Slack-Dev-201 Exam Guide & Practice Questions

A facilities department supports eight office locations, each with its own Slack channel. Its maintenance system records equipment outages, but coordinators must monitor that system and copy urgent notices into the appropriate channel. Employees need prompt notice only when a new outage affects their location. Routine status changes are frequent, and the maintenance system must remain the authoritative record.

Which recommendation best uses a Slack app to improve this operation?

• AAutomate posting a notice to the relevant location channel when a new qualifying outage is recorded, while keeping the maintenance system as the system of record.
• BSend every employee a daily direct message listing all open outages, regardless of location or whether anything has changed.
• CReplace the maintenance system with an App Home page that employees must refresh to check for new outages.
• DOpen a modal in each location channel on a schedule so coordinators can review and repost outage details manually.

A regional procurement company uses a Slack app connected to its request system. Employees need to check their own open requests at any time, but the team does not want routine status updates posted in shared channels. When a request exceeds its approval deadline, the responsible approver must receive a timely alert. The company needs a persistent view and a separate way to deliver exceptions.

Which two Slack surfaces best meet these requirements? Choose two.

Select 2 answers, then check them.

• AUse a modal as the persistent request-status dashboard.
• BUse App Home to show each employee their open requests.
• CPost each employee's request status in a shared channel.
• DSend a direct message to the responsible approver when an exception occurs.
• EUse a direct message as the persistent dashboard for all open requests.

A support team handles customer reports in a shared Slack channel. Staff need to turn a particular message into a review request, with the report text and channel included in the request. They must be able to start the process only when they decide a report needs review. The app should then collect a short reason before creating the request.

Which app entry point best fits this workflow?

• AA message shortcut that opens a modal with the selected message available as context
• BA global shortcut that opens a modal without message context
• CA slash command that asks users to copy the message text into command arguments
• DAn event subscription that starts the workflow whenever a message is posted

A facilities app receives repair requests from several office channels. Each request must identify one owning team and a requested completion date before the app creates a task. The team choices come from a fixed list, and the date must be stored as a date value rather than text. The app collects both values in a modal opened from the channel.

Which two Block Kit elements should the app use in its modal to collect the required values? Choose two.

Select 2 answers, then check them.

• AA static_select element in an input block for choosing the owning team
• BA button element as the modal form's submit control
• CA datepicker element in an input block for choosing the due date
• DAn overflow menu for collecting the due date
• EA section block with plain text fields, relying on users to reply with their values

A support company has a Slack app that receives billing status changes from an internal service. When a status changes, the app must post a brief update to a designated Slack conversation using its bot identity. The internal service can make outbound requests, and the team wants to use supported Slack APIs while avoiding unnecessary retries when Slack limits requests.

Which implementation best meets the requirement?

• ASubscribe to the Events API and use incoming events to publish the message.
• BCall the Web API method chat.postMessage with the app's bot token, and honor Retry-After if the call is rate limited.
• CUse Socket Mode to send the message because it replaces Web API methods.
• DUse the legacy RTM API because the Web API cannot post messages.

A company runs its Slack app on servers behind a firewall that permits outbound connections but blocks inbound internet traffic. The app needs to receive subscribed Slack events, and the operations team will not expose a public request URL. The team can store an app-level token and keep a long-lived outbound connection open, but it does not want to poll Slack for changes.

Which event delivery approach fits these constraints?

• AConfigure HTTP-based Events API delivery to the internal service, even though it has no reachable public endpoint.
• BEnable Socket Mode and use an app-level token to receive Events API events over a WebSocket connection.
• CUse the Web API to poll continuously for each subscribed event.
• DUse the legacy RTM API because it does not require a public HTTP endpoint.

A data processing company receives Events API requests over HTTP and then performs a lengthy update in an internal system. During busy periods, some Web API calls return HTTP 429 responses. The app team has seen delayed acknowledgments and repeated event deliveries, and it needs to adjust both its event handling and its method retry behavior without losing work.

Which two changes should the team make? Choose two.

Select 2 answers, then check them.

• AAcknowledge each Events API request with a successful response within three seconds, then process longer work separately.
• BWhen a Web API method returns HTTP 429, wait for the duration specified by Retry-After before retrying.
• CRetry a Web API request immediately after receiving HTTP 429 so that the operation completes sooner.
• DAssume each event is delivered exactly once and omit duplicate-event handling.
• EUse the Retry-After value as the deadline for acknowledging an Events API request.
• FKeep the Events API request open until all downstream processing has finished.

A release coordination app posts a channel update every hour with deployment status for twelve services. On-call engineers say they miss the only service needing attention because the message gives every service equal detail and uses internal abbreviations. The team wants readers to scan the update quickly and understand what, if anything, they need to do.

Which message design best meets the team’s goal?

