Slack-Dev-201 Questions and Answers

An organization-ready Slack application can be installed once at the Enterprise organization level, generating an organization-wide token that represents the application's authorization across the Enterprise organization. Slack explicitly identifies one of the advantages of organization-ready applications as requiring users to authorize the app once rather than creating separate credentials for each individual workspace. Therefore, with the application appropriately approved and configured with the necessary scopes, installing it at the Enterprise Grid organization level produces the token architecture required by the scenario. Installing separately into every workspace, as described by A, would defeat the stated objective of avoiding multiple-token management. A further architectural distinction is important: organization-level installation does not necessarily make the application automatically visible or usable in every workspace. Slack can separately grant an organization-installed app access to selected workspaces. However, that deployment/access process is distinct from the question's specific requirement to generate the single organization-wide token. Slack's Admin API scopes similarly require the application to be installed across the organization rather than only to an individual workspace. Thus B represents the intended token-generation procedure. This belongs to APIs for Managing Your Slack, particularly Enterprise organization-ready applications, org-level authorization, and administrative token management.

Slack recommends transmitting OAuth access tokens through the HTTP `Authorization` header using the Bearer authentication scheme. A typical request therefore includes a header such as `Authorization: Bearer xoxb-...`, where an `xoxb-` value represents a bot token. When using JSON request bodies for write methods, Slack explicitly requires the token to be transmitted as a bearer token in this header. Keeping credentials in headers also avoids exposing sensitive tokens through URLs, browser history, intermediary logs, or query-string processing. Slack does permit token transmission as an encoded POST body parameter in some cases, but the Authorization header is the preferred mechanism. `X-Slack-Token`, browser cookies, and the `Referer` header are not the documented authentication mechanisms for ordinary Slack Web API calls. Therefore, A is the verified answer.

The `slack app settings` command opens the selected app's configuration interface in a web browser. It provides a convenient transition from command-line development to Slack's web-based app management interface, where developers can inspect or modify app settings such as features, OAuth permissions, event subscriptions, interactivity, collaborators, and distribution configuration. Slack's CLI reference documents `slack app settings` specifically for opening app settings, making it the direct match for the behavior described in the question. `slack config open`, `slack edit`, and `slack dashboard` are not the documented Slack CLI commands for opening the app configuration page. Therefore, A is correct because `slack app settings` is the supported command for navigating from the CLI to the application's browser-based settings.

Slack explicitly recommends applying the principle of least privilege when choosing OAuth scopes. An application should request only the minimum permissions required to perform its intended functionality. Every unnecessary scope expands the data or operations available to the application and therefore increases the potential impact of credential compromise, implementation defects, or inappropriate application behavior. Slack's security guidance recommends defining minimal scope sets and auditing requested permissions regularly. Marketplace guidance reinforces the same principle because users and administrators may reject applications that request excessive access to sensitive Slack data. Slack does not charge applications according to their number of scopes, and narrower scopes do not exist primarily to improve performance. Broad scopes have not simply been universally deprecated; rather, developers are expected to justify and minimize permissions. Therefore, B accurately captures Slack's security model and recommended application-design practice.

Interactive Block Kit components such as buttons generate interaction payloads when users activate them. Slack delivers the payload to the application through its configured interactivity request endpoint or through Socket Mode when that transport mechanism is enabled. The payload identifies the user, application, workspace, conversation context, and specific action through properties such as the component's `action_id`. The application should acknowledge the interaction promptly and can then perform business logic, update the original message, call a Web API method, or open another interface such as a modal. Clicking a button does not automatically delete its containing message or revoke the user's OAuth authorization. Slack also does not simply ignore a properly configured interactive action. Therefore, B accurately describes Slack's interactive-component processing architecture.

