Salesforce Slack-Dev-201 Salesforce Certified Slack Developer Exam Practice Test

The `slack create` command is used to create a new Slack application project from a supported template. Slack CLI can prompt the developer to choose a starter project, or a template can be supplied directly, after which the command creates the local project directory and required project files. Slack's current quickstarts use `slack create` as the standard starting point for Bolt-based development in JavaScript or Python. This command is distinct from `slack run`, which executes the application locally, and from deployment or configuration commands used later in the lifecycle. `slack init`, `slack new`, and `slack bootstrap` are not the documented Slack CLI commands for scaffolding a new project. Therefore, option C correctly identifies the supported project-creation command.

Interactive Block Kit components such as buttons generate interaction payloads when users activate them. Slack delivers the payload to the application through its configured interactivity request endpoint or through Socket Mode when that transport mechanism is enabled. The payload identifies the user, application, workspace, conversation context, and specific action through properties such as the component's `action_id`. The application should acknowledge the interaction promptly and can then perform business logic, update the original message, call a Web API method, or open another interface such as a modal. Clicking a button does not automatically delete its containing message or revoke the user's OAuth authorization. Slack also does not simply ignore a properly configured interactive action. Therefore, B accurately describes Slack's interactive-component processing architecture.

The application currently needs only two capabilities: detect messages containing “hello” in public channels where it is already present, and post a response. Receiving public-channel message events requires the channels:history scope when subscribing to the message.channels event. Sending a response as the application requires chat:write. Therefore, D provides exactly the permissions required by the functionality available at release. The planned capabilities to independently join public channels and add reactions are explicitly scheduled for the following year. Slack's least-privilege principle requires applications to request only permissions required by functionality that presently exists. Requesting channels:join or reactions:write before those capabilities are implemented would unnecessarily expand the application's authorization footprint. Current Slack Marketplace guidance reinforces this requirement and states that applications should not submit scopes intended only for future functionality. Therefore, the correct release-time scopes are chat:write and channels:history. Additional scopes should be requested later when the associated features are implemented and ready for use. This maps to Design for Security, particularly granular OAuth scopes, least privilege, Events API authorization, and permission lifecycle management.

Option C provides the cleanest modal architecture because each required decision is represented independently: reservation date, permitted time block, and the user's stored vehicle. A select menu is specifically designed to present a controlled list of choices without consuming excessive modal space. Slack's Block Kit specification provides date pickers, time/datetime elements, and select menus for precisely these kinds of structured inputs. A static or externally populated select menu can represent the employee's saved vehicles while the displayed option text can include identifying information such as license plate and parking classification. Option B becomes progressively unusable as users store more vehicles because one button per vehicle increases visual clutter and competes for limited modal space. Slack's design guidance emphasizes reducing unnecessary choices and avoiding overloaded surfaces. Option D combines the date and time into a datetime picker, but the scenario requires users to select a date and a defined time range/block, making separate controls more appropriate. Option A automatically preselects the previous vehicle, which can encourage users to submit an unintended selection and is not required by the scenario. Therefore, C remains the most appropriate Block Kit modal layout. This maps to Design a Great User Experience, particularly concise forms and appropriate input controls.

GovSlack is a separate Slack environment specifically designed for U.S. public sector organizations and their security and compliance requirements. Slack states that GovSlack enables agencies, contractors, citizens, and partners to collaborate through an environment designed for stringent public-sector operational requirements. GovSlack operates separately from commercial Slack on the `slack-gov.com` domain, with data isolated from the commercial Slack environment. It runs in AWS GovCloud-certified infrastructure and supports compliance requirements including FedRAMP High. Developers making commercial Slack apps available in GovSlack must separately configure and deploy them for that environment and follow GovSlack-specific API, OAuth, credential, and Marketplace requirements. It is therefore neither a personal free-workspace product nor a Marketplace testing environment. Answer A is correct.

