Slack-Dev-201 Salesforce Certified Slack Developer Question and Answers

Workflow Builder is Slack's no-code environment for creating automated workflows directly within Slack. Authorized users can combine triggers, built-in actions, connector actions, forms, conditional logic, and other workflow steps to automate repeatable business processes without implementing a complete custom application. Slack describes Workflow Builder as a no-code way to build workflows in which users combine supported steps and triggers to create automations. Developers can extend these workflows by supplying custom workflow steps when business logic exceeds the built-in capabilities. Workflow Builder is not primarily an app-manifest editor, a Bolt compilation environment, or an OAuth-token management interface. Those responsibilities belong to Slack app configuration, development tooling, and authentication mechanisms respectively. Consequently, B accurately captures the principal role of Workflow Builder within Slack's automation architecture.

Slack's response_url provides a temporary callback mechanism that lets an application send additional responses after receiving a slash command or supported interactive-action payload. Current Slack documentation specifies that the URL can be used up to five times within 30 minutes after the application receives the original payload. That makes B the precise platform restriction. A response_url does not require the app to attach a bot or user OAuth token. Slack treats the URL itself as an authorized response pathway associated with the originating interaction. It can therefore bypass ordinary channel posting permissions for that response context. Option C is incorrect because global shortcuts do not inherently provide a response_url; their primary payload contains a trigger_id, which can be used to open a modal. Option A is also incorrect because interaction responses can modify or replace originating messages where the interaction type supports such behavior. If an app needs to communicate after the 30-minute response window or after exhausting the permitted responses, it should use standard messaging APIs such as chat.postMessage. This maps directly to Design the Interactive Flow of Your App, particularly slash commands, interaction acknowledgments, and asynchronous responses.

The Discovery API is specifically designed for Enterprise security, compliance, archiving, and eDiscovery use cases involving extraction of Slack content into approved third-party systems. Slack explicitly describes eDiscovery applications as pulling messages and files from Slack and storing the information in third-party data warehouses, where that content can subsequently be searched, archived, or retrieved. The Discovery API can provide organization-level message and file information, including historical content that remains available under applicable retention and legal-hold policies. Its use is restricted to approved security and compliance scenarios such as eDiscovery, archiving, and Data Loss Prevention. The Audit Logs API provides administrative and security event records rather than the actual body of message and file content needed for an external archive. Admin APIs manage Enterprise configuration and administrative resources. Legal Holds preserve relevant Slack data from deletion or retention-policy expiration but are not themselves the general extraction mechanism described in the scenario. Therefore, D directly matches the legal department's requirement to transfer Slack content into a third-party data warehouse. This question belongs to APIs for Managing Your Slack, specifically Enterprise content governance, eDiscovery, archiving, and Discovery API use cases.

`api.slack.com/apps` is Slack's web-based application dashboard for viewing and managing registered Slack applications. After signing in, developers can select an app and configure application features, OAuth permissions, event subscriptions, interactivity, distribution, collaborators, credentials, manifests, and related settings. The page remains active and presents the developer's “Your Apps” interface. `slack.com/billing` is associated with account and subscription matters rather than application configuration. `docs.slack.dev/tools` provides developer documentation and does not function as the management dashboard, while `app.slack.com/downloads` is unrelated to app configuration. Although Slack has progressively moved developer documentation from the older API documentation structure to `docs.slack.dev`, the app-management dashboard at `api.slack.com/apps` remains the correct web interface identified by this question. Therefore, A is correct.

