Pass the Salesforce Developer Slack-Dev-201 Questions and answers with ExamsMirror

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

Among the supplied options, B is the intended answer because Slack's Web API is HTTP-based and Web API responses are JSON objects. Successful and failed responses contain a top-level Boolean `ok` property, together with method-specific fields or an `error` value. Many write methods also accept `application/json` request bodies. However, one technical correction is important: current Slack documentation explicitly states that the Web API is not a REST API. Slack describes it more precisely as a collection of HTTP RPC-style methods with endpoints such as `https://slack.com/api/METHOD_FAMILY.method`. Therefore, “REST with JSON” is not perfectly worded, but it is still the only defensible choice among A–D because SOAP/XML, GraphQL, and gRPC are incorrect. For current Slack terminology, “HTTP RPC-style methods with JSON responses” would be more precise.

C corrects the supplied document's marked answer of A. The customers described are separate businesses rather than multiple workspaces belonging to one Enterprise organization. Consequently, Enterprise organization distribution is not the correct model. Organization-ready apps are installed at the level of a single Enterprise organization and then granted access to selected workspaces belonging to that organization. They are not a distribution mechanism for unrelated customer organizations. Slack's current application-lifecycle guidance describes unlisted distributed apps—historically described as publicly distributed apps—as the correct architecture when an application needs to be installed in other customer workspaces without being publicly discoverable in the Slack Marketplace. After configuring OAuth and enabling distribution, the developer can provide the installation link specifically to selected customers. A single-workspace app cannot be installed in customers' independent workspaces. Marketplace distribution would maximize discoverability rather than keep installation restricted to the agency's customers. Therefore, the appropriate option from the supplied choices is C. Public app distribution, more precisely called unlisted distribution in current Slack documentation. This belongs to Distribute Your App, covering undistributed, unlisted distributed, Marketplace, and Enterprise organization distribution models.

A Slack application distributed across multiple independent workspaces must implement an OAuth installation flow. Slack explicitly states that enabling installation on other workspaces allows the application to generate access tokens for each workspace and applicable user authorization. Bolt's current OAuth documentation likewise explains that each app installation issues unique access tokens and installation information that the application must store securely and retrieve when processing requests. This is fundamentally different from a single-workspace application, which can receive one access token through direct installation without implementing the full distributed OAuth flow. Independent workspaces do not normally share one universal token. Organization-wide Enterprise installations are a distinct model and can use an organization-level authorization, but that does not invalidate the standard multi-workspace distribution behavior tested here. Therefore, A is correct.

Slack's documented macOS and Linux installation method uses the official shell installer hosted on Slack's downloads domain. The command `curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bash` retrieves the installer securely and runs it through Bash, installing the Slack CLI and making the `slack` command available for development. Slack's current CLI installation documentation presents this command as the supported installation path for macOS and Linux. The alternatives do not represent the official installation command in the Slack Developer documentation: Slack CLI is not installed through the listed npm or pip commands, and `brew install slack` does not correspond to Slack's documented CLI installer. Therefore, option B is the verified installation command for the environments named in the question.

Adding additional app collaborators is the appropriate lifecycle-management practice because application administration should not depend exclusively on one individual's Slack account. Slack provides collaborator management specifically so multiple authorized developers or maintainers can manage an application. Current Slack tooling supports adding, listing, and removing collaborators, and Slack's application lifecycle documentation recognizes creator/collaborator status when determining application continuity in certain installation circumstances. There is an important modern-platform nuance. With granular-permission Slack apps, deactivation of an installing user does not necessarily invalidate a bot installation in the same way older Slack application models did. Nevertheless, relying on a single owner still creates an administrative single point of failure. Adding collaborators preserves access to configuration and maintenance functions when the original developer leaves or becomes deactivated. Source-code version control is essential engineering practice but does not itself transfer Slack application ownership or management rights. Storing tokens securely is a security requirement, not an ownership-continuity mechanism. Visiting App Home has no effect on app administrative ownership. This therefore remains A and aligns directly with Apps in the Slack Platform, whose certification objective includes identifying when a team should be established to collaborate on a Slack application.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

Socket Mode enables a Slack application to receive Events API payloads and interactive events over a WebSocket connection instead of exposing a publicly accessible HTTP Request URL. Slack's current documentation explicitly states that the WebSocket URL is not static. The application obtains the URL at runtime by invoking apps.connections.open, and Slack refreshes that URL periodically. This architecture is particularly useful for applications operating behind corporate firewalls, during local development, or in environments where exposing an inbound public HTTP endpoint is undesirable. Therefore, B precisely matches Slack's documented description: the application listens through a non-static WebSocket URL dynamically created while the application is running. There is, however, a defect in the supplied question: C is semantically equivalent to B. Slack itself uses the wording “created at runtime,” so C also describes the underlying behavior accurately. Because this is marked as a single-choice question, B should be retained as the intended exam answer, but the alternatives are not sufficiently differentiated to make B uniquely true. This belongs to Tools, particularly Socket Mode, WebSockets, apps.connections.open, and alternative event-delivery architecture.

Message shortcuts operate in the contextual action menu of an existing Slack message. Slack's official shortcut documentation specifies that message shortcuts appear in the context menus of non-ephemeral messages. Therefore, an ephemeral message cannot serve as the source message for a message shortcut, making B correct. This restriction follows from the underlying interaction model. Message shortcuts preserve context from the source message so an application can perform an action based on that message—for example, creating a ticket, escalating an incident, or sending content to an external system. Ephemeral messages have restricted visibility and lifecycle behavior and are excluded from this shortcut surface. Option D is incorrect because every shortcut invocation must be acknowledged promptly, regardless of how many shortcuts the app defines. Current Slack UX guidance requires shortcut requests to be acknowledged with an HTTP 200 response within three seconds. Option C is not a general rule; follow-up notification mechanics depend on the interaction payload and workflow. A's fixed limit of three message shortcuts is not the applicable platform rule represented here. This belongs to Design the Interactive Flow of Your App, particularly message shortcuts and contextual interactions.