Practice Free Slack-Dev-201 Salesforce Certified Slack Developer Exam Questions Answers With Explanation

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

Bolt is Slack's higher-level application framework for building Slack apps with common platform patterns already organized for developers. Rather than manually wiring every incoming event, interaction, Web API request, acknowledgment, and middleware concern, Bolt provides listener registration, context injection, utilities such as `say()` and `ack()`, and convenient access to Slack API clients. Official Bolt implementations are available for JavaScript, Python, and Java, each built around Slack's corresponding SDK capabilities. Bolt is not a message database, a Marketplace billing system, or a CSS framework for Block Kit. Block Kit is Slack's UI composition system, while Bolt is application-development infrastructure. Therefore, B accurately describes Bolt as a higher-level framework that simplifies event handling, interactivity, and calls to Slack platform APIs.

Slack recommends making help accessible where users naturally interact with an application. For conversational applications, Slack's onboarding guidance specifically recommends replying when users request help in the application's DM and responding appropriately when the app is @mentioned. An app mention often indicates that a user either intends to invoke the application or needs guidance, making B directly aligned with Slack's recommendations. The application's Home tab is also an appropriate persistent location for support information and interactive help controls. Current Slack Marketplace UX guidance explicitly recommends making help and support easily accessible as part of the application experience and specifically cites placing support information in the app Home tab. Because Home tabs support Block Kit interactivity, a help button can provide an obvious, reusable entry point to assistance, making C appropriate. A feedback workflow does not directly provide operational help. Message shortcuts are intended primarily for actions associated with an existing message rather than general application assistance. Sending users unsolicited DMs containing prominent external URLs is also less consistent with Slack's preference for helpful, contextual, non-spammy onboarding. This maps to Design a Great User Experience, covering onboarding, discoverability, App Home, and contextual support.

Slack requires a valid trigger_id when an application opens a modal through views.open. A trigger_id is generated in response to an explicit user interaction, including a global shortcut, slash command, button interaction, or supported interactive component. This requirement ensures that an application cannot arbitrarily display modal interfaces without recent user intent. When the user invokes the “Request Changes” global shortcut, Slack sends an interaction payload to the application. The application must acknowledge that request and use the contained trigger_id when calling views.open. Slack currently specifies that a trigger_id expires approximately three seconds after it is issued, so the application must use it promptly. A response_url is used to send follow-up responses for certain interactive requests and slash commands rather than to authorize modal opening. A callback_id is an application-defined identifier used to identify interaction flows in older or specific payload contexts. The payload's verification token is likewise not a modal-opening credential. Therefore, D is correct. This is a core Design the Interactive Flow of Your App concept involving shortcuts, interaction payloads, modal invocation, and views.open.

Slack locale information is explicitly opt-in at the API-request level. For a conversation, an application can call conversations.info and set include_locale=true. For an individual member, it can call users.info with the same parameter. Slack then includes the applicable locale field in the returned object. The locale is represented using an IETF language identifier such as en-US or another supported language-region combination. Slack's design guidance recommends using a conversation's locale for content published publicly within that conversation and using the individual user's locale for private or personalized interactions. Option C is incorrect because locale is not included automatically by default. The application must explicitly request it. Option A incorrectly treats locale retrieval as an app-dashboard configuration toggle rather than a Web API argument. Option D refers to API methods that do not exist; Slack uses established methods such as users.info and conversations.info. Applications should also retrieve current locale information when preparing content rather than permanently assuming a user's language preference, because those preferences may change. This directly aligns with Design a Great User Experience, particularly internationalization and localization of Slack application content.

The Slack CLI is Slack's official command-line development tool for creating, running, and managing Slack app projects. It supports the standard local development workflow used in Slack's current quickstarts, including creating a project from a template, authenticating with a development workspace, running the app locally, and opening app configuration. The command-line workflow is integrated with supported Slack SDKs and Bolt starter projects, so developers can move from scaffolding to testing without manually assembling the entire project structure. The alternatives listed are not Slack's official app-development command-line tool: there is no standard npm create-slack or pip slack-init workflow, and Bolt Studio is not the CLI product. Therefore, A correctly identifies Slack CLI as the official tool for command-line app development.

