Salesforce Slack-Dev-201 - Salesforce Certified Slack Developer

Slack's current documentation names this capability the Slack MCP and Skills Plugin. It is designed to improve AI-assisted and agent-assisted Slack development by supplying coding agents with specialized Slack development skills and, on supported clients, a connection to the Slack MCP Server. The skills provide focused instructions and references for tasks such as scaffolding Slack apps, validating Block Kit objects, composing messages, calling Web API methods, and using Slack CLI functionality. The MCP Server can additionally allow supported AI tools to interact with workspace data, including searching channels, sending messages, and managing canvases. Slack documents support for tools such as Claude Code, Codex, Cursor, and other coding agents, with capabilities varying by client. It does not replace Slack CLI or exist solely for OAuth. Therefore, A is correct.

Slack bot tokens use the `xoxb-` prefix. These tokens represent the application's bot identity within an installed Slack workspace and carry the granular bot OAuth scopes granted during installation. Slack's official token documentation explicitly states that bot token strings begin with `xoxb-`. Developers must treat these values as secrets because possession of a valid token can permit API operations authorized by its associated scopes. Credentials should therefore be stored in a secure secrets-management system or protected environment rather than embedded in source code or exposed in logs. The `xapp-` prefix belongs to app-level tokens, which are used for application-level functionality such as Socket Mode. The remaining prefixes do not represent the standard Slack bot token type described by this question. Therefore, option A is correct.

C corrects the supplied document's marked answer of A. The customers described are separate businesses rather than multiple workspaces belonging to one Enterprise organization. Consequently, Enterprise organization distribution is not the correct model. Organization-ready apps are installed at the level of a single Enterprise organization and then granted access to selected workspaces belonging to that organization. They are not a distribution mechanism for unrelated customer organizations. Slack's current application-lifecycle guidance describes unlisted distributed apps—historically described as publicly distributed apps—as the correct architecture when an application needs to be installed in other customer workspaces without being publicly discoverable in the Slack Marketplace. After configuring OAuth and enabling distribution, the developer can provide the installation link specifically to selected customers. A single-workspace app cannot be installed in customers' independent workspaces. Marketplace distribution would maximize discoverability rather than keep installation restricted to the agency's customers. Therefore, the appropriate option from the supplied choices is C. Public app distribution, more precisely called unlisted distribution in current Slack documentation. This belongs to Distribute Your App, covering undistributed, unlisted distributed, Marketplace, and Enterprise organization distribution models.

Enterprise Grid is Slack's enterprise architecture for organizations that need centralized governance across multiple Slack workspaces. Workspaces can exist within one Enterprise organization while organization-level administrators manage identity, policies, applications, security, and other administrative functions across the broader environment. Slack's current Enterprise documentation continues to describe Enterprise Grid organizations as containing multiple workspaces, and migration tooling allows standalone workspaces to be incorporated into an Enterprise organization. Enterprise functionality also enables organization-level application installation, Admin APIs, centralized app-management policies, and other large-scale administrative capabilities. Enterprise Grid is therefore not a pricing utility, UI theme, or authentication token type. Among the available options, B correctly captures its architectural purpose as Slack's offering for large organizations operating multiple managed workspaces.

GovSlack is a separate Slack environment specifically designed for U.S. public sector organizations and their security and compliance requirements. Slack states that GovSlack enables agencies, contractors, citizens, and partners to collaborate through an environment designed for stringent public-sector operational requirements. GovSlack operates separately from commercial Slack on the `slack-gov.com` domain, with data isolated from the commercial Slack environment. It runs in AWS GovCloud-certified infrastructure and supports compliance requirements including FedRAMP High. Developers making commercial Slack apps available in GovSlack must separately configure and deploy them for that environment and follow GovSlack-specific API, OAuth, credential, and Marketplace requirements. It is therefore neither a personal free-workspace product nor a Marketplace testing environment. Answer A is correct.

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

Slash commands are application entry points that allow users to invoke Slack app functionality directly from the message composer. A user enters a forward slash followed by the registered command—for example, `/todo`—and Slack routes the resulting command payload to the associated application. The payload includes contextual information and any text entered after the command. The application must acknowledge the request promptly and can respond through mechanisms such as `respond()`, `say()`, or subsequent Web API operations. Slack's official documentation explicitly describes slash commands as allowing users to invoke an app by typing a string into the message composer. They are unrelated to message encryption, workspace theme configuration, or general channel deletion. Therefore, B accurately describes the purpose of Slack slash commands.

Workflow Builder is Slack's no-code environment for creating automated workflows directly within Slack. Authorized users can combine triggers, built-in actions, connector actions, forms, conditional logic, and other workflow steps to automate repeatable business processes without implementing a complete custom application. Slack describes Workflow Builder as a no-code way to build workflows in which users combine supported steps and triggers to create automations. Developers can extend these workflows by supplying custom workflow steps when business logic exceeds the built-in capabilities. Workflow Builder is not primarily an app-manifest editor, a Bolt compilation environment, or an OAuth-token management interface. Those responsibilities belong to Slack app configuration, development tooling, and authentication mechanisms respectively. Consequently, B accurately captures the principal role of Workflow Builder within Slack's automation architecture.

Bolt provides a higher-level application framework that uses Slack's language SDKs underneath. Slack's platform overview explains that the Bolt frameworks for Python, JavaScript, and Java use the corresponding Slack SDKs to handle lower-level development details. The SDK layer exposes primitives such as Web API clients, authentication, HTTP requests, and API method implementations, while Bolt adds listener registration, middleware, context injection, interaction acknowledgment, event routing, and other application-development conveniences. This architecture allows developers to build Slack applications without repeatedly implementing platform plumbing themselves. Bolt and the SDKs therefore are not unrelated, nor do the SDKs automatically replace Bolt. Conversely, Bolt depends on the capabilities supplied by its underlying language ecosystem rather than functioning independently of them. Option B most accurately describes the documented architectural relationship between these components.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.