A and C are the two choices that best align with the current official Slack design guidance. Slack emphasizes concise, easily processed content. Applications should communicate clearly and minimize unnecessary cognitive load so users can understand information quickly rather than reading lengthy or overly complex interfaces. This supports the principle represented by option A. Slack's Block Kit design guidance also recommends simplifying suitable information with pictures. For example, faces may communicate user identity more efficiently than lists of names, and maps can sometimes communicate location more effectively than text. Images must still be accessible through appropriate alt_text; the recommendation is not to remove essential textual meaning indiscriminately. Option B is incorrect under current official guidance. Slack explicitly states that shortcut names should start with a verb, not a noun. Option D conflicts with Slack's recommendation to avoid excessive notifications, while option E is directly contrary to the guidance to reduce complexity by progressively revealing controls and information. The supplied document marks A and B, but B conflicts with Slack's published developer guidance and therefore should not be retained as the verified answer. This question belongs under Design a Great User Experience.

Among the supplied options, B is the intended answer because Slack's Web API is HTTP-based and Web API responses are JSON objects. Successful and failed responses contain a top-level Boolean `ok` property, together with method-specific fields or an `error` value. Many write methods also accept `application/json` request bodies. However, one technical correction is important: current Slack documentation explicitly states that the Web API is not a REST API. Slack describes it more precisely as a collection of HTTP RPC-style methods with endpoints such as `https://slack.com/api/METHOD_FAMILY.method`. Therefore, “REST with JSON” is not perfectly worded, but it is still the only defensible choice among A–D because SOAP/XML, GraphQL, and gRPC are incorrect. For current Slack terminology, “HTTP RPC-style methods with JSON responses” would be more precise.

Slack requires applications to verify inbound HTTP requests by using the application's signing secret. Slack generates an X-Slack-Signature header for signed requests. The application reconstructs the signature locally from the request timestamp and raw request body using HMAC-SHA256 together with its signing secret, then compares the calculated signature with the signature Slack supplied. This mechanism provides cryptographic integrity and origin verification. If an attacker alters the payload in transit, the locally calculated signature no longer matches Slack's signature. Implementations should also validate the X-Slack-Request-Timestamp and reject sufficiently old requests to reduce replay-attack risk. IP-address validation is not the recommended authentication mechanism because infrastructure addresses can change and network origin alone does not cryptographically establish message integrity. The Audit Logs API serves Enterprise monitoring and investigation rather than inbound-request authentication. Restricting server access is useful operational security but does not prove that an individual request came unmodified from Slack. Therefore, D directly implements Slack's prescribed request-verification architecture. This belongs to Design for Security, covering signing secrets, request integrity, authentication of Slack-originated traffic, and replay protection.

Slack supports unlisted distributed applications specifically for scenarios such as pilots, early customer testing, and beta validation before a Marketplace submission. To install an application outside its original workspace, the developer must configure the required OAuth flow and enable distribution through the application's Manage Distribution settings. After activating public distribution, Slack provides a Shareable URL that initiates the app's installation process. The developer can send this URL directly to beta testers at other organizations. Those users can install and test the application subject to their own workspace's app-management policies. Once testing is complete and the application meets Slack's quality, functionality, privacy, security, and distribution requirements, it can be submitted for Slack Marketplace review. A Marketplace listing is not available as a substitute for pre-review beta distribution. Creating cloned versions for every customer is unnecessary and creates configuration-management problems. Inviting external beta testers into the developer's own workspace would also fail to test the critical multi-workspace OAuth and installation behavior. Current Slack documentation explicitly identifies unlisted distribution as appropriate for early-customer pilots before broader Marketplace publication. This belongs to Distribute Your App, covering public distribution, OAuth installations, beta testing, Shareable URLs, and Marketplace submission.

Bolt provides a higher-level application framework that uses Slack's language SDKs underneath. Slack's platform overview explains that the Bolt frameworks for Python, JavaScript, and Java use the corresponding Slack SDKs to handle lower-level development details. The SDK layer exposes primitives such as Web API clients, authentication, HTTP requests, and API method implementations, while Bolt adds listener registration, middleware, context injection, interaction acknowledgment, event routing, and other application-development conveniences. This architecture allows developers to build Slack applications without repeatedly implementing platform plumbing themselves. Bolt and the SDKs therefore are not unrelated, nor do the SDKs automatically replace Bolt. Conversely, Bolt depends on the capabilities supplied by its underlying language ecosystem rather than functioning independently of them. Option B most accurately describes the documented architectural relationship between these components.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

