Slack-Dev-201 Exam Questions & Answers

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

Slack requires applications to verify inbound HTTP requests by using the application's signing secret. Slack generates an X-Slack-Signature header for signed requests. The application reconstructs the signature locally from the request timestamp and raw request body using HMAC-SHA256 together with its signing secret, then compares the calculated signature with the signature Slack supplied. This mechanism provides cryptographic integrity and origin verification. If an attacker alters the payload in transit, the locally calculated signature no longer matches Slack's signature. Implementations should also validate the X-Slack-Request-Timestamp and reject sufficiently old requests to reduce replay-attack risk. IP-address validation is not the recommended authentication mechanism because infrastructure addresses can change and network origin alone does not cryptographically establish message integrity. The Audit Logs API serves Enterprise monitoring and investigation rather than inbound-request authentication. Restricting server access is useful operational security but does not prove that an individual request came unmodified from Slack. Therefore, D directly implements Slack's prescribed request-verification architecture. This belongs to Design for Security, covering signing secrets, request integrity, authentication of Slack-originated traffic, and replay protection.

When an application exceeds a Slack Web API rate limit, Slack returns an HTTP `429 Too Many Requests` response together with a `Retry-After` header. The header specifies how many seconds the application must wait before retrying that API method for the affected workspace. Applications should respect this value, pause the relevant request flow, and retry only after the specified interval. Retrying continuously in a tight loop would continue violating the rate limit and can worsen reliability. There is no reason to switch the operation to an unrelated workspace, and discarding an important request permanently is unnecessary when Slack has explicitly provided a retry interval. Production applications should combine `Retry-After` handling with queues, controlled retry logic, and appropriate concurrency management. Therefore, B represents Slack's documented and scalable rate-limit handling strategy.

Bolt is Slack's higher-level application framework for building Slack apps with common platform patterns already organized for developers. Rather than manually wiring every incoming event, interaction, Web API request, acknowledgment, and middleware concern, Bolt provides listener registration, context injection, utilities such as `say()` and `ack()`, and convenient access to Slack API clients. Official Bolt implementations are available for JavaScript, Python, and Java, each built around Slack's corresponding SDK capabilities. Bolt is not a message database, a Marketplace billing system, or a CSS framework for Block Kit. Block Kit is Slack's UI composition system, while Bolt is application-development infrastructure. Therefore, B accurately describes Bolt as a higher-level framework that simplifies event handling, interactivity, and calls to Slack platform APIs.

Block Kit Builder is Slack's visual prototyping environment for designing and previewing Block Kit layouts. It allows users to add, rearrange, and configure blocks while simultaneously reviewing the associated JSON representation and seeing how the completed layout will render. For the HR newsletter use case, the team can therefore construct and visually review a formatted message before the application or automation sends it to the required regional channel. Slack describes Block Kit Builder as a tool for choosing, configuring, arranging, and previewing blocks across Slack surfaces. Option A overstates its function: Block Kit Builder is not fundamentally a template-management repository for organizing recurring newsletters. Option C is also too broad. The builder can expose example interaction payloads and validate message composition, but it does not execute an application's complete backend interactivity workflow end-to-end. Option D is unsupported; it does not automatically convert arbitrary word-processing documents into production-ready Block Kit structures. Therefore, B accurately describes its intended role: prepare and preview the Slack UI/message composition before deployment. This belongs to Tools, specifically Block Kit Builder and visual prototyping of Slack application surfaces.