A Slack app manifest is a reusable, declarative representation of an application's configuration. Slack describes manifests as portable configurations that can define major application settings, including display information, features, OAuth scopes, event subscriptions, interactivity settings, and other platform capabilities. A manifest can be used to create, configure, copy, and reproduce Slack applications without manually re-entering every setting through the app-management interface. This is particularly useful for teams maintaining multiple environments or applications with similar configurations. Manifests can also be stored in source control so collaborators can review and track configuration changes alongside application code. They are unrelated to billing invoices, API error logs, or Slack user permission groups. Therefore, option B accurately captures both the declarative nature and primary purpose of a Slack app manifest.

Slack Marketplace publication is not automatic. Applications must satisfy Slack's Marketplace guidelines and pass Slack's submission and review process. Slack evaluates areas including functionality, installation and OAuth behavior, user experience, requested scopes, security controls, privacy documentation, support readiness, and application quality. As of September 2026, Slack also requires new Marketplace submissions to maintain at least 10 installations on active workspaces throughout review, subject to stated exceptions such as qualifying security and compliance partners. However, installation count alone does not qualify an application for publication; the complete Marketplace review requirements still apply. Enterprise Grid is likewise not required merely to publish an app. Therefore, B is the comprehensive correct answer because it encompasses Slack's review, eligibility, security, quality, distribution, and current submission requirements.

Among the supplied options, B is the intended answer because Slack's Web API is HTTP-based and Web API responses are JSON objects. Successful and failed responses contain a top-level Boolean `ok` property, together with method-specific fields or an `error` value. Many write methods also accept `application/json` request bodies. However, one technical correction is important: current Slack documentation explicitly states that the Web API is not a REST API. Slack describes it more precisely as a collection of HTTP RPC-style methods with endpoints such as `https://slack.com/api/METHOD_FAMILY.method`. Therefore, “REST with JSON” is not perfectly worded, but it is still the only defensible choice among A–D because SOAP/XML, GraphQL, and gRPC are incorrect. For current Slack terminology, “HTTP RPC-style methods with JSON responses” would be more precise.

Option A is the correct answer from the supplied choices. Slack historically exposed its complete Web API method reference at `api.slack.com/methods`, and that address currently redirects to Slack's modern developer documentation under the Methods reference at `docs.slack.dev/reference/methods/`. The reference contains Slack's available method families, including `admin.*`, `apps.*`, `auth.*`, `chat.*`, `conversations.*`, `files.*`, `users.*`, `views.*`, and many others. Each individual method page identifies supported access mechanisms, OAuth scopes, parameters, response structures, errors, and rate-limit information. The pricing and legal pages are unrelated to API-method documentation, while `app.slack.com/methods` is not Slack's developer method reference. Therefore, A remains valid, although the current canonical documentation location is Slack Developer Docs.

The `divider` block is the Block Kit component specifically designed to create a visual horizontal separation between adjacent pieces of content. Slack describes it as a content divider comparable to an HTML horizontal rule, allowing developers to organize messages, modals, and Home tabs into clearly separated visual sections. Its JSON representation is intentionally simple and normally requires only `"type": "divider"`, although a `block_id` can optionally be supplied. The alternatives `separator`, `line`, and `rule` are not valid Slack Block Kit block types. Dividers should be used where visual grouping improves readability rather than as substitutes for meaningful content structure. Slack officially supports divider blocks across messages, modals, and Home tabs. Therefore, A is the verified answer.

Slack requires a valid trigger_id when an application opens a modal through views.open. A trigger_id is generated in response to an explicit user interaction, including a global shortcut, slash command, button interaction, or supported interactive component. This requirement ensures that an application cannot arbitrarily display modal interfaces without recent user intent. When the user invokes the “Request Changes” global shortcut, Slack sends an interaction payload to the application. The application must acknowledge that request and use the contained trigger_id when calling views.open. Slack currently specifies that a trigger_id expires approximately three seconds after it is issued, so the application must use it promptly. A response_url is used to send follow-up responses for certain interactive requests and slash commands rather than to authorize modal opening. A callback_id is an application-defined identifier used to identify interaction flows in older or specific payload contexts. The payload's verification token is likewise not a modal-opening credential. Therefore, D is correct. This is a core Design the Interactive Flow of Your App concept involving shortcuts, interaction payloads, modal invocation, and views.open.