Slack's OAuth 2.0 authorization-code flow issues a temporary authorization code after the installing user reviews and approves the permissions requested by the application. Slack redirects the user to the application's configured redirect URI with this temporary code. The application backend then sends the code to Slack's token-exchange endpoint together with the required application credentials. If the exchange succeeds, Slack returns the applicable access credentials, which can include bot or user tokens depending on the requested authorization. Slack explicitly summarizes the process as requesting scopes, receiving user approval, and exchanging a temporary authorization code for an access token. A workspace ID identifies the Slack workspace but is not exchanged for credentials. Application manifests describe configuration, and user passwords must never be collected as part of Slack OAuth. Therefore, B is correct.

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

Slack specifically recommends testing applications in an Enterprise organization sandbox because Enterprise environments introduce behaviors that cannot always be reproduced accurately in a standalone workspace. Slack's Developer Program provides fully featured Enterprise organization sandboxes specifically for development and testing. Applications must also account for workspace migration periods. During migration into an Enterprise organization, Web API and other platform interactions may temporarily become unavailable. Slack provides the grid_migration_started and grid_migration_finished Events API events so applications can detect this lifecycle transition. Official guidance recommends pausing relevant API/platform activity when migration begins and resuming it after migration finishes. Discarding an existing application is unnecessary because ordinary Slack applications can be adapted for Enterprise behavior. Polling channel IDs is not an appropriate migration strategy. Likewise, reinstalling applications solely to obtain new access tokens is not the fundamental requirement when a workspace becomes part of an Enterprise organization. The critical architectural principle is to test Enterprise-specific behavior and implement migration-aware event handling instead of assuming a standalone-workspace environment will remain stable throughout migration. This directly addresses Design for Scale, especially Enterprise organizations, migration resilience, and testing applications under Enterprise-specific conditions.

The immediate security priority after loss or theft of an authenticated device is to invalidate the compromised Slack sessions. Slack provides the Admin API method admin.users.session.reset specifically for this purpose. Current documentation states that the method wipes all valid Slack sessions on all devices for the specified user. This provides immediate containment by forcing the user to authenticate again rather than allowing a potentially unauthorized person holding the device to continue using an existing authenticated Slack session. The Audit Logs API can subsequently support investigation by identifying suspicious authentication or administrative activity, but merely monitoring events does not terminate the attacker's access. SCIM de-provisioning is too disruptive as the first response because the employee remains a legitimate member of the organization; the security problem is the compromised device/session rather than employment status. The Discovery API is intended for security/compliance integrations involving organizational content and is not the primary incident-containment mechanism. The applicable Admin API method requires the admin.users:write user-token scope and is available for Enterprise environments. Therefore, D provides the quickest and most proportionate first response. This belongs to APIs for Managing Your Slack, specifically Enterprise session administration and security incident response.

Option A is the correct answer from the supplied choices. Slack historically exposed its complete Web API method reference at `api.slack.com/methods`, and that address currently redirects to Slack's modern developer documentation under the Methods reference at `docs.slack.dev/reference/methods/`. The reference contains Slack's available method families, including `admin.*`, `apps.*`, `auth.*`, `chat.*`, `conversations.*`, `files.*`, `users.*`, `views.*`, and many others. Each individual method page identifies supported access mechanisms, OAuth scopes, parameters, response structures, errors, and rate-limit information. The pricing and legal pages are unrelated to API-method documentation, while `app.slack.com/methods` is not Slack's developer method reference. Therefore, A remains valid, although the current canonical documentation location is Slack Developer Docs.

