Slack-Dev-201 Exam Dumps - Salesforce Certified Slack Developer

Socket Mode requires an app-level token carrying the `connections:write` scope. App-level tokens conventionally begin with `xapp-` and represent the application itself rather than a particular workspace bot installation. The application uses this credential with `apps.connections.open` to obtain the dynamically generated WebSocket URL required for Socket Mode communication. A bot token may still be necessary for subsequent Web API actions, such as posting messages, but a bot token alone does not establish the Socket Mode connection. Slack's current documentation explicitly identifies `connections:write` as supporting app-level tokens and being compatible with `apps.connections.open`. Legacy tokens are not the required credential, and Socket Mode certainly does not operate without authentication. Therefore, B is the only correct token type among the supplied options.

Slack requires an application using HTTP Events API delivery to acknowledge an event request with an HTTP `2xx` response within three seconds. If Slack does not receive a successful acknowledgment in that period, the delivery attempt is treated as unsuccessful and Slack may retry the event. Slack recommends responding with `HTTP 200 OK` as rapidly as possible and separating event ingestion from potentially slow business processing. A robust production architecture typically acknowledges the request immediately, places the event on a queue, and performs downstream processing asynchronously. This prevents expensive API calls, database operations, or external-service dependencies from delaying acknowledgment and producing duplicate deliveries. Returning Block Kit content is unnecessary for acknowledgment, while user logout and scope requests are unrelated. Therefore, A is correct and represents an important Slack scalability and reliability pattern.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

`chat.postMessage` is Slack's standard Web API method for publishing a message to a conversation. The method accepts a `channel` identifier together with message content such as `text`, Block Kit `blocks`, or supported attachments. It requires the `chat:write` scope for bot or user tokens. Depending on the app's permissions and conversation membership, it can post to public channels, private channels, and supported direct-message conversations. Apps requiring the ability to post to public channels without joining them can request the additional `chat:write.public` scope. Slack's official Web API documentation identifies `chat.postMessage` as the primary method for sending messages. `messages.send`, `channel.write`, and `chat.create` are not valid Slack Web API equivalents for this operation. Therefore, A is correct.

In Bolt for Python, `@app.message(...)` registers a listener for messages matching specified text or a regular-expression pattern. For example, `@app.message("hello")` can invoke a listener when an incoming message contains the expected text. Bolt handles the event routing and supplies useful listener arguments such as the message payload, `say`, `client`, and other context values. By contrast, `@app.event` is used to subscribe a listener to a specific Slack event type rather than to filter messages by text. `@app.listen` and `@app.on_message` are not the standard Bolt for Python decorators documented for this use case. Therefore, B is correct: `@app.message` is the framework feature specifically intended for listening to message content that matches a configured string or pattern.

Slack supports unlisted distributed applications specifically for scenarios such as pilots, early customer testing, and beta validation before a Marketplace submission. To install an application outside its original workspace, the developer must configure the required OAuth flow and enable distribution through the application's Manage Distribution settings. After activating public distribution, Slack provides a Shareable URL that initiates the app's installation process. The developer can send this URL directly to beta testers at other organizations. Those users can install and test the application subject to their own workspace's app-management policies. Once testing is complete and the application meets Slack's quality, functionality, privacy, security, and distribution requirements, it can be submitted for Slack Marketplace review. A Marketplace listing is not available as a substitute for pre-review beta distribution. Creating cloned versions for every customer is unnecessary and creates configuration-management problems. Inviting external beta testers into the developer's own workspace would also fail to test the critical multi-workspace OAuth and installation behavior. Current Slack documentation explicitly identifies unlisted distribution as appropriate for early-customer pilots before broader Marketplace publication. This belongs to Distribute Your App, covering public distribution, OAuth installations, beta testing, Shareable URLs, and Marketplace submission.

The required inputs map directly to three Block Kit element types. First, a datetime picker allows a user to select both a date and a time and therefore provides substantially more suitable information for an absence period than a time-only picker. Slack defines the datetimepicker element specifically for selecting a date and a time of day. Second, descriptive information is unstructured text, making a plain-text input the appropriate component. Plain-text input elements can collect single-line or multiline free-form information inside an input block. Third, the manager should be represented as a Slack user identity rather than an arbitrary number. Slack provides the users_select element, which automatically populates the selectable options using users visible in the current workspace. The resulting value is a Slack user ID, providing a stable identifier suitable for subsequent API calls and workflow processing. Options A and D incorrectly use a number input for the manager. Option C uses the correct user selector but supplies only a time picker, which cannot capture the required calendar component. This directly tests Design the Interactive Flow of Your App, specifically constructing modal interfaces using appropriate Block Kit elements.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.