Slack's `admin.conversations.*` methods provide Enterprise administrators with programmatic control over channels across an organization. Official Slack documentation lists methods for creating, deleting, archiving, unarchiving, and renaming channels, inviting users, searching channels, and changing channel visibility. For example, `admin.conversations.rename` can rename public or private channels, `admin.conversations.invite` adds users to channels, and `admin.conversations.search` searches conversations across an Enterprise organization. These methods require appropriate Admin API scopes and organization-level authorization and may additionally depend on the installing administrator's Channel Management permissions. They do not compile Bolt application code, construct Block Kit layouts, or issue app-level tokens; those functions belong to entirely different parts of Slack's developer platform. Therefore, A accurately represents the administrative channel-management capabilities of this API family.

Block Kit Builder is Slack's visual prototyping environment for designing and previewing Block Kit layouts. It allows users to add, rearrange, and configure blocks while simultaneously reviewing the associated JSON representation and seeing how the completed layout will render. For the HR newsletter use case, the team can therefore construct and visually review a formatted message before the application or automation sends it to the required regional channel. Slack describes Block Kit Builder as a tool for choosing, configuring, arranging, and previewing blocks across Slack surfaces. Option A overstates its function: Block Kit Builder is not fundamentally a template-management repository for organizing recurring newsletters. Option C is also too broad. The builder can expose example interaction payloads and validate message composition, but it does not execute an application's complete backend interactivity workflow end-to-end. Option D is unsupported; it does not automatically convert arbitrary word-processing documents into production-ready Block Kit structures. Therefore, B accurately describes its intended role: prepare and preview the Slack UI/message composition before deployment. This belongs to Tools, specifically Block Kit Builder and visual prototyping of Slack application surfaces.

Slack's current documentation names this capability the Slack MCP and Skills Plugin. It is designed to improve AI-assisted and agent-assisted Slack development by supplying coding agents with specialized Slack development skills and, on supported clients, a connection to the Slack MCP Server. The skills provide focused instructions and references for tasks such as scaffolding Slack apps, validating Block Kit objects, composing messages, calling Web API methods, and using Slack CLI functionality. The MCP Server can additionally allow supported AI tools to interact with workspace data, including searching channels, sending messages, and managing canvases. Slack documents support for tools such as Claude Code, Codex, Cursor, and other coding agents, with capabilities varying by client. It does not replace Slack CLI or exist solely for OAuth. Therefore, A is correct.

The supplied Slack Developer question bank identifies D, and the central collaborator-management behavior remains consistent with current Slack documentation. App collaborators are intended to share responsibility for an application's configuration rather than leave application administration dependent upon one developer. Current Slack guidance confirms that collaborators can manage an application's settings and that existing collaborators can add additional collaborators. Slack Marketplace guidance also requires Marketplace applications to have another collaborator, specifically to ensure continued configuration access if the original application creator leaves the associated workspace. Collaborator membership therefore represents administrative access to the application rather than ordinary end-user access. An important distinction concerns ownership. Being added as an App Collaborator does not mean a collaborator can simply unilaterally designate themselves the application owner. Current Slack tooling explicitly distinguishes collaborator permission from owner permission; owner assignment is a separate permission operation in supported Slack CLI workflows. That eliminates options A, B, and C because each incorrectly includes self-assignment as owner. Accordingly, D remains the exam-bank answer. Current Slack terminology also uses Slack Marketplace rather than App Directory. This maps to Distribute Your App, particularly application ownership continuity, collaborators, and Marketplace operational requirements.

Slack app manifests are officially expressed in JSON or YAML. Both formats represent the same structured application configuration and can define metadata, application features, OAuth configuration, event subscriptions, interactivity settings, and other supported manifest properties. Slack's manifest documentation explicitly states that manifests are reusable configurations expressed in JSON or YAML and can be authored through an application's configuration page. Slack's Deno SDK also supports defining compatible manifest information programmatically in TypeScript, but among the supplied answers, JSON or YAML is unequivocally correct for standard app manifests. XML, INI, and Markdown are not the documented manifest serialization formats. Using JSON or YAML also makes manifests practical for source-control workflows, code review, automated deployment, and reuse across related application configurations. Therefore, A is the verified answer.