The correct answer is B. read, post, client, search:read (or rather, let's look closely at legacy vs modern scopes; wait, read, post, client, search:read are listed in Slack docs as legacy/restricted scopes that are not allowed or accepted for new Marketplace submissions!). Let's re-read snippet 1.5.1 / 1.2.4: "do not include functionality in Slack. use legacy/restricted scopes or methods... (admin.*, identity.*, search:read, read, post, client...)". Wait, option B says read, post, client, search:read, but those are restricted/legacy. Let's check which set of scopes would be allowed . Wait, granular scopes like admin:post, admin:read, admin:search, client:connect? Wait, let's check if D uses granular scopes or if none are allowed or if D is the correct choice because options A, B, C contain legacy broad scopes (read, post, client, search:read, admin). Option D uses granular scopes (admin:post, admin:read, admin:search, client:connect).

Slack's app approval and app-management controls allow administrators to govern application installation and usage. Workspace Owners can enable app approval, pre-approve applications, restrict applications, and determine whether members can request unapproved apps. In Enterprise organizations, Org Owners can establish organization-level app-management policies that enable app approval across workspaces and control which applications may be installed or used. Enterprise administrative interfaces also support approving, restricting, installing, and distributing apps across selected workspaces. Block Kit Builder is a UI-design utility, Socket Mode is an event-delivery mechanism, and the Events API delivers Slack activity notifications; none of those features governs app installation policy. Therefore, option A is the correct administrative control for determining which applications users are allowed to install or request within managed Slack environments.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

When an application exceeds a Slack Web API rate limit, Slack returns an HTTP `429 Too Many Requests` response together with a `Retry-After` header. The header specifies how many seconds the application must wait before retrying that API method for the affected workspace. Applications should respect this value, pause the relevant request flow, and retry only after the specified interval. Retrying continuously in a tight loop would continue violating the rate limit and can worsen reliability. There is no reason to switch the operation to an unrelated workspace, and discarding an important request permanently is unnecessary when Slack has explicitly provided a retry interval. Production applications should combine `Retry-After` handling with queues, controlled retry logic, and appropriate concurrency management. Therefore, B represents Slack's documented and scalable rate-limit handling strategy.

admin.conversations.rename belongs to Slack's Admin API and is available for Enterprise organizations. Current Slack documentation requires a user token containing the appropriate administrative scope—in this case admin.conversations:write. The application must be installed at the Enterprise-organization level rather than merely in one individual workspace. An Org Admin is therefore the appropriate role among the listed choices. Slack currently allows an Enterprise Org Admin or Org Owner, subject to applicable Channel Management permissions, to install an app requesting relevant Admin API scopes. Because Org Owner is not presented as an option, B is the correct selection. A Workspace Admin's authority ordinarily applies to a specific workspace and does not provide organization-level authorization for Admin API operations that span an Enterprise organization. Compliance Admin and Audit Log-related roles address different governance or monitoring responsibilities and do not provide the channel-management authorization required here. Current Slack documentation additionally emphasizes that the installing Org Admin or Owner must possess the applicable Channel Management permissions, including access to the relevant public/private channel types. This maps directly to APIs for Managing Your Slack, particularly Admin APIs, Enterprise-level OAuth installation, administrative scopes, and organization-wide channel management.

GovSlack is a separate Slack environment specifically designed for U.S. public sector organizations and their security and compliance requirements. Slack states that GovSlack enables agencies, contractors, citizens, and partners to collaborate through an environment designed for stringent public-sector operational requirements. GovSlack operates separately from commercial Slack on the `slack-gov.com` domain, with data isolated from the commercial Slack environment. It runs in AWS GovCloud-certified infrastructure and supports compliance requirements including FedRAMP High. Developers making commercial Slack apps available in GovSlack must separately configure and deploy them for that environment and follow GovSlack-specific API, OAuth, credential, and Marketplace requirements. It is therefore neither a personal free-workspace product nor a Marketplace testing environment. Answer A is correct.