A Slack app initially created for one development workspace cannot simply be installed into unrelated workspaces. To support multi-workspace installation, the application must implement the Slack OAuth authorization flow and enable distribution. A key prerequisite is configuring an OAuth Redirect URL. After an installing user authorizes the requested scopes, Slack returns a temporary authorization code to this redirect URI. The application's server then exchanges that code using oauth.v2.access for installation credentials. Slack's official distribution documentation also requires the developer to enable application distribution from the app-management interface. Historically the setting is described as Activate Public Distribution; current documentation may refer more generally to app distribution or unlisted distribution. Marketplace publication is not required merely to make an application installable by other workspaces. An unlisted distributed application can be shared directly with selected customers through its installation flow. Option C contains a serious security defect because workspace and user IDs must not be hard-coded. Option D does not establish multi-workspace authorization. Therefore, A provides the minimum architecture required for cross-workspace installation. This maps directly to Distribute Your App, particularly OAuth, redirect URLs, and distributed installations.

The Home tab is the correct surface because Slack defines App Home as a persistent, private, one-to-one workspace between an individual user and an application. Unlike transient messages or task-focused modals, the Home tab can present personalized information that users repeatedly return to and can be updated dynamically through the views.publish method. For an interview-management application, the Home tab can display upcoming interviews, completed interview sessions, outstanding feedback tasks, candidate summaries, and interactive controls such as buttons for opening feedback forms or managing assignments. Slack specifically identifies dashboards, personalized user data, application settings, and persistent workflow entry points as appropriate Home-tab use cases. A modal is better for a focused temporary interaction, such as submitting one interview evaluation, rather than maintaining the overall interview-management dashboard. Shortcuts are invocation mechanisms rather than persistent information surfaces. Messages are useful for notifications and conversational workflows but do not provide the same stable, personalized workspace. Therefore, the application's principal summary and management interface should be implemented through App Home, with modals or messages used as complementary surfaces when appropriate. This maps directly to Design a Great User Experience, particularly selecting the correct Slack surface based on persistence and workflow requirements.

Token rotation and HTTP request-signature validation are both recognized Slack security controls. Slack supports OAuth token rotation, replacing long-lived access credentials with short-lived access tokens and refresh tokens. With token rotation enabled, access tokens expire after 12 hours and must be refreshed. This limits the useful lifetime of a compromised access token and reduces exposure from credential leakage. Slack's current security guidance recommends implementing token rotation as part of credential lifecycle management. Slack also requires applications to validate inbound requests using the application's signing secret. Each Slack HTTP request includes an X-Slack-Signature. The application generates its own HMAC-SHA256 signature from the timestamp and raw request body and securely compares it with Slack's supplied signature. This protects against tampering and impersonation. Storing customer data on an employee laptop creates unnecessary data exposure. Bots must never request user passwords. Publishing a client secret in a public repository constitutes direct credential compromise. Therefore, A and D remain correct under current Slack security guidance. This maps directly to Design for Security, particularly token lifecycle management, secret protection, and cryptographic verification of Slack-originated requests.

When using the HTTP delivery model for the Events API, Slack sends subscribed events as HTTP POST requests containing JSON payloads to the application's configured Request URL. That URL must be a publicly reachable HTTPS endpoint capable of receiving and acknowledging Slack requests. Slack currently provides two event-delivery architectures: HTTP Request URLs and Socket Mode. Socket Mode replaces the public Request URL with a WebSocket connection, so the question's phrase “by default” is slightly imprecise under current documentation. Nevertheless, among the available options, A is unequivocally the intended and technically valid Events API delivery mechanism. Email, desktop notifications, and SMS are not mechanisms Slack uses to deliver application Events API payloads. Applications using HTTP should also verify Slack request signatures before processing the payload.

Custom workflow steps expose application functionality as reusable building blocks that authorized users can incorporate directly into workflows through Workflow Builder. This provides a significant usability advantage for straightforward automation because end users can compose business processes visually rather than learning bot commands or interacting with a separate conversational interface. Slack allows developers to build custom steps and control who is permitted to add those steps to workflows, while administrators can impose additional restrictions. Custom steps do not eliminate app configuration or OAuth permission requirements, and they are not exclusive to Enterprise Grid environments. Their principal value is composability: application functionality becomes available alongside Slack-built and connector steps within the workflow-building experience. Therefore, B correctly identifies the architectural and user-experience advantage of using a custom workflow step for suitable automations.