users.info provides the information required for both localization dimensions. Slack's user object contains timezone properties including tz, tz_label, and tz_offset. These values allow an application to schedule or render time-sensitive functionality according to the user's configured timezone rather than assuming the server's timezone or attempting to derive timezone information from HTTP headers. For language localization, users.info supports the include_locale=true parameter. When requested, Slack can include the user's locale, represented by an IETF language code. The app can then select translated strings and culturally appropriate presentation based on that locale. users.profile.get is intended for retrieving profile information and custom profile fields; it is not the preferred mechanism described by Slack for this combined localization requirement. HTTP request headers are also inappropriate for determining the Slack user's configured timezone because they represent network/request metadata rather than the user's Slack preference. Accordingly, D combines the appropriate API method with the two relevant user attributes. In implementation, the developer must remember to request locale explicitly using include_locale=true. This aligns with Design a Great User Experience, especially internationalization, localization, time-zone awareness, and tailoring application behavior to the individual Slack user.

App Home is the strongest primary surface because the requirement involves persistent management of structured, user-specific information. Employees must repeatedly return to the application to create, edit, and review timesheet data rather than perform only a single transient action. Slack defines App Home as a private one-to-one space between a user and an application. Its Home tab remains available in a predictable location and retains its interface until the application republishes or updates it. Slack specifically recommends App Home for personalized dashboards, task views, user-specific information, settings, and persistent application workflows. A timesheet application can therefore display the employee's current pay period, submitted entries, outstanding hours, approval status, and actions for adding or modifying records. Individual edit/create operations could subsequently open a modal, but the modal would be a supporting interaction surface rather than the application's principal workspace. Messages are better suited to notifications and conversational interactions. Threads organize message-based discussion and do not provide an appropriate persistent management dashboard. Therefore, A correctly follows Slack's surface-selection guidance. This question belongs to Design a Great User Experience, especially persistent personalized interfaces and selection of the appropriate Slack surface.

The `slack app settings` command opens the selected app's configuration interface in a web browser. It provides a convenient transition from command-line development to Slack's web-based app management interface, where developers can inspect or modify app settings such as features, OAuth permissions, event subscriptions, interactivity, collaborators, and distribution configuration. Slack's CLI reference documents `slack app settings` specifically for opening app settings, making it the direct match for the behavior described in the question. `slack config open`, `slack edit`, and `slack dashboard` are not the documented Slack CLI commands for opening the app configuration page. Therefore, A is correct because `slack app settings` is the supported command for navigating from the CLI to the application's browser-based settings.

Custom workflow steps expose application functionality as reusable building blocks that authorized users can incorporate directly into workflows through Workflow Builder. This provides a significant usability advantage for straightforward automation because end users can compose business processes visually rather than learning bot commands or interacting with a separate conversational interface. Slack allows developers to build custom steps and control who is permitted to add those steps to workflows, while administrators can impose additional restrictions. Custom steps do not eliminate app configuration or OAuth permission requirements, and they are not exclusive to Enterprise Grid environments. Their principal value is composability: application functionality becomes available alongside Slack-built and connector steps within the workflow-building experience. Therefore, B correctly identifies the architectural and user-experience advantage of using a custom workflow step for suitable automations.