Workflow Builder is intentionally designed as a no-code automation environment, so ordinary workspace members can create workflows without being software developers. Slack currently states that, by default, all regular members can access Workflow Builder and create workflows, although owners and administrators can restrict who has permission to do so. In Enterprise organizations, Org Owners and Org Admins can similarly establish organization-level policies governing workflow creation. Workflow Builder therefore enables business users to automate routine processes using triggers, forms, Slack actions, connector steps, and other visual components. It is not restricted to Slack employees, certified developers, or Enterprise Grid owners. The important qualification in option B is “with the appropriate permissions,” because administrative policies can narrow the default access. Therefore, B is the correct answer.

Public channels are the only conversation type among these choices for which Slack provides an explicit permission enabling an app to post without first becoming a member. The relevant permission is the chat:write.public scope, used together with chat:write. Slack describes chat:write.public as permitting a Slack app to send messages to public channels in which the application is not a member. Without that additional scope, an app normally must join the public channel or be invited before posting. Private channels require appropriate membership and authorization because allowing an app to post into a private conversation without membership would violate Slack's privacy model. Likewise, ordinary direct messages and multi-person direct messages have different membership and conversation-opening semantics and are not equivalent to posting freely into a public channel. The wording “by default” in the source is somewhat imprecise because granular-permission Slack apps do not automatically receive access to all public channels. They must request chat:write.public. Nevertheless, among the four conversation types, D represents the intended and technically supported capability. This question aligns with Design Your Workflows: Spotlight on Slack's APIs, particularly chat.postMessage, conversation membership, and OAuth scope behavior.

Workflow Builder is Slack's no-code environment for creating automated workflows directly within Slack. Authorized users can combine triggers, built-in actions, connector actions, forms, conditional logic, and other workflow steps to automate repeatable business processes without implementing a complete custom application. Slack describes Workflow Builder as a no-code way to build workflows in which users combine supported steps and triggers to create automations. Developers can extend these workflows by supplying custom workflow steps when business logic exceeds the built-in capabilities. Workflow Builder is not primarily an app-manifest editor, a Bolt compilation environment, or an OAuth-token management interface. Those responsibilities belong to Slack app configuration, development tooling, and authentication mechanisms respectively. Consequently, B accurately captures the principal role of Workflow Builder within Slack's automation architecture.

Applications published in the Slack Marketplace must meet Slack's formal listing and review requirements. These requirements extend beyond functional API behavior and cover presentation, privacy, support, security, and overall user experience. Slack requires Marketplace listings to include high-quality visual presentation, including a recognizable, high-resolution application icon. The listing must also provide descriptive information explaining what the application does, which problems it solves, and how users interact with it inside Slack. Slack's current Marketplace guidelines separately define both short and long descriptions. Most importantly, Marketplace applications must provide a clearly accessible privacy policy explaining how third-party data is collected, used, retained, transferred, or deleted and how users can make privacy-related requests. A private single-workspace application does not undergo Slack Marketplace listing review. Merely implementing bot functionality does not trigger these listing requirements either. An unlisted publicly distributed app can be installed across workspaces using OAuth, but it is not automatically subject to the complete Marketplace listing presentation process. The original question uses the older term Slack App Directory. Slack's current official terminology is Slack Marketplace. This belongs to Distribute Your App, specifically Marketplace submission and listing requirements.

application/json is the appropriate Content-Type because Slack webhook-triggered workflows consume structured JSON payloads. When configuring a webhook workflow, Slack allows the workflow creator to define input variables and generates a request body containing corresponding JSON key-value pairs. The external application sends an HTTP POST request to the generated hooks.slack.com/triggers/... endpoint with values matching those defined inputs. JSON is the correct representation because it allows Slack to deserialize individual workflow variables predictably. Slack's webhook-related developer examples likewise show HTTP POST operations with Content-Type: application/json and a JSON body. multipart/form-data is normally appropriate for multipart uploads, not this trigger payload. text/plain would not provide the structured object Slack expects. application/x-www-form-urlencoded is associated with traditional form encoding and some older HTTP integrations, but it is not the format prescribed for the Workflow Builder webhook payload described here. The webhook URL itself must also be protected because possession of the URL can allow an external party to trigger the workflow. This maps directly to Design Your Workflows: Spotlight on Slack's APIs, specifically webhook-triggered workflow automation.