The correct answer is B. read, post, client, search:read (or rather, let's look closely at legacy vs modern scopes; wait, read, post, client, search:read are listed in Slack docs as legacy/restricted scopes that are not allowed or accepted for new Marketplace submissions!). Let's re-read snippet 1.5.1 / 1.2.4: "do not include functionality in Slack. use legacy/restricted scopes or methods... (admin.*, identity.*, search:read, read, post, client...)". Wait, option B says read, post, client, search:read, but those are restricted/legacy. Let's check which set of scopes would be allowed . Wait, granular scopes like admin:post, admin:read, admin:search, client:connect? Wait, let's check if D uses granular scopes or if none are allowed or if D is the correct choice because options A, B, C contain legacy broad scopes (read, post, client, search:read, admin). Option D uses granular scopes (admin:post, admin:read, admin:search, client:connect).

Slack Web API responses conventionally include a top-level Boolean `ok` property indicating whether the requested operation succeeded. A normal successful response contains `"ok": true` together with any method-specific data, such as a user object, channel information, timestamps, or other returned values. When an API operation fails, Slack generally returns `"ok": false` together with an `error` field identifying the failure condition. Slack explicitly advises callers to evaluate the `ok` value rather than assuming that a syntactically valid response represents success. For example, the official `users.info` method documentation shows a successful response containing `"ok": true` and an unsuccessful response containing `"ok": false`. Slack Web API operations do not normally return CSV files, redirects, or HTML documents as their standard JSON success response. Therefore, A is correct.

Slack's app approval and app-management controls allow administrators to govern application installation and usage. Workspace Owners can enable app approval, pre-approve applications, restrict applications, and determine whether members can request unapproved apps. In Enterprise organizations, Org Owners can establish organization-level app-management policies that enable app approval across workspaces and control which applications may be installed or used. Enterprise administrative interfaces also support approving, restricting, installing, and distributing apps across selected workspaces. Block Kit Builder is a UI-design utility, Socket Mode is an event-delivery mechanism, and the Events API delivers Slack activity notifications; none of those features governs app installation policy. Therefore, option A is the correct administrative control for determining which applications users are allowed to install or request within managed Slack environments.

Slack workflows automate tasks through configurable steps. Typical workflow functionality includes sending Slack messages, presenting forms to collect information, adding people to channels, and executing connector actions in external services. Slack's current Workflow Builder documentation specifically identifies Slack steps and connector steps, with connectors capable of actions such as adding rows to external spreadsheets. Form-based data collection is also a standard workflow capability. Compiling the Slack CLI from source, however, is a software-development and build operation performed outside Workflow Builder and has no role as a normal business-process workflow action. Workflow Builder is designed to orchestrate Slack and integrated-service operations rather than build Slack's own developer tooling. Consequently, options A, B, and D represent legitimate automation patterns, while C is unrelated to Workflow Builder execution. Therefore, C is correct.

Option B provides the strongest Slack-platform architecture because the process requires individualized status tracking, integration with an external system of record, recurring reminders, and escalation when employees remain noncompliant. Slack apps are specifically intended to automate tasks and connect Slack with external business systems. The application can determine each employee's compliance state externally and send targeted Slack notifications only where action is required. A quarterly announcement workflow is insufficient because it treats every employee identically and cannot distinguish completed from outstanding obligations. It also lacks an escalation mechanism. Option C unnecessarily places compliance training and acceptance inside Slack even though the scenario identifies an external system of record. That creates duplicated state and introduces additional governance concerns around which system represents the authoritative acceptance record. Slack's application-design guidance also cautions against noisy broad notifications. Targeted communication is preferable where a service concerns an individual user, and manager escalation can be generated only for unresolved cases. This maps to Apps in the Slack Platform, particularly recommending how Slack applications can automate organizational operations and integrate existing business processes with external systems.

Block Kit is Slack's UI framework for constructing structured and interactive application interfaces. It provides reusable blocks, block elements, and composition objects that developers combine to create messages, modal views, and App Home experiences. Blocks define major visual sections of an interface, while elements provide interactive controls such as buttons, menus, text inputs, date pickers, and other components. Slack applications represent these interfaces through structured payloads and can use them across supported Slack surfaces. Block Kit is therefore concerned with presentation, interaction, information hierarchy, and application user experience. It does not provide message encryption, administrative user-role management, or API rate-limiting functionality. Those responsibilities belong to separate security, administrative, and platform-control mechanisms. Option B precisely describes Block Kit's documented function as a framework for building rich and interactive Slack application layouts.

