Score Higher on Verified Slack-Dev-201 | Salesforce Certified Slack Developer Exam Questions with Answers

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.

Option D combines two important Slack security principles: least privilege and restriction of credential use. Applications should request only the OAuth scopes that are genuinely required. Every unnecessary scope expands what a compromised token could access or modify, so eliminating unused permissions materially reduces exposure. Slack additionally allows developers to restrict Web API token usage to an allowlist of trusted source IP addresses. Requests using the protected token from addresses outside the configured ranges are rejected. This creates an additional control around bearer-token misuse if credentials are accidentally exposed. Base64 encoding is not encryption and offers no meaningful protection for a leaked token, making A and B insecure. Credentials must not be embedded directly in application source code or committed to repositories. They should instead be kept in appropriate secret-management or environment-based facilities. Periodically uninstalling and reinstalling an application is also not a recognized credential-security strategy. Slack further recommends token rotation where appropriate. With token rotation enabled, granular access tokens expire and are exchanged using refresh tokens, reducing the useful lifetime of a stolen access token. Therefore, D is the strongest choice and directly aligns with Design for Security, including least-privilege scopes, credential protection, IP restrictions, and token lifecycle security.

The `slack app settings` command opens the selected app's configuration interface in a web browser. It provides a convenient transition from command-line development to Slack's web-based app management interface, where developers can inspect or modify app settings such as features, OAuth permissions, event subscriptions, interactivity, collaborators, and distribution configuration. Slack's CLI reference documents `slack app settings` specifically for opening app settings, making it the direct match for the behavior described in the question. `slack config open`, `slack edit`, and `slack dashboard` are not the documented Slack CLI commands for opening the app configuration page. Therefore, A is correct because `slack app settings` is the supported command for navigating from the CLI to the application's browser-based settings.