• APut the service needing attention and its required next step first, then provide a concise status summary for the remaining services.
• BList all twelve services in full detail and place a summary of the urgent issue at the end.
• CReplace service names and explanations with internal abbreviations to make the update shorter.
• DSend a separate channel message for each service, regardless of its status.

An internal support app posts service health updates in a shared channel. Its message uses colored status tiles and small icons, but screen-reader users report that they cannot distinguish healthy services from degraded ones. Several teams also use different color themes, and users need to identify the state from the message without opening another page.

Which two changes would make the service states easier to understand for these users? Choose two.

Select 2 answers, then check them.

• AProvide meaningful alt text for each status image so its state is conveyed to screen-reader users.
• BUse color alone to distinguish healthy services from degraded services.
• CPlace the meaning of each status only inside its image to keep the message brief.
• DInclude a written status label alongside each color-coded state.
• EWrite each status entirely in capital letters to make it more prominent.
• FReplace the status text with a graphic-only summary.

A company is building an internal Slack app that reads messages in public channels where it is a member and posts replies as a bot. It will be installed in several workspaces. The team has a server-side application and a secrets-management service, but its current prototype places credentials in browser code and requests both bot and user permissions.

Which implementation best meets the app's security requirements?

• AUse Slack's OAuth v2 authorization code flow, validate the returned state value, request only the required bot scopes, exchange the code on the server, and store the resulting bot token in a protected secrets store.
• BSend the client secret and requested scopes from the browser, then save the returned bot token in the browser's local storage for later requests.
• CRequest broad bot and user scopes during installation, then discard the scopes the app does not use and save the token in an application configuration file.
• DUse a manually generated bot token for every workspace and store it in the app's source code so that all servers use the same credential.

A service receives Slack requests at a public endpoint hosted in a cloud environment. The team recently added several server instances behind a load balancer, and a security review found that the endpoint accepts requests based only on fields in the JSON body. The app already has Slack's signing secret available through its server-side secrets-management service.

Choose two actions that best protect requests sent from Slack to the app.

Select 2 answers, then check them.

• AServe the request endpoint over HTTPS so that data is protected in transit.
• BAccept a request if its JSON body contains a workspace ID that appears in the app database.
• CValidate Slack's request signature using the signing secret and the unmodified request body, and reject stale timestamps.
• DPlace the signing secret in a query parameter so that every server instance can read it from the request URL.
• EAllow HTTP requests from Slack and rely on obscuring the callback URL to prevent interception.

A company uses Enterprise Grid with twelve workspaces. Its platform team manages approved app rollouts centrally, while individual business units need different app settings because their projects and data retention needs differ. The team wants one app experience across the organization without treating every workspace as an unrelated customer.

Which design best fits this customer’s Enterprise Grid structure?

• AModel the customer as one organization with multiple workspaces, keep workspace-specific settings distinct, and coordinate rollout with organization administrators.
• BTreat every workspace as a separate customer and require its workspace administrator to manage all app rollout decisions independently.
• CAssume each Enterprise Grid organization has only one workspace and store all settings at the organization level.
• DUse one shared configuration for every workspace because workspaces in an organization cannot have different requirements.

An organization administrator plans to test a new app configuration before making it available to users in a production Enterprise Grid organization. The production organization contains sensitive conversations and several workspaces with different settings. The administrator has a separate Enterprise Grid Sandbox but has not populated it with representative users or workspace configurations.

Choose two. Which statements should guide the team’s use of an Enterprise Grid Sandbox?

Select 2 answers, then check them.

• AIt is separate from production, so testing changes there does not change production workspaces.
• BProduction conversations and settings are continuously mirrored into the sandbox, so tests always use current production data.
• CThe team can use it to evaluate app behavior and administrative changes before deciding on a production rollout.
• DInstalling the app in the sandbox automatically installs it across the production organization.
• ETesting in the sandbox removes the need to check behavior in workspaces with different configurations.

A logistics company uses an app across several internal workspaces to coordinate shipment exceptions. Its operations team now plans to work with suppliers in Slack Connect channels, where supplier members remain part of their own organizations. The app team must decide whether external shared-channel use belongs in the planned product scope or can be ignored.

Which recommendation best addresses the customer’s plans for Slack Connect?

• APlan support for Slack Connect when the app’s intended workflows must operate in channels shared with external organizations, and validate behavior with participants from both organizations.
• BExclude Slack Connect because a shared channel can only be used by members of the organization that created it.
• CAssume Slack Connect support is unnecessary whenever the app is already available in multiple workspaces within one Enterprise Grid organization.
• DAdd Slack Connect support only after every external participant has joined the customer’s Enterprise Grid organization.

A product team is building a Slack app that must respond to several kinds of user interaction. The developers are comfortable with JavaScript, but they want a consistent structure for the app and do not want to implement common Slack interaction handling from scratch. They are comparing a framework, visual layout tools, and copied code examples.

Which development approach best fits the team’s requirements?