Bolt provides a higher-level application framework that uses Slack's language SDKs underneath. Slack's platform overview explains that the Bolt frameworks for Python, JavaScript, and Java use the corresponding Slack SDKs to handle lower-level development details. The SDK layer exposes primitives such as Web API clients, authentication, HTTP requests, and API method implementations, while Bolt adds listener registration, middleware, context injection, interaction acknowledgment, event routing, and other application-development conveniences. This architecture allows developers to build Slack applications without repeatedly implementing platform plumbing themselves. Bolt and the SDKs therefore are not unrelated, nor do the SDKs automatically replace Bolt. Conversely, Bolt depends on the capabilities supplied by its underlying language ecosystem rather than functioning independently of them. Option B most accurately describes the documented architectural relationship between these components.

Slack's current Agent quickstart guides developers through creating an AI-powered Slack agent. The official quickstart uses a sample support agent named Casey and demonstrates building the application with the Slack CLI and Bolt frameworks while integrating supported AI agent frameworks such as the Claude Agent SDK, OpenAI Agents SDK, or Pydantic AI. The resulting agent can interact through direct messages, app mentions, App Home, modals, reactions, and threaded responses. Developers begin by installing the Slack CLI, authenticating with a workspace, and creating the agent project using the provided sample template. This is application-development guidance for Slack's AI agent platform, not billing, workspace theming, or Block Kit Builder extensions. Therefore, B precisely matches the purpose of the Agent quickstart.

A and C are the two choices that best align with the current official Slack design guidance. Slack emphasizes concise, easily processed content. Applications should communicate clearly and minimize unnecessary cognitive load so users can understand information quickly rather than reading lengthy or overly complex interfaces. This supports the principle represented by option A. Slack's Block Kit design guidance also recommends simplifying suitable information with pictures. For example, faces may communicate user identity more efficiently than lists of names, and maps can sometimes communicate location more effectively than text. Images must still be accessible through appropriate alt_text; the recommendation is not to remove essential textual meaning indiscriminately. Option B is incorrect under current official guidance. Slack explicitly states that shortcut names should start with a verb, not a noun. Option D conflicts with Slack's recommendation to avoid excessive notifications, while option E is directly contrary to the guidance to reduce complexity by progressively revealing controls and information. The supplied document marks A and B, but B conflicts with Slack's published developer guidance and therefore should not be retained as the verified answer. This question belongs under Design a Great User Experience.

Slack provides the app_uninstalled Events API event specifically to notify an application that it has been completely removed from a workspace. Current Slack documentation identifies this as an Events API-only event and states that no OAuth scope is required specifically to subscribe to it. The event payload identifies the application and workspace involved, allowing the application's backend to locate the corresponding installation information and execute cleanup operations. Typical cleanup responsibilities include removing stored installation tokens, workspace configuration, cached identifiers, and customer data that should no longer be retained after the installation relationship ends. Slack may also deliver tokens_revoked events when individual tokens are revoked. However, Slack explicitly notes that the ordering of tokens_revoked and app_uninstalled is not guaranteed. The definitive uninstall lifecycle signal in this question is therefore app_uninstalled. The remaining answer choices are not valid Slack event types for this purpose. Handling uninstall events is important for both application lifecycle management and data minimization. Applications should not indefinitely retain workspace data after the customer has terminated the integration unless a legitimate retention requirement applies. This maps to Design Your Workflows: Spotlight on Slack's APIs, specifically Events API lifecycle events and installation cleanup.

Slack explicitly recommends applying the principle of least privilege when choosing OAuth scopes. An application should request only the minimum permissions required to perform its intended functionality. Every unnecessary scope expands the data or operations available to the application and therefore increases the potential impact of credential compromise, implementation defects, or inappropriate application behavior. Slack's security guidance recommends defining minimal scope sets and auditing requested permissions regularly. Marketplace guidance reinforces the same principle because users and administrators may reject applications that request excessive access to sensitive Slack data. Slack does not charge applications according to their number of scopes, and narrower scopes do not exist primarily to improve performance. Broad scopes have not simply been universally deprecated; rather, developers are expected to justify and minimize permissions. Therefore, B accurately captures Slack's security model and recommended application-design practice.