Slack workflows can begin from multiple types of triggers rather than being limited to scheduled execution. Workflow Builder supports event-driven automation, and available triggers can include Slack activity, user-invoked links or shortcuts, scheduled execution, webhook-based initiation, and other supported events. Slack's developer examples specifically demonstrate workflows starting when an emoji reaction is applied, while Workflow Builder documentation describes combining supported triggers with workflow steps to create automations. The precise trigger choices available can vary by workflow architecture, workspace plan, and evolving Workflow Builder capabilities, but the central concept remains that workflows can start from many different events or user actions. Therefore, options A, C, and D are overly restrictive. Among the supplied answers, B best represents Slack's event-driven and scheduled workflow-trigger model and is the correct answer.

The required inputs map directly to three Block Kit element types. First, a datetime picker allows a user to select both a date and a time and therefore provides substantially more suitable information for an absence period than a time-only picker. Slack defines the datetimepicker element specifically for selecting a date and a time of day. Second, descriptive information is unstructured text, making a plain-text input the appropriate component. Plain-text input elements can collect single-line or multiline free-form information inside an input block. Third, the manager should be represented as a Slack user identity rather than an arbitrary number. Slack provides the users_select element, which automatically populates the selectable options using users visible in the current workspace. The resulting value is a Slack user ID, providing a stable identifier suitable for subsequent API calls and workflow processing. Options A and D incorrectly use a number input for the manager. Option C uses the correct user selector but supplies only a time picker, which cannot capture the required calendar component. This directly tests Design the Interactive Flow of Your App, specifically constructing modal interfaces using appropriate Block Kit elements.

Slack identifies rate-limit exhaustion through the HTTP status code 429 Too Many Requests. When this occurs, the response includes a Retry-After header containing the number of seconds the application must wait before retrying the rate-limited operation. Slack applies Web API limits primarily on a per-method, per-workspace basis. Consequently, reaching the limit for conversations.list does not necessarily mean that every Web API method for the same workspace has become unavailable. Applications should read Retry-After, wait for the indicated interval, and retry responsibly rather than immediately issuing more requests. Pagination is also important. Slack explicitly notes that methods supporting cursor-based pagination may receive stricter rate treatment when an application attempts to retrieve extensive datasets without using pagination appropriately. A growing workspace therefore makes efficient pagination and caching increasingly important. HTTP 500 generally indicates a server-side failure rather than rate limiting. HTTP 200 can contain method-level errors or warnings but is not Slack's rate-limit signal. A Timeout header is not the prescribed rate-limit response mechanism. This is a core Design for Scale concept: applications must handle API limits predictably as data volume and workspace size increase.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Slack Developer Tools is specifically designed to provide Slack-platform development assistance directly inside Slack. Its capabilities include inspecting existing Slack messages to understand how those messages were constructed and accessing Slack method documentation without leaving the workspace. The official Slack Developer Tools listing describes an Inspect action available from a message's menu. Developers can use it to examine the underlying structure of a message, making it useful for understanding Block Kit layouts and message payload composition. The tool also provides the /sdt docs [method name] command, which retrieves documentation and implementation information for Slack API methods. Postman is useful for constructing and testing HTTP requests against Slack's Web API, but it does not provide the same Slack-native message inspection function. Browser developer tools inspect browser-side behavior and network activity rather than Slack message structures as a dedicated platform feature. The Slack CLI provides significant development, deployment, and application-management functionality, but the option's claimed built-in debugger is not the specific tool described for this requirement. Therefore, A remains correct. This directly maps to the Tools objective of the Slack Developer curriculum.

A global shortcut is designed for exactly this entry-point requirement. Global shortcuts expose application functionality independently of a particular message or channel context, enabling users to launch an application's workflow from broadly accessible locations in Slack. Slack specifically describes global shortcuts as suitable for workflows that can operate without the context of an existing channel or message. After the shortcut is invoked, Slack sends the app an interaction payload containing a trigger_id. The application can acknowledge the invocation and use that trigger_id to open a modal. The modal can then present the required multi-question form. On submission, the application can process the captured fields, transmit the data to the backend system, and use Slack's messaging API to publish the appropriate information to #benefits-us. A message shortcut requires an existing message context, which this use case does not require. A reaction similarly depends on a message. An incoming webhook provides a mechanism for posting information into Slack but does not provide an application entry point for opening an interactive form. This is a direct example of Design the Interactive Flow of Your App, particularly selecting the correct user entry point and connecting shortcuts to modal workflows.