• AUse Bolt to provide a framework for handling common Slack app interactions, then implement the app’s required behavior within that framework.
• BUse Block Kit Builder as the framework for receiving Slack events and processing app logic.
• CUse Slack sample code as the complete application, without adapting it to the team’s requirements.
• DBuild the app without a framework because Slack apps cannot use frameworks such as Bolt.

A team is preparing a message layout for a Slack app and has found an official sample that includes a similar structure. The team needs to check how the layout will appear and confirm that its implementation matches the app’s requirements. It has limited review time and wants to use Slack development resources that address these separate tasks.

Choose two. Which actions make the best use of Slack development resources while the team refines its message layout?

Select 2 answers, then check them.

• AUse Block Kit Builder to assemble and preview the Block Kit layout before integrating it into the app.
• BUse relevant official Slack sample code and API documentation as references, then adapt the examples to the app’s requirements.
• CTreat Block Kit Builder as a tool that implements the app’s backend event processing.
• DCopy a sample app unchanged and assume it will meet the team’s specific requirements.
• EPrefer an unrelated third-party example over Slack documentation, even when it describes different behavior.

A developer has made changes to a Slack platform app and needs to test them from a development workspace. The production app is already in use, and the team does not want untested changes to affect it. The project uses Slack CLI, and the developer must choose a development tool workflow rather than deploy first or test only a message layout.

Which action best supports the developer’s goal?

• AUse Slack CLI development mode to run and test the app changes in the development workspace before deploying them.
• BDeploy the changes immediately so the production app can be used to evaluate them.
• CUse Block Kit Builder to run the app’s functions and verify its backend behavior.
• DReplace the app’s development workflow with copied sample code and skip testing the changes.

A company has an Enterprise Grid organization with several workspaces. Its operations team plans to use Admin API methods to automate organization-level administration, and the app will need organization-level admin scopes. The team has Workspace Admins available, but its Org Owner is not part of the development team. The developers are deciding what authorization step to arrange before implementation.

Which authorization prerequisite should the company plan for before obtaining and using the required Admin API token?

• AAn Org Owner must install the app and authorize its required organization-level admin scopes.
• BA Workspace Admin can authorize the app with admin scopes for the entire organization.
• CA bot token can be used without an installation that has admin scopes.
• DA SCIM token must be generated first, and it will also authorize Admin API calls.

A global company uses Enterprise Grid and has hired contractors to administer several workspaces. Its identity team needs to provision and deactivate employees and maintain user groups from its identity system. Separately, the compliance team must review records of administrative actions across the organization. The company wants to select the APIs that directly serve these two requirements.

Choose two. Which APIs should the company use to meet these requirements?

Select 2 answers, then check them.

• AThe SCIM API to provision and deactivate users and manage user groups.
• BThe Audit Logs API to review records of administrative activity.
• CThe Admin API to provision users and user groups through the identity lifecycle process.
• DThe Discovery API to monitor administrative changes made by contractors.
• EThe Web API to provide an organization audit-log feed.

A regulated financial firm must retain Slack messages and files for its compliance archive and respond to legal requests for relevant content from multiple workspaces. Its security team also reviews administrative actions, but that activity review is handled by a separate system. The firm needs a Slack API intended for content retrieval across its compliance process, rather than a tool for identity management or activity monitoring.

Which API is the best fit for the requested content retrieval?

• AThe Discovery API
• BThe Audit Logs API
• CThe SCIM API
• DThe Admin API
• EThe conversations.history Web API method

A software company built an app for its own support workspace and later enabled OAuth installation for customer workspaces. The team provides customers with an installation link, but it has not submitted the app for Slack review or created a public listing. The team needs to describe the app's current distribution model accurately.

Which description best fits the app's current distribution model?

• AA single-workspace app that can be installed only in the workspace where it was created.
• BA distributed app that can be installed in other workspaces through its OAuth flow, without being listed in the Slack App Directory.
• CA published App Directory app that is publicly listed and discoverable to eligible Slack customers.
• DAn app that becomes available in other workspaces when its original workspace installation is copied.

A small vendor has completed testing of a Slack app in its own workspace and wants customers to find it through the Slack App Directory. Customers must be able to install the app in their own workspaces. The vendor has not yet enabled cross-workspace installation, prepared a listing, or submitted the app for review.

The team plans to submit the app to the Slack App Directory. Which two actions should it take? Choose two.

Select 2 answers, then check them.

• AEnable app distribution and configure the OAuth installation details needed for installations in other workspaces.
• BComplete the App Directory listing with required app information, including privacy and support details, and submit it for review.
• CKeep distribution disabled and give reviewers a link to the app's installation in the development workspace.
• DRely on workspace administrators to approve installations instead of submitting the app for Slack's review.
• ESubmit the listing before making the app available for OAuth installation, because Directory approval supplies the installation flow.