The `slack create` command is used to create a new Slack application project from a supported template. Slack CLI can prompt the developer to choose a starter project, or a template can be supplied directly, after which the command creates the local project directory and required project files. Slack's current quickstarts use `slack create` as the standard starting point for Bolt-based development in JavaScript or Python. This command is distinct from `slack run`, which executes the application locally, and from deployment or configuration commands used later in the lifecycle. `slack init`, `slack new`, and `slack bootstrap` are not the documented Slack CLI commands for scaffolding a new project. Therefore, option C correctly identifies the supported project-creation command.

conversations.history is Slack's current unified Web API method for retrieving message history from conversations. With the relevant OAuth scopes, a bot token can retrieve message history from conversations in which the bot is a member. Public-channel history requires channels:history, while private-channel history requires groups:history. Therefore, the app must be present in the applicable channels and possess the corresponding history scopes. Option C relies on legacy methods. Slack consolidated historically separate channel APIs into the Conversations API, making conversations.history the supported method for both public and private conversation history. The Events API can deliver newly occurring message events, but it does not independently provide the historical messages already stored in the conversation. Therefore, A does not meet the requirement to read both existing and subsequent message history. The Discovery API is a specialized Enterprise security and compliance capability and is inappropriate for an ordinary internal application. The source question and marked answer are therefore consistent with current Slack behavior. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly conversation membership, history scopes, and the unified Conversations API.

When an application exceeds a Slack Web API rate limit, Slack returns an HTTP `429 Too Many Requests` response together with a `Retry-After` header. The header specifies how many seconds the application must wait before retrying that API method for the affected workspace. Applications should respect this value, pause the relevant request flow, and retry only after the specified interval. Retrying continuously in a tight loop would continue violating the rate limit and can worsen reliability. There is no reason to switch the operation to an unrelated workspace, and discarding an important request permanently is unnecessary when Slack has explicitly provided a retry interval. Production applications should combine `Retry-After` handling with queues, controlled retry logic, and appropriate concurrency management. Therefore, B represents Slack's documented and scalable rate-limit handling strategy.

Interactive Block Kit components such as buttons generate interaction payloads when users activate them. Slack delivers the payload to the application through its configured interactivity request endpoint or through Socket Mode when that transport mechanism is enabled. The payload identifies the user, application, workspace, conversation context, and specific action through properties such as the component's `action_id`. The application should acknowledge the interaction promptly and can then perform business logic, update the original message, call a Web API method, or open another interface such as a modal. Clicking a button does not automatically delete its containing message or revoke the user's OAuth authorization. Slack also does not simply ignore a properly configured interactive action. Therefore, B accurately describes Slack's interactive-component processing architecture.

Slack's Direct Install URL is specifically intended to eliminate the extra step of routing prospective installers through the application's own landing page before starting OAuth. Current Slack Marketplace documentation states that when Slack sends an HTTP GET request to the configured Direct Install URL, that endpoint must respond with an HTTP 302 redirect to a fully qualified Slack OAuth authorization URL. For modern Slack applications, the redirect target follows the OAuth v2 authorization pattern: https://slack.com/oauth/v2/authorize. The URL includes the application's client ID and appropriate OAuth scope information. Slack then presents the authorization interface to the installing user. After consent, the normal OAuth authorization-code process continues through the application's configured redirect URI. Option B represents the conventional landing-page installation flow that Direct Install exists specifically to bypass. Option C confuses installation behavior with Slack's three-second acknowledgment requirement for interactive requests and Events API deliveries. A slack:// deep link is not the required Direct Install target. Therefore, D is precisely supported by current Slack Marketplace documentation. The question's older phrase Slack App Directory should now be read as Slack Marketplace. This maps directly to Distribute Your App.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

Slack's response_url provides a temporary callback mechanism that lets an application send additional responses after receiving a slash command or supported interactive-action payload. Current Slack documentation specifies that the URL can be used up to five times within 30 minutes after the application receives the original payload. That makes B the precise platform restriction. A response_url does not require the app to attach a bot or user OAuth token. Slack treats the URL itself as an authorized response pathway associated with the originating interaction. It can therefore bypass ordinary channel posting permissions for that response context. Option C is incorrect because global shortcuts do not inherently provide a response_url; their primary payload contains a trigger_id, which can be used to open a modal. Option A is also incorrect because interaction responses can modify or replace originating messages where the interaction type supports such behavior. If an app needs to communicate after the 30-minute response window or after exhausting the permitted responses, it should use standard messaging APIs such as chat.postMessage. This maps directly to Design the Interactive Flow of Your App, particularly slash commands, interaction acknowledgments, and asynchronous responses.

A message posted to an authorized conversation is a standard example of activity that can generate an Events API notification. Slack provides specific message event subscriptions for different conversation types, including `message.channels`, `message.groups`, `message.im`, and `message.mpim`. The exact events an application receives depend on its subscribed event types, granted OAuth scopes, and access to the relevant conversation. Slack's own Events API walkthrough uses a message posted in a channel containing a bot as a canonical example: Slack sends the event to the application, the server acknowledges it, and application logic can then respond using a Web API method such as `chat.postMessage`. A user's local clock, browser-tab changes, and ordinary billing renewal are not Events API event triggers represented by these developer subscriptions. Therefore, A is correct.