Installing an organization-ready Slack application at the Enterprise organization level does not automatically add the application to every workspace in that organization. Slack explicitly separates organization-level installation from workspace access. After installation at the organization level, an Org Admin must grant the application access to one or more individual workspaces—or all workspaces—before members in those workspaces can actually use it. This architecture allows centralized authorization and token management while retaining administrative control over where the application is available. Option B is therefore incorrect because organization-level installation alone does not make the application immediately operational in every workspace. Option C incorrectly describes the requirement as installation “to a channel.” Applications are granted to workspaces; channel membership may subsequently matter for specific APIs or event subscriptions, but that is a separate issue. Application collaborators manage application configuration and development access and are not required merely to activate an organization-installed application. Slack identifies simplified token storage and centralized policy as major advantages of organization-ready installation while retaining workspace-level access control. This aligns directly with Design for Scale, especially Enterprise organization deployment and organization-ready applications.

Slack provides the app_uninstalled Events API event specifically to notify an application that it has been completely removed from a workspace. Current Slack documentation identifies this as an Events API-only event and states that no OAuth scope is required specifically to subscribe to it. The event payload identifies the application and workspace involved, allowing the application's backend to locate the corresponding installation information and execute cleanup operations. Typical cleanup responsibilities include removing stored installation tokens, workspace configuration, cached identifiers, and customer data that should no longer be retained after the installation relationship ends. Slack may also deliver tokens_revoked events when individual tokens are revoked. However, Slack explicitly notes that the ordering of tokens_revoked and app_uninstalled is not guaranteed. The definitive uninstall lifecycle signal in this question is therefore app_uninstalled. The remaining answer choices are not valid Slack event types for this purpose. Handling uninstall events is important for both application lifecycle management and data minimization. Applications should not indefinitely retain workspace data after the customer has terminated the integration unless a legitimate retention requirement applies. This maps to Design Your Workflows: Spotlight on Slack's APIs, specifically Events API lifecycle events and installation cleanup.

Bolt is Slack's higher-level application framework for building Slack apps with common platform patterns already organized for developers. Rather than manually wiring every incoming event, interaction, Web API request, acknowledgment, and middleware concern, Bolt provides listener registration, context injection, utilities such as `say()` and `ack()`, and convenient access to Slack API clients. Official Bolt implementations are available for JavaScript, Python, and Java, each built around Slack's corresponding SDK capabilities. Bolt is not a message database, a Marketplace billing system, or a CSS framework for Block Kit. Block Kit is Slack's UI composition system, while Bolt is application-development infrastructure. Therefore, B accurately describes Bolt as a higher-level framework that simplifies event handling, interactivity, and calls to Slack platform APIs.

A global shortcut is designed for exactly this entry-point requirement. Global shortcuts expose application functionality independently of a particular message or channel context, enabling users to launch an application's workflow from broadly accessible locations in Slack. Slack specifically describes global shortcuts as suitable for workflows that can operate without the context of an existing channel or message. After the shortcut is invoked, Slack sends the app an interaction payload containing a trigger_id. The application can acknowledge the invocation and use that trigger_id to open a modal. The modal can then present the required multi-question form. On submission, the application can process the captured fields, transmit the data to the backend system, and use Slack's messaging API to publish the appropriate information to #benefits-us. A message shortcut requires an existing message context, which this use case does not require. A reaction similarly depends on a message. An incoming webhook provides a mechanism for posting information into Slack but does not provide an application entry point for opening an interactive form. This is a direct example of Design the Interactive Flow of Your App, particularly selecting the correct user entry point and connecting shortcuts to modal workflows.

application/json is the appropriate Content-Type because Slack webhook-triggered workflows consume structured JSON payloads. When configuring a webhook workflow, Slack allows the workflow creator to define input variables and generates a request body containing corresponding JSON key-value pairs. The external application sends an HTTP POST request to the generated hooks.slack.com/triggers/... endpoint with values matching those defined inputs. JSON is the correct representation because it allows Slack to deserialize individual workflow variables predictably. Slack's webhook-related developer examples likewise show HTTP POST operations with Content-Type: application/json and a JSON body. multipart/form-data is normally appropriate for multipart uploads, not this trigger payload. text/plain would not provide the structured object Slack expects. application/x-www-form-urlencoded is associated with traditional form encoding and some older HTTP integrations, but it is not the format prescribed for the Workflow Builder webhook payload described here. The webhook URL itself must also be protected because possession of the URL can allow an external party to trigger the workflow. This maps directly to Design Your Workflows: Spotlight on Slack's APIs, specifically webhook-triggered workflow automation.