The Slack CLI is Slack's official command-line development tool for creating, running, and managing Slack app projects. It supports the standard local development workflow used in Slack's current quickstarts, including creating a project from a template, authenticating with a development workspace, running the app locally, and opening app configuration. The command-line workflow is integrated with supported Slack SDKs and Bolt starter projects, so developers can move from scaffolding to testing without manually assembling the entire project structure. The alternatives listed are not Slack's official app-development command-line tool: there is no standard npm create-slack or pip slack-init workflow, and Bolt Studio is not the CLI product. Therefore, A correctly identifies Slack CLI as the official tool for command-line app development.

Slack identifies rate-limit exhaustion through the HTTP status code 429 Too Many Requests. When this occurs, the response includes a Retry-After header containing the number of seconds the application must wait before retrying the rate-limited operation. Slack applies Web API limits primarily on a per-method, per-workspace basis. Consequently, reaching the limit for conversations.list does not necessarily mean that every Web API method for the same workspace has become unavailable. Applications should read Retry-After, wait for the indicated interval, and retry responsibly rather than immediately issuing more requests. Pagination is also important. Slack explicitly notes that methods supporting cursor-based pagination may receive stricter rate treatment when an application attempts to retrieve extensive datasets without using pagination appropriately. A growing workspace therefore makes efficient pagination and caching increasingly important. HTTP 500 generally indicates a server-side failure rather than rate limiting. HTTP 200 can contain method-level errors or warnings but is not Slack's rate-limit signal. A Timeout header is not the prescribed rate-limit response mechanism. This is a core Design for Scale concept: applications must handle API limits predictably as data volume and workspace size increase.

A Slack application created for use exclusively inside its associated workspace does not need public distribution or a multi-workspace OAuth installation architecture. Slack classifies such an application as an undistributed or single-workspace app. It can be installed directly into its associated development workspace through the app-management configuration. Because the IT manager needs access to the app's configuration, adding that person as an application collaborator provides the appropriate administrative access. The collaborator can then install the application to the Business Operations workspace through the app dashboard. Option A unnecessarily enables distribution to other workspaces. Once public distribution is activated, Slack provides a shareable installation URL intended for multi-workspace installations. Option C similarly introduces OAuth infrastructure that is required when distributing an application beyond its associated workspace but is unnecessary for this internal single-workspace scenario. Option D is even broader because Slack Marketplace publication is intended for externally distributed applications that have completed Slack's review process. Slack's current lifecycle documentation confirms that newly created apps reside in an associated workspace and can be installed there directly without building a separate authorization flow. This belongs to Distribute Your App, particularly understanding single-workspace versus distributed application models.

Slack's current Agent quickstart guides developers through creating an AI-powered Slack agent. The official quickstart uses a sample support agent named Casey and demonstrates building the application with the Slack CLI and Bolt frameworks while integrating supported AI agent frameworks such as the Claude Agent SDK, OpenAI Agents SDK, or Pydantic AI. The resulting agent can interact through direct messages, app mentions, App Home, modals, reactions, and threaded responses. Developers begin by installing the Slack CLI, authenticating with a workspace, and creating the agent project using the provided sample template. This is application-development guidance for Slack's AI agent platform, not billing, workspace theming, or Block Kit Builder extensions. Therefore, B precisely matches the purpose of the Agent quickstart.

