Applications can push new views onto the stack, update existing views, and allow users to return to prior views with their state preserved. This makes D correct and directly makes C incorrect. The App Home Home tab is also an application-controlled surface. An app composes its Home view using Block Kit and publishes that view with views.publish. The application can subsequently republish the Home view as application data changes, enabling personalized dashboards, summaries, settings, workflow entry points, and other persistent experiences. Therefore, E is correct and A is false. Block Kit applies to both modals and Home tabs, so B is incorrect. The distinction between these surfaces is architectural: a modal is focused and transient, suited to completing a defined task, whereas App Home is persistent and suited to information users revisit. This question therefore maps to Design the Interactive Flow of Your App, particularly Slack surfaces, modal view-stack behavior, Block Kit composition, and dynamic Home-tab publishing.

Public channels are the only conversation type among these choices for which Slack provides an explicit permission enabling an app to post without first becoming a member. The relevant permission is the chat:write.public scope, used together with chat:write. Slack describes chat:write.public as permitting a Slack app to send messages to public channels in which the application is not a member. Without that additional scope, an app normally must join the public channel or be invited before posting. Private channels require appropriate membership and authorization because allowing an app to post into a private conversation without membership would violate Slack's privacy model. Likewise, ordinary direct messages and multi-person direct messages have different membership and conversation-opening semantics and are not equivalent to posting freely into a public channel. The wording “by default” in the source is somewhat imprecise because granular-permission Slack apps do not automatically receive access to all public channels. They must request chat:write.public. Nevertheless, among the four conversation types, D represents the intended and technically supported capability. This question aligns with Design Your Workflows: Spotlight on Slack's APIs, particularly chat.postMessage, conversation membership, and OAuth scope behavior.

A private channel is represented through Slack's unified conversation-object model. Slack's Conversations API consolidates several historically separate object categories into the conversation abstraction. Depending on its properties, a conversation object can represent a public channel, private channel, direct message, multi-person direct message, and other conversation-oriented constructs. For a private channel, the conversation object exposes properties such as is_private. Slack's modern APIs therefore avoid requiring developers to treat every channel type through entirely separate legacy APIs. Older terminology such as group survives in some legacy documentation and fields, but private channels are now handled through the Conversations API. A public message is not itself a conversation; it is content contained inside a conversation. A message reaction is metadata or an event associated with a message. A file attachment similarly represents content attached to or referenced from a message rather than a conversation container. The distinction matters when using methods such as conversations.info, conversations.list, conversations.history, and other Conversations API operations because the same core object model can represent multiple Slack conversation types. This maps to Apps in the Slack Platform, specifically understanding Slack's object model and the unified Conversations API.

Application governance in an Enterprise Slack organization is performed through administrative roles rather than ordinary channel members or application developers. Slack currently allows Org Owners, Org Admins, and appropriate administrative roles to view and manage applications at the organization level. Organization administrators can approve or restrict applications and establish policies that affect workspaces throughout the organization. At the workspace level, Workspace Owners and designated app managers can review requests and manage applications within the authority allowed by organization-wide policies. Slack support does not perform routine customer app approvals, and the original application developer does not control whether another organization's administrators permit installation. Although current Slack role models are more granular than the wording of the question, option B correctly represents the responsible administrative groups.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Message shortcuts are Slack app shortcuts specifically associated with an existing message. Slack distinguishes them from global shortcuts: global shortcuts can be initiated independently of message or channel context, whereas message shortcuts appear in an individual message's context menu and provide the app with information about that message. This makes message shortcuts particularly appropriate for operations such as creating a task from a message, escalating content, saving information to an external system, or launching a modal pre-populated with message context. Invoking the shortcut generates an interaction payload that the application processes. Message shortcuts are not keyboard-navigation commands, recurring-message schedulers, or administrator-only operations. Their distinguishing characteristic is that they provide an application action tied directly to the message selected by the user. Therefore, A is correct.

Slack locale information is explicitly opt-in at the API-request level. For a conversation, an application can call conversations.info and set include_locale=true. For an individual member, it can call users.info with the same parameter. Slack then includes the applicable locale field in the returned object. The locale is represented using an IETF language identifier such as en-US or another supported language-region combination. Slack's design guidance recommends using a conversation's locale for content published publicly within that conversation and using the individual user's locale for private or personalized interactions. Option C is incorrect because locale is not included automatically by default. The application must explicitly request it. Option A incorrectly treats locale retrieval as an app-dashboard configuration toggle rather than a Web API argument. Option D refers to API methods that do not exist; Slack uses established methods such as users.info and conversations.info. Applications should also retrieve current locale information when preparing content rather than permanently assuming a user's language preference, because those preferences may change. This directly aligns with Design a Great User Experience, particularly internationalization and localization of Slack application content.

Slack Web API responses conventionally include a top-level Boolean `ok` property indicating whether the requested operation succeeded. A normal successful response contains `"ok": true` together with any method-specific data, such as a user object, channel information, timestamps, or other returned values. When an API operation fails, Slack generally returns `"ok": false` together with an `error` field identifying the failure condition. Slack explicitly advises callers to evaluate the `ok` value rather than assuming that a syntactically valid response represents success. For example, the official `users.info` method documentation shows a successful response containing `"ok": true` and an unsuccessful response containing `"ok": false`. Slack Web API operations do not normally return CSV files, redirects, or HTML documents as their standard JSON success response. Therefore, A is correct.