An organization-ready Slack application can be installed once at the Enterprise organization level, generating an organization-wide token that represents the application's authorization across the Enterprise organization. Slack explicitly identifies one of the advantages of organization-ready applications as requiring users to authorize the app once rather than creating separate credentials for each individual workspace. Therefore, with the application appropriately approved and configured with the necessary scopes, installing it at the Enterprise Grid organization level produces the token architecture required by the scenario. Installing separately into every workspace, as described by A, would defeat the stated objective of avoiding multiple-token management. A further architectural distinction is important: organization-level installation does not necessarily make the application automatically visible or usable in every workspace. Slack can separately grant an organization-installed app access to selected workspaces. However, that deployment/access process is distinct from the question's specific requirement to generate the single organization-wide token. Slack's Admin API scopes similarly require the application to be installed across the organization rather than only to an individual workspace. Thus B represents the intended token-generation procedure. This belongs to APIs for Managing Your Slack, particularly Enterprise organization-ready applications, org-level authorization, and administrative token management.

Slack bot tokens use the `xoxb-` prefix. These tokens represent the application's bot identity within an installed Slack workspace and carry the granular bot OAuth scopes granted during installation. Slack's official token documentation explicitly states that bot token strings begin with `xoxb-`. Developers must treat these values as secrets because possession of a valid token can permit API operations authorized by its associated scopes. Credentials should therefore be stored in a secure secrets-management system or protected environment rather than embedded in source code or exposed in logs. The `xapp-` prefix belongs to app-level tokens, which are used for application-level functionality such as Socket Mode. The remaining prefixes do not represent the standard Slack bot token type described by this question. Therefore, option A is correct.

A Slack modal is a temporary focused interface displayed over the current Slack experience. Slack describes modals as alert boxes, pop-ups, or dialog boxes that capture and maintain user focus until the modal is submitted or dismissed. Applications commonly use modals for structured forms, configuration tasks, data entry, confirmation flows, and detailed information that would otherwise clutter a message or Home tab. Modal views are built using Block Kit and can contain input elements, select menus, buttons, text, and other supported components. Applications normally open them through `views.open` using a recently generated `trigger_id`. Channels and workspaces are persistent Slack organizational structures, while workflow triggers begin automations rather than rendering focused pop-up interfaces. Therefore, A is correct.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.

Block Kit is Slack's UI framework for constructing structured and interactive application interfaces. It provides reusable blocks, block elements, and composition objects that developers combine to create messages, modal views, and App Home experiences. Blocks define major visual sections of an interface, while elements provide interactive controls such as buttons, menus, text inputs, date pickers, and other components. Slack applications represent these interfaces through structured payloads and can use them across supported Slack surfaces. Block Kit is therefore concerned with presentation, interaction, information hierarchy, and application user experience. It does not provide message encryption, administrative user-role management, or API rate-limiting functionality. Those responsibilities belong to separate security, administrative, and platform-control mechanisms. Option B precisely describes Block Kit's documented function as a framework for building rich and interactive Slack application layouts.

Slack AI agents are built on the core Slack application platform rather than an entirely isolated development system. Slack's agent documentation describes Slack as particularly suitable for agent experiences because it already provides a conversational environment, Block Kit interaction model, multiple application surfaces, identity, permissions, and contextual information. The official Agent quickstart demonstrates an agent using familiar Slack application mechanisms such as Bolt, App Home, modals, direct messages, app mentions, reactions, and threaded messaging. Developers can therefore combine AI reasoning and external model frameworks with established Slack primitives for events, messages, interfaces, authentication, and Web API actions. Agent functionality may introduce specialized capabilities and scopes, but it does not replace the underlying Slack platform. Agents can also post and stream responses. Consequently, B is the technically correct answer.