The Events API enables Slack applications to react to activities occurring within Slack. An application subscribes to specific event types, and Slack delivers corresponding event payloads when those activities occur. Examples include messages being posted, reactions being added, members joining channels, files being created, and application mentions. The events available to an application are constrained by its OAuth scopes and the conversations or resources it is authorized to access. Slack can deliver Events API payloads through a public HTTP Request URL or through Socket Mode. After receiving an event, the application typically acknowledges delivery and asynchronously performs any associated business logic, such as calling `chat.postMessage`. The Events API does not manage billing, construct Block Kit layouts, or configure OAuth permissions. Therefore, B correctly describes its primary function.

A Slack modal is a temporary focused interface displayed over the current Slack experience. Slack describes modals as alert boxes, pop-ups, or dialog boxes that capture and maintain user focus until the modal is submitted or dismissed. Applications commonly use modals for structured forms, configuration tasks, data entry, confirmation flows, and detailed information that would otherwise clutter a message or Home tab. Modal views are built using Block Kit and can contain input elements, select menus, buttons, text, and other supported components. Applications normally open them through `views.open` using a recently generated `trigger_id`. Channels and workspaces are persistent Slack organizational structures, while workflow triggers begin automations rather than rendering focused pop-up interfaces. Therefore, A is correct.

A distributed Slack app uses the OAuth 2.0 authorization-code flow to obtain authorization for each installation. The process begins by redirecting the installing user to Slack's authorization endpoint: https://slack.com/oauth/v2/authorize. The authorization request contains the application's Client ID together with the permissions being requested. Bot scopes are supplied using the scope parameter, while user scopes can be supplied through user_scope. The application's Client Secret must not be exposed in the browser-facing authorization request. After the user approves installation, Slack sends a temporary authorization code to the application's configured redirect URI. The backend then securely combines that temporary code with the application's client credentials when calling oauth.v2.access to exchange the code for access credentials. This distinction invalidates A and B because oauth.v2.access is the backend token-exchange API endpoint, not the user-facing authorization endpoint. D is incorrect because it would expose the Client Secret in a user redirect, violating OAuth security architecture. This question maps directly to Distribute Your App, particularly multi-workspace distribution, OAuth installation flows, requested scopes, and secure handling of Slack application credentials.

Slack modals support a view stack containing up to three views, while only one view is displayed to the user at any particular moment. Applications can push new views onto the stack, update existing views, and allow users to return to prior views with their state preserved. This makes D correct and directly makes C incorrect. The App Home Home tab is also an application-controlled surface. An app composes its Home view using Block Kit and publishes that view with views.publish. The application can subsequently republish the Home view as application data changes, enabling personalized dashboards, summaries, settings, workflow entry points, and other persistent experiences. Therefore, E is correct and A is false. Block Kit applies to both modals and Home tabs, so B is incorrect. The distinction between these surfaces is architectural: a modal is focused and transient, suited to completing a defined task, whereas App Home is persistent and suited to information users revisit. This question therefore maps to Design the Interactive Flow of Your App, particularly Slack surfaces, modal view-stack behavior, Block Kit composition, and dynamic Home-tab publishing.

Slack Developer Tools is specifically designed to provide Slack-platform development assistance directly inside Slack. Its capabilities include inspecting existing Slack messages to understand how those messages were constructed and accessing Slack method documentation without leaving the workspace. The official Slack Developer Tools listing describes an Inspect action available from a message's menu. Developers can use it to examine the underlying structure of a message, making it useful for understanding Block Kit layouts and message payload composition. The tool also provides the /sdt docs [method name] command, which retrieves documentation and implementation information for Slack API methods. Postman is useful for constructing and testing HTTP requests against Slack's Web API, but it does not provide the same Slack-native message inspection function. Browser developer tools inspect browser-side behavior and network activity rather than Slack message structures as a dedicated platform feature. The Slack CLI provides significant development, deployment, and application-management functionality, but the option's claimed built-in debugger is not the specific tool described for this requirement. Therefore, A remains correct. This directly maps to the Tools objective of the Slack Developer curriculum.