C# is the correct answer. Slack officially maintains the Bolt framework for JavaScript, Python, and Java. Bolt provides a higher-level application framework over Slack's underlying SDKs and handles substantial platform plumbing such as receiving and acknowledging events, routing interactive actions, authentication, authorization, token handling, and rate-limit-aware integration patterns. JavaScript is supported through Bolt for JavaScript. Python is supported through Bolt for Python. Java is supported through Bolt for Java and the Slack Java SDK. Slack's platform overview explicitly identifies these three languages as the supported Bolt implementations. C# applications can still interact with Slack because Slack's Web API is fundamentally HTTP-based. A developer can make HTTPS requests from C# and implement event endpoints, OAuth, request verification, and other Slack functionality manually or through third-party libraries. That does not make C# an officially supported Bolt framework implementation. The distinction is important for certification purposes: the question asks specifically which language Bolt does not support, rather than which languages can communicate with Slack APIs. This maps directly to the Tools objective, which requires candidates to understand when and how the Bolt development framework is used in Slack application development.

Slack's current architecture guidance explicitly favors HTTP Request URLs for production applications when Socket Mode is not required. WebSockets are stateful, which makes them more complex to scale horizontally and more susceptible to connection interruptions, network partitions, and transient disconnections. Slack describes Socket Mode as particularly convenient for local development, on-premises integrations, environments behind firewalls, or applications unable to receive inbound HTTP traffic. For maximum application-connectivity reliability, Slack recommends HTTP for production applications and advises developers to continue using HTTP request URLs when their deployment does not specifically require Socket Mode. Socket Mode also does not replace the Web API; applications commonly receive events over Socket Mode and then invoke Web API methods to perform actions. Therefore, B accurately reflects Slack's present production-scale guidance.

A modal is a focused application surface that appears over the Slack interface and maintains the user's attention until it is submitted or dismissed. Slack describes modals as alert boxes, pop-ups, or dialog-style interfaces used for focused interactions. Applications commonly use them to collect structured information, present temporary details, configure settings, or guide a user through a task. Modal content is constructed using Block Kit blocks and interactive elements, including text inputs, select menus, buttons, and date pickers. Modals are typically opened after an explicit user interaction by calling `views.open` with a valid `trigger_id`. They are not scheduled background processes, authentication tokens, or organization-wide announcement mechanisms. Therefore, option B accurately describes the purpose and presentation model of a Slack modal.

Slack modals support a view stack containing up to three views, while only one view is displayed to the user at any particular moment. Applications can push new views onto the stack, update existing views, and allow users to return to prior views with their state preserved. This makes D correct and directly makes C incorrect. The App Home Home tab is also an application-controlled surface. An app composes its Home view using Block Kit and publishes that view with views.publish. The application can subsequently republish the Home view as application data changes, enabling personalized dashboards, summaries, settings, workflow entry points, and other persistent experiences. Therefore, E is correct and A is false. Block Kit applies to both modals and Home tabs, so B is incorrect. The distinction between these surfaces is architectural: a modal is focused and transient, suited to completing a defined task, whereas App Home is persistent and suited to information users revisit. This question therefore maps to Design the Interactive Flow of Your App, particularly Slack surfaces, modal view-stack behavior, Block Kit composition, and dynamic Home-tab publishing.

A private channel is represented through Slack's unified conversation-object model. Slack's Conversations API consolidates several historically separate object categories into the conversation abstraction. Depending on its properties, a conversation object can represent a public channel, private channel, direct message, multi-person direct message, and other conversation-oriented constructs. For a private channel, the conversation object exposes properties such as is_private. Slack's modern APIs therefore avoid requiring developers to treat every channel type through entirely separate legacy APIs. Older terminology such as group survives in some legacy documentation and fields, but private channels are now handled through the Conversations API. A public message is not itself a conversation; it is content contained inside a conversation. A message reaction is metadata or an event associated with a message. A file attachment similarly represents content attached to or referenced from a message rather than a conversation container. The distinction matters when using methods such as conversations.info, conversations.list, conversations.history, and other Conversations API operations because the same core object model can represent multiple Slack conversation types. This maps to Apps in the Slack Platform, specifically understanding Slack's object model and the unified Conversations API.