Slack locale information is explicitly opt-in at the API-request level. For a conversation, an application can call conversations.info and set include_locale=true. For an individual member, it can call users.info with the same parameter. Slack then includes the applicable locale field in the returned object. The locale is represented using an IETF language identifier such as en-US or another supported language-region combination. Slack's design guidance recommends using a conversation's locale for content published publicly within that conversation and using the individual user's locale for private or personalized interactions. Option C is incorrect because locale is not included automatically by default. The application must explicitly request it. Option A incorrectly treats locale retrieval as an app-dashboard configuration toggle rather than a Web API argument. Option D refers to API methods that do not exist; Slack uses established methods such as users.info and conversations.info. Applications should also retrieve current locale information when preparing content rather than permanently assuming a user's language preference, because those preferences may change. This directly aligns with Design a Great User Experience, particularly internationalization and localization of Slack application content.

Slack's current Agent quickstart guides developers through creating an AI-powered Slack agent. The official quickstart uses a sample support agent named Casey and demonstrates building the application with the Slack CLI and Bolt frameworks while integrating supported AI agent frameworks such as the Claude Agent SDK, OpenAI Agents SDK, or Pydantic AI. The resulting agent can interact through direct messages, app mentions, App Home, modals, reactions, and threaded responses. Developers begin by installing the Slack CLI, authenticating with a workspace, and creating the agent project using the provided sample template. This is application-development guidance for Slack's AI agent platform, not billing, workspace theming, or Block Kit Builder extensions. Therefore, B precisely matches the purpose of the Agent quickstart.

When using the HTTP delivery model for the Events API, Slack sends subscribed events as HTTP POST requests containing JSON payloads to the application's configured Request URL. That URL must be a publicly reachable HTTPS endpoint capable of receiving and acknowledging Slack requests. Slack currently provides two event-delivery architectures: HTTP Request URLs and Socket Mode. Socket Mode replaces the public Request URL with a WebSocket connection, so the question's phrase “by default” is slightly imprecise under current documentation. Nevertheless, among the available options, A is unequivocally the intended and technically valid Events API delivery mechanism. Email, desktop notifications, and SMS are not mechanisms Slack uses to deliver application Events API payloads. Applications using HTTP should also verify Slack request signatures before processing the payload.

Bolt is Slack's higher-level application framework for building Slack apps with common platform patterns already organized for developers. Rather than manually wiring every incoming event, interaction, Web API request, acknowledgment, and middleware concern, Bolt provides listener registration, context injection, utilities such as `say()` and `ack()`, and convenient access to Slack API clients. Official Bolt implementations are available for JavaScript, Python, and Java, each built around Slack's corresponding SDK capabilities. Bolt is not a message database, a Marketplace billing system, or a CSS framework for Block Kit. Block Kit is Slack's UI composition system, while Bolt is application-development infrastructure. Therefore, B accurately describes Bolt as a higher-level framework that simplifies event handling, interactivity, and calls to Slack platform APIs.

Slack's current quickstart recommends using a developer sandbox when a developer does not already have a suitable Slack workspace for application development. A developer sandbox provides an isolated environment where an app can be installed, tested, and iterated without disrupting a production workspace. Slack CLI includes sandbox-related tooling, and the quickstart treats the sandbox as the preferred development environment for users who lack an existing workspace. A paid Slack plan, Enterprise Grid organization, or verified domain is not a prerequisite simply to begin a Slack CLI project. Strictly speaking, Slack documentation frames the sandbox as the recommended development workspace rather than a universal technical requirement in every circumstance; however, among the supplied choices, B is unequivocally the intended and correct answer.

