Salesforce Slack-Dev-201 - Salesforce Certified Slack Developer

Message shortcuts are Slack app shortcuts specifically associated with an existing message. Slack distinguishes them from global shortcuts: global shortcuts can be initiated independently of message or channel context, whereas message shortcuts appear in an individual message's context menu and provide the app with information about that message. This makes message shortcuts particularly appropriate for operations such as creating a task from a message, escalating content, saving information to an external system, or launching a modal pre-populated with message context. Invoking the shortcut generates an interaction payload that the application processes. Message shortcuts are not keyboard-navigation commands, recurring-message schedulers, or administrator-only operations. Their distinguishing characteristic is that they provide an application action tied directly to the message selected by the user. Therefore, A is correct.

Slack provides the app_uninstalled Events API event specifically to notify an application that it has been completely removed from a workspace. Current Slack documentation identifies this as an Events API-only event and states that no OAuth scope is required specifically to subscribe to it. The event payload identifies the application and workspace involved, allowing the application's backend to locate the corresponding installation information and execute cleanup operations. Typical cleanup responsibilities include removing stored installation tokens, workspace configuration, cached identifiers, and customer data that should no longer be retained after the installation relationship ends. Slack may also deliver tokens_revoked events when individual tokens are revoked. However, Slack explicitly notes that the ordering of tokens_revoked and app_uninstalled is not guaranteed. The definitive uninstall lifecycle signal in this question is therefore app_uninstalled. The remaining answer choices are not valid Slack event types for this purpose. Handling uninstall events is important for both application lifecycle management and data minimization. Applications should not indefinitely retain workspace data after the customer has terminated the integration unless a legitimate retention requirement applies. This maps to Design Your Workflows: Spotlight on Slack's APIs, specifically Events API lifecycle events and installation cleanup.

Bolt is Slack's higher-level application framework for building Slack apps with common platform patterns already organized for developers. Rather than manually wiring every incoming event, interaction, Web API request, acknowledgment, and middleware concern, Bolt provides listener registration, context injection, utilities such as `say()` and `ack()`, and convenient access to Slack API clients. Official Bolt implementations are available for JavaScript, Python, and Java, each built around Slack's corresponding SDK capabilities. Bolt is not a message database, a Marketplace billing system, or a CSS framework for Block Kit. Block Kit is Slack's UI composition system, while Bolt is application-development infrastructure. Therefore, B accurately describes Bolt as a higher-level framework that simplifies event handling, interactivity, and calls to Slack platform APIs.

The immediate security priority after loss or theft of an authenticated device is to invalidate the compromised Slack sessions. Slack provides the Admin API method admin.users.session.reset specifically for this purpose. Current documentation states that the method wipes all valid Slack sessions on all devices for the specified user. This provides immediate containment by forcing the user to authenticate again rather than allowing a potentially unauthorized person holding the device to continue using an existing authenticated Slack session. The Audit Logs API can subsequently support investigation by identifying suspicious authentication or administrative activity, but merely monitoring events does not terminate the attacker's access. SCIM de-provisioning is too disruptive as the first response because the employee remains a legitimate member of the organization; the security problem is the compromised device/session rather than employment status. The Discovery API is intended for security/compliance integrations involving organizational content and is not the primary incident-containment mechanism. The applicable Admin API method requires the admin.users:write user-token scope and is available for Enterprise environments. Therefore, D provides the quickest and most proportionate first response. This belongs to APIs for Managing Your Slack, specifically Enterprise session administration and security incident response.

A clear privacy policy is a mandatory requirement for applications listed in what Slack now calls the Slack Marketplace. Slack requires the application's public landing page to provide a clear link to that privacy policy. The policy must explain, at minimum, what third-party data is collected, how that information is used, how long it is retained, and how individuals can request access, transfer, or deletion of their information. It must also provide a means of contacting the service regarding data-related requests. Slack specifically notes that even applications that do not actively use certain received data may nevertheless receive identifiers or other information through platform payloads, and this handling must be disclosed. Bank-account information is not a universal Marketplace submission requirement. A security assessment or penetration-testing report may become relevant for certain applications or review circumstances but is not the general listing requirement represented here. Slack also does not require every Marketplace description to be translated into every supported language. Therefore, B is correct. This belongs to Distribute Your App, specifically Marketplace listing requirements, privacy governance, and public application documentation.

Custom workflow steps expose application functionality as reusable building blocks that authorized users can incorporate directly into workflows through Workflow Builder. This provides a significant usability advantage for straightforward automation because end users can compose business processes visually rather than learning bot commands or interacting with a separate conversational interface. Slack allows developers to build custom steps and control who is permitted to add those steps to workflows, while administrators can impose additional restrictions. Custom steps do not eliminate app configuration or OAuth permission requirements, and they are not exclusive to Enterprise Grid environments. Their principal value is composability: application functionality becomes available alongside Slack-built and connector steps within the workflow-building experience. Therefore, B correctly identifies the architectural and user-experience advantage of using a custom workflow step for suitable automations.

The Slack CLI is Slack's official command-line development tool for creating, running, and managing Slack app projects. It supports the standard local development workflow used in Slack's current quickstarts, including creating a project from a template, authenticating with a development workspace, running the app locally, and opening app configuration. The command-line workflow is integrated with supported Slack SDKs and Bolt starter projects, so developers can move from scaffolding to testing without manually assembling the entire project structure. The alternatives listed are not Slack's official app-development command-line tool: there is no standard npm create-slack or pip slack-init workflow, and Bolt Studio is not the CLI product. Therefore, A correctly identifies Slack CLI as the official tool for command-line app development.

One of the strongest benefits of Slack app manifests is that application configuration becomes portable, reviewable, and reproducible. Slack explicitly recommends storing manifests in version-control systems such as GitHub, where collaborators can understand application setup and track configuration changes over time. A manifest can then be reused to create or configure apps consistently instead of manually reproducing settings through the web interface. This significantly reduces configuration drift between development, testing, and related application environments. A manifest is not the only mechanism for enabling bot functionality, does not eliminate OAuth authorization requirements, and does not automatically publish an application to the Slack Marketplace. Distribution and Marketplace publication remain separate lifecycle processes with their own requirements. Therefore, the version-controlled and repeatable configuration benefit described in B is precisely aligned with Slack's manifest documentation.

A is the current technically correct answer, replacing the uploaded bank's marked C. Slack's current token taxonomy does not define an “Admin” token type. Slack officially distinguishes token types such as bot tokens, user tokens, workflow tokens, and configuration tokens. Administrative authority is expressed through admin.* OAuth scopes attached to a user token, rather than through a separate token type called “Admin.” For example, Slack's official documentation for admin.conversations:read, admin.apps:read, and related Admin API scopes explicitly lists the supported token type as User. To obtain a user token imbued with Admin API scopes, the application must be installed at the entire Enterprise organization level by an authorized Org Admin or Org Owner. The resulting user access token can then call the applicable admin.* methods. Creating, inviting members to, and archiving channels require the appropriate administrative conversation scopes, particularly admin.conversations:*, subject to the installer having the corresponding Channel Management permissions. Therefore, under current Slack documentation, User is the correct token type. “Admin token” is outdated/imprecise terminology because admin describes the permission scope, not a distinct token class. This maps directly to APIs for Managing Your Slack.