Salesforce Updated Slack-Dev-201 Exam Questions and Answers by taron

Slack applies OAuth authorization at the API-method level. If an access token does not contain the scope required by the requested Web API operation, Slack rejects the call rather than silently granting additional privileges or returning unauthorized data. A common response is the `missing_scope` error, which indicates that the token lacks the specific scope permissions necessary to complete the operation. Slack's permissions model therefore enforces least privilege: an application's token can perform only the actions authorized through its granted scopes. Adding a scope to app configuration does not automatically upgrade an already issued token; existing installations may need reauthorization when new required scopes are introduced. Slack also does not normally email an administrator merely because an API request lacks a scope. Therefore, B accurately represents Slack's authorization behavior.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

Slack modals support a view stack containing up to three views, while only one view is displayed to the user at any particular moment. Applications can push new views onto the stack, update existing views, and allow users to return to prior views with their state preserved. This makes D correct and directly makes C incorrect. The App Home Home tab is also an application-controlled surface. An app composes its Home view using Block Kit and publishes that view with views.publish. The application can subsequently republish the Home view as application data changes, enabling personalized dashboards, summaries, settings, workflow entry points, and other persistent experiences. Therefore, E is correct and A is false. Block Kit applies to both modals and Home tabs, so B is incorrect. The distinction between these surfaces is architectural: a modal is focused and transient, suited to completing a defined task, whereas App Home is persistent and suited to information users revisit. This question therefore maps to Design the Interactive Flow of Your App, particularly Slack surfaces, modal view-stack behavior, Block Kit composition, and dynamic Home-tab publishing.

Slack defines every Audit Logs API event around four principal components: action, actor, entity, and context. The action specifies what occurred—for example, a user login, application installation, role change, or file-related administrative event. The actor identifies the user, application, or system responsible for performing the action. The entity represents the Slack resource affected by that action. The context provides environmental information surrounding the event, such as the location, workspace, organization, or session-related information relevant to interpreting what happened. Slack summarizes this relationship conceptually as an actor taking an action on an entity within a context. This structured model enables security teams to ingest Slack audit data into SIEM, monitoring, anomaly-detection, and forensic-analysis systems. Option A substitutes the vague terms “event” and “user,” which do not reflect Slack's formal audit schema. Option B incorrectly replaces entity with team, and D omits context. For certification purposes, these four fields are foundational because Audit Logs API workflows depend on understanding who performed an activity, what activity occurred, which resource was affected, and the surrounding operational context. This question belongs to APIs for Managing Your Slack, specifically the Audit Logs API data model.