Slack's `admin.conversations.*` methods provide Enterprise administrators with programmatic control over channels across an organization. Official Slack documentation lists methods for creating, deleting, archiving, unarchiving, and renaming channels, inviting users, searching channels, and changing channel visibility. For example, `admin.conversations.rename` can rename public or private channels, `admin.conversations.invite` adds users to channels, and `admin.conversations.search` searches conversations across an Enterprise organization. These methods require appropriate Admin API scopes and organization-level authorization and may additionally depend on the installing administrator's Channel Management permissions. They do not compile Bolt application code, construct Block Kit layouts, or issue app-level tokens; those functions belong to entirely different parts of Slack's developer platform. Therefore, A accurately represents the administrative channel-management capabilities of this API family.

When a Bolt project is being developed locally through the current Slack CLI, `slack run` can watch application files and automatically restart the local application development server when supported source files change. Slack documents this behavior for Bolt for Python and Bolt for JavaScript projects. Python projects normally watch `.py` files, while JavaScript projects watch `.js` files unless the developer customizes the watch configuration. This live-reload capability shortens the development cycle because developers can modify application logic and have the running process restarted without manually stopping and relaunching it after every edit. The Slack workspace itself is not restarted, the user's browser is unaffected, and OAuth tokens are not regenerated merely because source code changes. Therefore, B is correct.

In Bolt for Python, `@app.message(...)` registers a listener for messages matching specified text or a regular-expression pattern. For example, `@app.message("hello")` can invoke a listener when an incoming message contains the expected text. Bolt handles the event routing and supplies useful listener arguments such as the message payload, `say`, `client`, and other context values. By contrast, `@app.event` is used to subscribe a listener to a specific Slack event type rather than to filter messages by text. `@app.listen` and `@app.on_message` are not the standard Bolt for Python decorators documented for this use case. Therefore, B is correct: `@app.message` is the framework feature specifically intended for listening to message content that matches a configured string or pattern.

Option D accurately reflects Slack Connect behavior. Slack's official developer guidance explicitly states that messages sent through an incoming webhook into a Slack Connect channel are visible to all members of that shared channel, including users participating from external organizations. Option A is incorrect because the Events API can deliver events generated by external users participating in Slack Connect channels. Developers must therefore design applications to recognize that the actor may belong to another workspace. Option B is also incorrect: Slack specifically documents that shared channels do not cause duplicate event callbacks merely because the channel spans multiple workspaces. Developers should instead inspect authorization information in event payloads to determine where the application has authorization. Option C is overly broad. Incoming webhooks can send direct messages only under specific installation-team constraints; they cannot simply DM every external participant in a shared channel. Slack Connect therefore changes assumptions about workspace ownership, user identities, channel membership, and application authorization. Applications must distinguish the workspace where the app is installed from external workspaces represented in the shared conversation. This question belongs to Apps in the Slack Platform, particularly Slack Connect architecture and app behavior in externally shared channels.

The application currently needs only two capabilities: detect messages containing “hello” in public channels where it is already present, and post a response. Receiving public-channel message events requires the channels:history scope when subscribing to the message.channels event. Sending a response as the application requires chat:write. Therefore, D provides exactly the permissions required by the functionality available at release. The planned capabilities to independently join public channels and add reactions are explicitly scheduled for the following year. Slack's least-privilege principle requires applications to request only permissions required by functionality that presently exists. Requesting channels:join or reactions:write before those capabilities are implemented would unnecessarily expand the application's authorization footprint. Current Slack Marketplace guidance reinforces this requirement and states that applications should not submit scopes intended only for future functionality. Therefore, the correct release-time scopes are chat:write and channels:history. Additional scopes should be requested later when the associated features are implemented and ready for use. This maps to Design for Security, particularly granular OAuth scopes, least privilege, Events API authorization, and permission lifecycle management.