Salesforce Certified Slack Developer Practice Exam

An expense app posts a message with a “Submit expense” button. When a user clicks it, the app must show a form with several input fields and receive the values when the user submits.

Which approach correctly opens the form?

1. Post an ephemeral message asking the user to type each value as a separate reply in the channel
2. Call dialog.open with the button’s response_url to render a dialog
3. Call views.open with the trigger_id from the button’s block_actions payload and a modal view of input blocks, then handle the view_submission payload
4. Call chat.update on the original message to turn the button into a text field the user can type into

Users click an “Approve” button, and the app then calls a slow ERP API that can take 8–10 seconds before it posts the result. Users intermittently see an error in Slack even though the approval eventually succeeds.

What should the developer change?

1. Return an HTTP 200 acknowledgment immediately, run the ERP call asynchronously, then post the outcome through the response_url or the Web API
2. Raise the request timeout in the app’s settings so Slack waits for the ERP call to finish
3. Have the app re-send the interaction payload to itself until the ERP call completes
4. Change the button to a link button so that no interaction payload is sent

An app exposes a public Request URL for slash commands and interactivity. The security team wants the endpoint to act only on requests that genuinely come from Slack and to reject replayed requests.

What should the app do with every incoming request?

1. Accept the request if its source IP address looks like it belongs to Slack
2. Compute an HMAC-SHA256 of “v0:” + the X-Slack-Request-Timestamp + “:” + the raw request body with the app’s signing secret, compare it to X-Slack-Signature, and reject requests whose timestamp is more than five minutes old
3. Compare the verification token in the payload with the stored token and accept on a match
4. Require users to include a shared password in the slash command text

A developer is building an app that other companies will install. After an admin clicks “Add to Slack” and approves the requested scopes, Slack redirects back to the app’s redirect URL with a temporary code.

What is the next step in the OAuth v2 installation flow?

1. Store the temporary code as the app’s long-term credential for future API calls
2. Ask the installing admin to paste a personal user token from their account settings
3. Call chat.postMessage with the code to confirm the installation
4. Exchange the code by calling oauth.v2.access with the app’s client ID and client secret, then securely store the returned bot token for that workspace

An internal-only app runs on a server inside a corporate network. Security policy forbids exposing any public HTTP endpoint, but the app still has to receive events and interactivity payloads.

Which delivery approach fits?

1. Incoming webhooks, so Slack can push events to the app
2. HTTP-based Events API delivery to a Request URL on the internal hostname
3. Socket Mode, where the app opens a WebSocket connection to Slack using apps.connections.open and receives payloads over it
4. Polling conversations.history every few seconds for new activity

An identity team wants people created in its identity provider to be provisioned as Slack users automatically, placed in the right groups, and deactivated on their last day.

Which Slack API is designed for this?

1. The Audit Logs API
2. The SCIM API
3. The Discovery API
4. The Events API’s team_join event

An app is deployed organization-wide across twelve workspaces in an Enterprise organization (the structure the exam guide calls Enterprise Grid). It stores per-user preferences, and people regularly work across several workspaces.

How should the app key each person’s data so it follows them across workspaces?

1. By the Enterprise user ID, which represents the same person across every workspace in the organization
2. By the combination of the workspace team_id and the user’s display name
3. By channel ID, so preferences are shared by everyone in the channel
4. By a separate installation and database per workspace with no cross-workspace mapping

A /status slash command returns a detailed diagnostic readout. Channel members complain that every run clutters the conversation with output only the person who ran it needs.

What is the best UX fix?

1. Post the readout as a pinned message so it is easier to find later
2. Move the readout to an external web page and post the link in the channel
3. Reply with an ephemeral message, visible only to the invoking user
4. Post the readout to the channel and delete it after a minute

A team built an app in its own development workspace. Customers at other companies now need to install it, but the team is not ready to go through Slack Marketplace review.

What must the team do?

1. Nothing — any Slack app can be installed in any workspace by default
2. Submit the app to the Slack Marketplace, since that is the only way other workspaces can install it
3. Share the app’s bot token with each customer so they can use it in their workspace
4. Enable distribution and implement the OAuth 2.0 installation flow, so other workspaces can install it as an unlisted distributed app

Each user needs a personal dashboard inside Slack that lists their open tasks and refreshes whenever they open the app — without posting anything into channels.

Which surface and method fit?

1. A shared channel message that the app edits with chat.update for each user
2. The App Home tab, publishing a per-user view with views.publish when the app_home_opened event fires
3. A modal that opens automatically when the user signs in to Slack
4. A scheduled direct message sent to every user each morning