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

A message posted to an authorized conversation is a standard example of activity that can generate an Events API notification. Slack provides specific message event subscriptions for different conversation types, including `message.channels`, `message.groups`, `message.im`, and `message.mpim`. The exact events an application receives depend on its subscribed event types, granted OAuth scopes, and access to the relevant conversation. Slack's own Events API walkthrough uses a message posted in a channel containing a bot as a canonical example: Slack sends the event to the application, the server acknowledges it, and application logic can then respond using a Web API method such as `chat.postMessage`. A user's local clock, browser-tab changes, and ordinary billing renewal are not Events API event triggers represented by these developer subscriptions. Therefore, A is correct.

`chat.postMessage` is Slack's standard Web API method for publishing a message to a conversation. The method accepts a `channel` identifier together with message content such as `text`, Block Kit `blocks`, or supported attachments. It requires the `chat:write` scope for bot or user tokens. Depending on the app's permissions and conversation membership, it can post to public channels, private channels, and supported direct-message conversations. Apps requiring the ability to post to public channels without joining them can request the additional `chat:write.public` scope. Slack's official Web API documentation identifies `chat.postMessage` as the primary method for sending messages. `messages.send`, `channel.write`, and `chat.create` are not valid Slack Web API equivalents for this operation. Therefore, A is correct.

 member_joined_channel (often referred to as member_joined in event grouping contexts): This event is triggered when a standard user joins a public or private channel. Subscribing to this allows your bot to see whenever someone joins #it-help and instantly send them the welcome overview and resources guide.

 channel_joined: This event is specifically sent to your application when the bot user itself is added to a channel. Subscribing to this ensures your bot knows it has been successfully added to #it-help so it can begin its duties or send an initial greeting.

 app_mention: This event explicitly handles instances where users mention the bot (e.g., @ITHelpBot how do I connect to the VPN?). Subscribing to this lets the bot listen for and respond to specific user queries without needing access to read every single regular message in the channel.

In Bolt for Python, `@app.message(...)` registers a listener for messages matching specified text or a regular-expression pattern. For example, `@app.message("hello")` can invoke a listener when an incoming message contains the expected text. Bolt handles the event routing and supplies useful listener arguments such as the message payload, `say`, `client`, and other context values. By contrast, `@app.event` is used to subscribe a listener to a specific Slack event type rather than to filter messages by text. `@app.listen` and `@app.on_message` are not the standard Bolt for Python decorators documented for this use case. Therefore, B is correct: `@app.message` is the framework feature specifically intended for listening to message content that matches a configured string or pattern.

A modal is a focused application surface that appears over the Slack interface and maintains the user's attention until it is submitted or dismissed. Slack describes modals as alert boxes, pop-ups, or dialog-style interfaces used for focused interactions. Applications commonly use them to collect structured information, present temporary details, configure settings, or guide a user through a task. Modal content is constructed using Block Kit blocks and interactive elements, including text inputs, select menus, buttons, and date pickers. Modals are typically opened after an explicit user interaction by calling `views.open` with a valid `trigger_id`. They are not scheduled background processes, authentication tokens, or organization-wide announcement mechanisms. Therefore, option B accurately describes the purpose and presentation model of a Slack modal.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

When an application exceeds a Slack Web API rate limit, Slack returns an HTTP `429 Too Many Requests` response together with a `Retry-After` header. The header specifies how many seconds the application must wait before retrying that API method for the affected workspace. Applications should respect this value, pause the relevant request flow, and retry only after the specified interval. Retrying continuously in a tight loop would continue violating the rate limit and can worsen reliability. There is no reason to switch the operation to an unrelated workspace, and discarding an important request permanently is unnecessary when Slack has explicitly provided a retry interval. Production applications should combine `Retry-After` handling with queues, controlled retry logic, and appropriate concurrency management. Therefore, B represents Slack's documented and scalable rate-limit handling strategy.

