Pass the Salesforce Developer Slack-Dev-201 Questions and answers with ExamsMirror

Slack's OAuth 2.0 authorization-code flow issues a temporary authorization code after the installing user reviews and approves the permissions requested by the application. Slack redirects the user to the application's configured redirect URI with this temporary code. The application backend then sends the code to Slack's token-exchange endpoint together with the required application credentials. If the exchange succeeds, Slack returns the applicable access credentials, which can include bot or user tokens depending on the requested authorization. Slack explicitly summarizes the process as requesting scopes, receiving user approval, and exchanging a temporary authorization code for an access token. A workspace ID identifies the Slack workspace but is not exchanged for credentials. Application manifests describe configuration, and user passwords must never be collected as part of Slack OAuth. Therefore, B is correct.

Application governance in an Enterprise Slack organization is performed through administrative roles rather than ordinary channel members or application developers. Slack currently allows Org Owners, Org Admins, and appropriate administrative roles to view and manage applications at the organization level. Organization administrators can approve or restrict applications and establish policies that affect workspaces throughout the organization. At the workspace level, Workspace Owners and designated app managers can review requests and manage applications within the authority allowed by organization-wide policies. Slack support does not perform routine customer app approvals, and the original application developer does not control whether another organization's administrators permit installation. Although current Slack role models are more granular than the wording of the question, option B correctly represents the responsible administrative groups.

Slack applications declare their requested OAuth permissions through application configuration. These permissions can be configured in the app settings under OAuth & Permissions or represented declaratively in an app manifest. Within a manifest, scopes reside under `oauth_config.scopes`, with separate fields for bot and user scopes. Slack's current platform also supports optional scopes through `bot_optional` and `user_optional`. The scopes determine what actions and data the application's tokens may access after authorization. Browser cookies do not define Slack app permissions, and the Slack CLI's local configuration is not the authoritative location for declaring the application's OAuth scope requirements. Scopes absolutely can—and normally should—be determined before installation so users and administrators can review the requested permissions during OAuth authorization. Therefore, A is correct.

Slack uses OAuth scopes to define and grant specific permissions to applications. Each scope authorizes access to a defined category of data or actions—for example, reading particular conversation information, viewing user information, or posting messages. Slack applications have no general API access by default; their effective privileges are determined by the scopes associated with their access tokens. Bot scopes grant permissions to the application's bot identity, while user scopes allow appropriately authorized actions on behalf of a user. Although application manifests can declare the scopes an application requests, the manifest itself is not the authorization mechanism. IP allowlisting can supplement token security but does not grant Slack API permissions, and workspace passwords are unrelated to application authorization. Therefore, OAuth scopes are the correct mechanism, making B the verified answer.

The Events API enables Slack applications to react to activities occurring within Slack. An application subscribes to specific event types, and Slack delivers corresponding event payloads when those activities occur. Examples include messages being posted, reactions being added, members joining channels, files being created, and application mentions. The events available to an application are constrained by its OAuth scopes and the conversations or resources it is authorized to access. Slack can deliver Events API payloads through a public HTTP Request URL or through Socket Mode. After receiving an event, the application typically acknowledges delivery and asynchronously performs any associated business logic, such as calling `chat.postMessage`. The Events API does not manage billing, construct Block Kit layouts, or configure OAuth permissions. Therefore, B correctly describes its primary function.

When a Bolt project is being developed locally through the current Slack CLI, `slack run` can watch application files and automatically restart the local application development server when supported source files change. Slack documents this behavior for Bolt for Python and Bolt for JavaScript projects. Python projects normally watch `.py` files, while JavaScript projects watch `.js` files unless the developer customizes the watch configuration. This live-reload capability shortens the development cycle because developers can modify application logic and have the running process restarted without manually stopping and relaunching it after every edit. The Slack workspace itself is not restarted, the user's browser is unaffected, and OAuth tokens are not regenerated merely because source code changes. Therefore, B is correct.

Block Kit Builder is Slack's visual prototyping environment for designing and previewing Block Kit layouts. It allows users to add, rearrange, and configure blocks while simultaneously reviewing the associated JSON representation and seeing how the completed layout will render. For the HR newsletter use case, the team can therefore construct and visually review a formatted message before the application or automation sends it to the required regional channel. Slack describes Block Kit Builder as a tool for choosing, configuring, arranging, and previewing blocks across Slack surfaces. Option A overstates its function: Block Kit Builder is not fundamentally a template-management repository for organizing recurring newsletters. Option C is also too broad. The builder can expose example interaction payloads and validate message composition, but it does not execute an application's complete backend interactivity workflow end-to-end. Option D is unsupported; it does not automatically convert arbitrary word-processing documents into production-ready Block Kit structures. Therefore, B accurately describes its intended role: prepare and preview the Slack UI/message composition before deployment. This belongs to Tools, specifically Block Kit Builder and visual prototyping of Slack application surfaces.

admin.conversations.rename belongs to Slack's Admin API and is available for Enterprise organizations. Current Slack documentation requires a user token containing the appropriate administrative scope—in this case admin.conversations:write. The application must be installed at the Enterprise-organization level rather than merely in one individual workspace. An Org Admin is therefore the appropriate role among the listed choices. Slack currently allows an Enterprise Org Admin or Org Owner, subject to applicable Channel Management permissions, to install an app requesting relevant Admin API scopes. Because Org Owner is not presented as an option, B is the correct selection. A Workspace Admin's authority ordinarily applies to a specific workspace and does not provide organization-level authorization for Admin API operations that span an Enterprise organization. Compliance Admin and Audit Log-related roles address different governance or monitoring responsibilities and do not provide the channel-management authorization required here. Current Slack documentation additionally emphasizes that the installing Org Admin or Owner must possess the applicable Channel Management permissions, including access to the relevant public/private channel types. This maps directly to APIs for Managing Your Slack, particularly Admin APIs, Enterprise-level OAuth installation, administrative scopes, and organization-wide channel management.

Slack app-level tokens use the `xapp-` prefix. Unlike bot tokens, app-level tokens represent an application independently of an individual bot installation and are limited to specific application-level API capabilities. Socket Mode is a major use case. To establish Socket Mode, Slack requires an app-level token with the `connections:write` scope. That credential is supplied to `apps.connections.open`, which generates the temporary WebSocket URL through which Slack delivers Events API and interactive payloads. Slack's Socket Mode documentation also demonstrates storing this credential as `SLACK_APP_TOKEN` with a value beginning `xapp-`. By contrast, `xoxb-` identifies bot tokens and `xoxp-` identifies user tokens. `bearer-` is not a Slack token-prefix classification. Therefore, B is the verified answer.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.