Slack requires a valid trigger_id when an application opens a modal through views.open. A trigger_id is generated in response to an explicit user interaction, including a global shortcut, slash command, button interaction, or supported interactive component. This requirement ensures that an application cannot arbitrarily display modal interfaces without recent user intent. When the user invokes the “Request Changes” global shortcut, Slack sends an interaction payload to the application. The application must acknowledge that request and use the contained trigger_id when calling views.open. Slack currently specifies that a trigger_id expires approximately three seconds after it is issued, so the application must use it promptly. A response_url is used to send follow-up responses for certain interactive requests and slash commands rather than to authorize modal opening. A callback_id is an application-defined identifier used to identify interaction flows in older or specific payload contexts. The payload's verification token is likewise not a modal-opening credential. Therefore, D is correct. This is a core Design the Interactive Flow of Your App concept involving shortcuts, interaction payloads, modal invocation, and views.open.

Slack shortcuts provide explicit entry points that users can invoke to start application functionality. Slack supports two principal shortcut types: global shortcuts and message shortcuts. Global shortcuts can initiate functionality without requiring an existing message context, while message shortcuts are attached to individual messages and appear in the message context menu. When a shortcut is invoked, Slack sends an interaction payload to the application containing contextual information and a `trigger_id`, which can be used to open a modal or continue another interactive flow. Webhooks are message-delivery mechanisms rather than user action entry points. OAuth scopes define permissions, while manifests describe application configuration. Consequently, Shortcuts is the Slack feature specifically designed to let users invoke application actions from Slack UI locations.

Slack's app approval and app-management controls allow administrators to govern application installation and usage. Workspace Owners can enable app approval, pre-approve applications, restrict applications, and determine whether members can request unapproved apps. In Enterprise organizations, Org Owners can establish organization-level app-management policies that enable app approval across workspaces and control which applications may be installed or used. Enterprise administrative interfaces also support approving, restricting, installing, and distributing apps across selected workspaces. Block Kit Builder is a UI-design utility, Socket Mode is an event-delivery mechanism, and the Events API delivers Slack activity notifications; none of those features governs app installation policy. Therefore, option A is the correct administrative control for determining which applications users are allowed to install or request within managed Slack environments.

The `slack run` command starts a Slack app in the local development environment and supports the install-and-test workflow against a selected workspace. Slack CLI uses the project's configuration to run the application locally, and current development tooling can watch supported source files and restart the running process when code changes. This enables an iterative development cycle in which the developer edits code, runs or reloads the local app, and immediately tests behavior inside Slack. `slack deploy` serves a different lifecycle purpose for supported hosted applications, while `slack start` and `slack serve` are not the standard commands documented for this workflow. Consequently, B is correct: `slack run` is the command Slack's quickstarts use to run the application locally and make it available for live workspace testing.

Slack's current Marketplace review policy explicitly requires applications to request only scopes associated with functionality that reviewers can currently test. Developers should not request access for speculative or future features. Because the feature requiring files:read does not yet exist, the application should omit that scope from the present submission. Once the feature has been implemented and can be demonstrated to Slack reviewers, the developer should update the requested OAuth permissions and submit the modified application for review again. That makes C correct. Option B is incorrect because adding a materially new scope to a published Marketplace application cannot simply bypass review. Slack reviews both application functionality and the permissions required to implement it. Options A and D violate least privilege by requesting access before any production feature requires it. This is particularly important for files:read, which Slack currently classifies among scopes that can provide substantial access to workspace data and may therefore trigger enhanced review. The older term App Directory in the source question corresponds to today's Slack Marketplace. This belongs to Distribute Your App, with a strong relationship to security through scope minimization and Marketplace review governance.

