Slack-Dev-201 Exam Dumps - Salesforce Developer Questions and Answers

The required inputs map directly to three Block Kit element types. First, a datetime picker allows a user to select both a date and a time and therefore provides substantially more suitable information for an absence period than a time-only picker. Slack defines the datetimepicker element specifically for selecting a date and a time of day. Second, descriptive information is unstructured text, making a plain-text input the appropriate component. Plain-text input elements can collect single-line or multiline free-form information inside an input block. Third, the manager should be represented as a Slack user identity rather than an arbitrary number. Slack provides the users_select element, which automatically populates the selectable options using users visible in the current workspace. The resulting value is a Slack user ID, providing a stable identifier suitable for subsequent API calls and workflow processing. Options A and D incorrectly use a number input for the manager. Option C uses the correct user selector but supplies only a time picker, which cannot capture the required calendar component. This directly tests Design the Interactive Flow of Your App, specifically constructing modal interfaces using appropriate Block Kit elements.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

In Bolt for Python, `@app.message(...)` registers a listener for messages matching specified text or a regular-expression pattern. For example, `@app.message("hello")` can invoke a listener when an incoming message contains the expected text. Bolt handles the event routing and supplies useful listener arguments such as the message payload, `say`, `client`, and other context values. By contrast, `@app.event` is used to subscribe a listener to a specific Slack event type rather than to filter messages by text. `@app.listen` and `@app.on_message` are not the standard Bolt for Python decorators documented for this use case. Therefore, B is correct: `@app.message` is the framework feature specifically intended for listening to message content that matches a configured string or pattern.

A Slack modal is a temporary focused interface displayed over the current Slack experience. Slack describes modals as alert boxes, pop-ups, or dialog boxes that capture and maintain user focus until the modal is submitted or dismissed. Applications commonly use modals for structured forms, configuration tasks, data entry, confirmation flows, and detailed information that would otherwise clutter a message or Home tab. Modal views are built using Block Kit and can contain input elements, select menus, buttons, text, and other supported components. Applications normally open them through `views.open` using a recently generated `trigger_id`. Channels and workspaces are persistent Slack organizational structures, while workflow triggers begin automations rather than rendering focused pop-up interfaces. Therefore, A is correct.

users.info provides the information required for both localization dimensions. Slack's user object contains timezone properties including tz, tz_label, and tz_offset. These values allow an application to schedule or render time-sensitive functionality according to the user's configured timezone rather than assuming the server's timezone or attempting to derive timezone information from HTTP headers. For language localization, users.info supports the include_locale=true parameter. When requested, Slack can include the user's locale, represented by an IETF language code. The app can then select translated strings and culturally appropriate presentation based on that locale. users.profile.get is intended for retrieving profile information and custom profile fields; it is not the preferred mechanism described by Slack for this combined localization requirement. HTTP request headers are also inappropriate for determining the Slack user's configured timezone because they represent network/request metadata rather than the user's Slack preference. Accordingly, D combines the appropriate API method with the two relevant user attributes. In implementation, the developer must remember to request locale explicitly using include_locale=true. This aligns with Design a Great User Experience, especially internationalization, localization, time-zone awareness, and tailoring application behavior to the individual Slack user.

Option B provides the strongest Slack-platform architecture because the process requires individualized status tracking, integration with an external system of record, recurring reminders, and escalation when employees remain noncompliant. Slack apps are specifically intended to automate tasks and connect Slack with external business systems. The application can determine each employee's compliance state externally and send targeted Slack notifications only where action is required. A quarterly announcement workflow is insufficient because it treats every employee identically and cannot distinguish completed from outstanding obligations. It also lacks an escalation mechanism. Option C unnecessarily places compliance training and acceptance inside Slack even though the scenario identifies an external system of record. That creates duplicated state and introduces additional governance concerns around which system represents the authoritative acceptance record. Slack's application-design guidance also cautions against noisy broad notifications. Targeted communication is preferable where a service concerns an individual user, and manager escalation can be generated only for unresolved cases. This maps to Apps in the Slack Platform, particularly recommending how Slack applications can automate organizational operations and integrate existing business processes with external systems.

Slack bot tokens use the `xoxb-` prefix. These tokens represent the application's bot identity within an installed Slack workspace and carry the granular bot OAuth scopes granted during installation. Slack's official token documentation explicitly states that bot token strings begin with `xoxb-`. Developers must treat these values as secrets because possession of a valid token can permit API operations authorized by its associated scopes. Credentials should therefore be stored in a secure secrets-management system or protected environment rather than embedded in source code or exposed in logs. The `xapp-` prefix belongs to app-level tokens, which are used for application-level functionality such as Socket Mode. The remaining prefixes do not represent the standard Slack bot token type described by this question. Therefore, option A is correct.

Under the current Block Kit specification, C is the technically valid answer, correcting the supplied key of A. A section block supports an accessory field containing one compatible Block Kit element. That accessory can be an overflow-menu element, and the overflow menu itself can contain multiple selectable options. Consequently, a section block containing an overflow menu can validly offer the user several choices while preserving a compact layout. Option A is structurally invalid as written because the accessory field is a single object, not an array of multiple button elements. When several independent buttons need to appear together, Slack's proper construct is an actions block, whose elements array can contain multiple buttons and other interactive elements. However, B incorrectly describes the actions block as a mechanism for displaying contextual images and text; its purpose is to hold interactive controls. A file block is unrelated to presenting user choices and D also incorrectly associates it with this decision-oriented use case. Therefore, based on current official Slack Block Kit definitions, C replaces the document's marked A answer. This belongs to Design the Interactive Flow of Your App, specifically selecting appropriate blocks and interactive elements.

 member_joined_channel (often referred to as member_joined in event grouping contexts): This event is triggered when a standard user joins a public or private channel. Subscribing to this allows your bot to see whenever someone joins #it-help and instantly send them the welcome overview and resources guide.

 channel_joined: This event is specifically sent to your application when the bot user itself is added to a channel. Subscribing to this ensures your bot knows it has been successfully added to #it-help so it can begin its duties or send an initial greeting.

 app_mention: This event explicitly handles instances where users mention the bot (e.g., @ITHelpBot how do I connect to the VPN?). Subscribing to this lets the bot listen for and respond to specific user queries without needing access to read every single regular message in the channel.

Installing an organization-ready Slack application at the Enterprise organization level does not automatically add the application to every workspace in that organization. Slack explicitly separates organization-level installation from workspace access. After installation at the organization level, an Org Admin must grant the application access to one or more individual workspaces—or all workspaces—before members in those workspaces can actually use it. This architecture allows centralized authorization and token management while retaining administrative control over where the application is available. Option B is therefore incorrect because organization-level installation alone does not make the application immediately operational in every workspace. Option C incorrectly describes the requirement as installation “to a channel.” Applications are granted to workspaces; channel membership may subsequently matter for specific APIs or event subscriptions, but that is a separate issue. Application collaborators manage application configuration and development access and are not required merely to activate an organization-installed application. Slack identifies simplified token storage and centralized policy as major advantages of organization-ready installation while retaining workspace-level access control. This aligns directly with Design for Scale, especially Enterprise organization deployment and organization-ready applications.