Slash commands are application entry points that allow users to invoke Slack app functionality directly from the message composer. A user enters a forward slash followed by the registered command—for example, `/todo`—and Slack routes the resulting command payload to the associated application. The payload includes contextual information and any text entered after the command. The application must acknowledge the request promptly and can respond through mechanisms such as `respond()`, `say()`, or subsequent Web API operations. Slack's official documentation explicitly describes slash commands as allowing users to invoke an app by typing a string into the message composer. They are unrelated to message encryption, workspace theme configuration, or general channel deletion. Therefore, B accurately describes the purpose of Slack slash commands.

Slack applies OAuth authorization at the API-method level. If an access token does not contain the scope required by the requested Web API operation, Slack rejects the call rather than silently granting additional privileges or returning unauthorized data. A common response is the `missing_scope` error, which indicates that the token lacks the specific scope permissions necessary to complete the operation. Slack's permissions model therefore enforces least privilege: an application's token can perform only the actions authorized through its granted scopes. Adding a scope to app configuration does not automatically upgrade an already issued token; existing installations may need reauthorization when new required scopes are introduced. Slack also does not normally email an administrator merely because an API request lacks a scope. Therefore, B accurately represents Slack's authorization behavior.

Option B provides the strongest Slack-platform architecture because the process requires individualized status tracking, integration with an external system of record, recurring reminders, and escalation when employees remain noncompliant. Slack apps are specifically intended to automate tasks and connect Slack with external business systems. The application can determine each employee's compliance state externally and send targeted Slack notifications only where action is required. A quarterly announcement workflow is insufficient because it treats every employee identically and cannot distinguish completed from outstanding obligations. It also lacks an escalation mechanism. Option C unnecessarily places compliance training and acceptance inside Slack even though the scenario identifies an external system of record. That creates duplicated state and introduces additional governance concerns around which system represents the authoritative acceptance record. Slack's application-design guidance also cautions against noisy broad notifications. Targeted communication is preferable where a service concerns an individual user, and manager escalation can be generated only for unresolved cases. This maps to Apps in the Slack Platform, particularly recommending how Slack applications can automate organizational operations and integrate existing business processes with external systems.

The legacy Slack term group historically referred to what the modern platform calls a private channel. Slack's current Group object documentation explicitly directs developers to the Conversation object documentation for private channels and explains that older private channels were historically known as “private groups.” Modern Slack development uses the unified Conversations API. A conversation can represent a public channel, private channel, direct message, multi-person direct message, or other supported conversational surface. Developers can inspect properties such as is_private, is_im, and is_mpim rather than relying on older resource naming. A Group DM is instead represented as an MPIM and is conceptually different from a private channel. A direct message is a one-to-one conversation, while a User Group is an administrative grouping of workspace members used for functions such as mentions and organizational categorization. Therefore, D correctly translates the legacy term in the context of Slack API objects. This question maps to Apps in the Slack Platform, particularly the modern Conversations API object model and interpretation of legacy Slack documentation.

Option D combines two important Slack security principles: least privilege and restriction of credential use. Applications should request only the OAuth scopes that are genuinely required. Every unnecessary scope expands what a compromised token could access or modify, so eliminating unused permissions materially reduces exposure. Slack additionally allows developers to restrict Web API token usage to an allowlist of trusted source IP addresses. Requests using the protected token from addresses outside the configured ranges are rejected. This creates an additional control around bearer-token misuse if credentials are accidentally exposed. Base64 encoding is not encryption and offers no meaningful protection for a leaked token, making A and B insecure. Credentials must not be embedded directly in application source code or committed to repositories. They should instead be kept in appropriate secret-management or environment-based facilities. Periodically uninstalling and reinstalling an application is also not a recognized credential-security strategy. Slack further recommends token rotation where appropriate. With token rotation enabled, granular access tokens expire and are exchanged using refresh tokens, reducing the useful lifetime of a stolen access token. Therefore, D is the strongest choice and directly aligns with Design for Security, including least-privilege scopes, credential protection, IP restrictions, and token lifecycle security.