The immediate security priority after loss or theft of an authenticated device is to invalidate the compromised Slack sessions. Slack provides the Admin API method admin.users.session.reset specifically for this purpose. Current documentation states that the method wipes all valid Slack sessions on all devices for the specified user. This provides immediate containment by forcing the user to authenticate again rather than allowing a potentially unauthorized person holding the device to continue using an existing authenticated Slack session. The Audit Logs API can subsequently support investigation by identifying suspicious authentication or administrative activity, but merely monitoring events does not terminate the attacker's access. SCIM de-provisioning is too disruptive as the first response because the employee remains a legitimate member of the organization; the security problem is the compromised device/session rather than employment status. The Discovery API is intended for security/compliance integrations involving organizational content and is not the primary incident-containment mechanism. The applicable Admin API method requires the admin.users:write user-token scope and is available for Enterprise environments. Therefore, D provides the quickest and most proportionate first response. This belongs to APIs for Managing Your Slack, specifically Enterprise session administration and security incident response.

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.

A modal is a focused application surface that appears over the Slack interface and maintains the user's attention until it is submitted or dismissed. Slack describes modals as alert boxes, pop-ups, or dialog-style interfaces used for focused interactions. Applications commonly use them to collect structured information, present temporary details, configure settings, or guide a user through a task. Modal content is constructed using Block Kit blocks and interactive elements, including text inputs, select menus, buttons, and date pickers. Modals are typically opened after an explicit user interaction by calling `views.open` with a valid `trigger_id`. They are not scheduled background processes, authentication tokens, or organization-wide announcement mechanisms. Therefore, option B accurately describes the purpose and presentation model of a Slack modal.

Slack locale information is explicitly opt-in at the API-request level. For a conversation, an application can call conversations.info and set include_locale=true. For an individual member, it can call users.info with the same parameter. Slack then includes the applicable locale field in the returned object. The locale is represented using an IETF language identifier such as en-US or another supported language-region combination. Slack's design guidance recommends using a conversation's locale for content published publicly within that conversation and using the individual user's locale for private or personalized interactions. Option C is incorrect because locale is not included automatically by default. The application must explicitly request it. Option A incorrectly treats locale retrieval as an app-dashboard configuration toggle rather than a Web API argument. Option D refers to API methods that do not exist; Slack uses established methods such as users.info and conversations.info. Applications should also retrieve current locale information when preparing content rather than permanently assuming a user's language preference, because those preferences may change. This directly aligns with Design a Great User Experience, particularly internationalization and localization of Slack application content.

Block Kit Builder is Slack's official visual prototyping environment for designing and previewing Block Kit interfaces. Developers can use it to assemble blocks, configure their properties, rearrange components, inspect the resulting structured payload, and preview how the interface will appear within supported Slack surfaces. Slack's Block Kit documentation specifically recommends using Block Kit Builder to experiment with available blocks before incorporating the generated structures into an application. This is especially useful when designing complex messages, modals, and Home tabs because developers can validate visual hierarchy and component compatibility interactively rather than repeatedly modifying application code. Slack Studio, Bolt Designer, and Surface Editor are not the official Block Kit prototyping tools described in Slack Developer documentation. Consequently, option A is the only answer that corresponds to Slack's documented visual interface-development tooling.

Slack specifically recommends testing applications in an Enterprise organization sandbox because Enterprise environments introduce behaviors that cannot always be reproduced accurately in a standalone workspace. Slack's Developer Program provides fully featured Enterprise organization sandboxes specifically for development and testing. Applications must also account for workspace migration periods. During migration into an Enterprise organization, Web API and other platform interactions may temporarily become unavailable. Slack provides the grid_migration_started and grid_migration_finished Events API events so applications can detect this lifecycle transition. Official guidance recommends pausing relevant API/platform activity when migration begins and resuming it after migration finishes. Discarding an existing application is unnecessary because ordinary Slack applications can be adapted for Enterprise behavior. Polling channel IDs is not an appropriate migration strategy. Likewise, reinstalling applications solely to obtain new access tokens is not the fundamental requirement when a workspace becomes part of an Enterprise organization. The critical architectural principle is to test Enterprise-specific behavior and implement migration-aware event handling instead of assuming a standalone-workspace environment will remain stable throughout migration. This directly addresses Design for Scale, especially Enterprise organizations, migration resilience, and testing applications under Enterprise-specific conditions.