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.

Socket Mode allows a Slack application to receive Events API and interactive payloads through a WebSocket connection rather than exposing a publicly accessible HTTP Request URL. The application establishes an outbound connection to Slack, making Socket Mode particularly useful during local development, behind corporate firewalls, or in environments where inbound public HTTP traffic cannot be accepted. Slack dynamically creates the WebSocket URL through `apps.connections.open`; the URL is not a permanent endpoint. Socket Mode does not remove OAuth requirements, eliminate Block Kit, or eliminate application installation. Bot and user functionality still depends on the application's authorization model and appropriate scopes. Socket Mode simply changes how Slack delivers events and interactive payloads to the application. Therefore, B precisely identifies the architectural advantage tested by the question.

The Discovery API is specifically designed for Enterprise security, compliance, archiving, and eDiscovery use cases involving extraction of Slack content into approved third-party systems. Slack explicitly describes eDiscovery applications as pulling messages and files from Slack and storing the information in third-party data warehouses, where that content can subsequently be searched, archived, or retrieved. The Discovery API can provide organization-level message and file information, including historical content that remains available under applicable retention and legal-hold policies. Its use is restricted to approved security and compliance scenarios such as eDiscovery, archiving, and Data Loss Prevention. The Audit Logs API provides administrative and security event records rather than the actual body of message and file content needed for an external archive. Admin APIs manage Enterprise configuration and administrative resources. Legal Holds preserve relevant Slack data from deletion or retention-policy expiration but are not themselves the general extraction mechanism described in the scenario. Therefore, D directly matches the legal department's requirement to transfer Slack content into a third-party data warehouse. This question belongs to APIs for Managing Your Slack, specifically Enterprise content governance, eDiscovery, archiving, and Discovery API use cases.

Slack app manifests are officially expressed in JSON or YAML. Both formats represent the same structured application configuration and can define metadata, application features, OAuth configuration, event subscriptions, interactivity settings, and other supported manifest properties. Slack's manifest documentation explicitly states that manifests are reusable configurations expressed in JSON or YAML and can be authored through an application's configuration page. Slack's Deno SDK also supports defining compatible manifest information programmatically in TypeScript, but among the supplied answers, JSON or YAML is unequivocally correct for standard app manifests. XML, INI, and Markdown are not the documented manifest serialization formats. Using JSON or YAML also makes manifests practical for source-control workflows, code review, automated deployment, and reuse across related application configurations. Therefore, A is the verified answer.

Slack apps can extend Workflow Builder by defining custom workflow steps. Slack describes workflow steps as functions added to an application that can subsequently be selected as steps by users creating workflows in Workflow Builder. Custom steps may be implemented through supported frameworks such as Bolt for Python, Bolt for JavaScript, Bolt for Java, or through Slack's Deno SDK. For Bolt applications, a custom step is defined and paired with a function listener that processes the corresponding execution request. This architecture allows organizations to expose specialized business logic—such as interacting with internal systems—as reusable automation components without requiring workflow creators to write code themselves. Workflow Builder is therefore not restricted to Slack's built-in actions, and using the Web API alone is not the only extension mechanism. Consequently, B accurately describes Slack's supported custom-step capability.

Under the current Block Kit specification, C is the technically valid answer, correcting the supplied key of A. A section block supports an accessory field containing one compatible Block Kit element. That accessory can be an overflow-menu element, and the overflow menu itself can contain multiple selectable options. Consequently, a section block containing an overflow menu can validly offer the user several choices while preserving a compact layout. Option A is structurally invalid as written because the accessory field is a single object, not an array of multiple button elements. When several independent buttons need to appear together, Slack's proper construct is an actions block, whose elements array can contain multiple buttons and other interactive elements. However, B incorrectly describes the actions block as a mechanism for displaying contextual images and text; its purpose is to hold interactive controls. A file block is unrelated to presenting user choices and D also incorrectly associates it with this decision-oriented use case. Therefore, based on current official Slack Block Kit definitions, C replaces the document's marked A answer. This belongs to Design the Interactive Flow of Your App, specifically selecting appropriate blocks and interactive elements.

conversations.history is Slack's current unified Web API method for retrieving message history from conversations. With the relevant OAuth scopes, a bot token can retrieve message history from conversations in which the bot is a member. Public-channel history requires channels:history, while private-channel history requires groups:history. Therefore, the app must be present in the applicable channels and possess the corresponding history scopes. Option C relies on legacy methods. Slack consolidated historically separate channel APIs into the Conversations API, making conversations.history the supported method for both public and private conversation history. The Events API can deliver newly occurring message events, but it does not independently provide the historical messages already stored in the conversation. Therefore, A does not meet the requirement to read both existing and subsequent message history. The Discovery API is a specialized Enterprise security and compliance capability and is inappropriate for an ordinary internal application. The source question and marked answer are therefore consistent with current Slack behavior. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly conversation membership, history scopes, and the unified Conversations API.