Message shortcuts operate in the contextual action menu of an existing Slack message. Slack's official shortcut documentation specifies that message shortcuts appear in the context menus of non-ephemeral messages. Therefore, an ephemeral message cannot serve as the source message for a message shortcut, making B correct. This restriction follows from the underlying interaction model. Message shortcuts preserve context from the source message so an application can perform an action based on that message—for example, creating a ticket, escalating an incident, or sending content to an external system. Ephemeral messages have restricted visibility and lifecycle behavior and are excluded from this shortcut surface. Option D is incorrect because every shortcut invocation must be acknowledged promptly, regardless of how many shortcuts the app defines. Current Slack UX guidance requires shortcut requests to be acknowledged with an HTTP 200 response within three seconds. Option C is not a general rule; follow-up notification mechanics depend on the interaction payload and workflow. A's fixed limit of three message shortcuts is not the applicable platform rule represented here. This belongs to Design the Interactive Flow of Your App, particularly message shortcuts and contextual interactions.

When using the HTTP delivery model for the Events API, Slack sends subscribed events as HTTP POST requests containing JSON payloads to the application's configured Request URL. That URL must be a publicly reachable HTTPS endpoint capable of receiving and acknowledging Slack requests. Slack currently provides two event-delivery architectures: HTTP Request URLs and Socket Mode. Socket Mode replaces the public Request URL with a WebSocket connection, so the question's phrase “by default” is slightly imprecise under current documentation. Nevertheless, among the available options, A is unequivocally the intended and technically valid Events API delivery mechanism. Email, desktop notifications, and SMS are not mechanisms Slack uses to deliver application Events API payloads. Applications using HTTP should also verify Slack request signatures before processing the payload.

Among the supplied options, B is the intended answer because Slack's Web API is HTTP-based and Web API responses are JSON objects. Successful and failed responses contain a top-level Boolean `ok` property, together with method-specific fields or an `error` value. Many write methods also accept `application/json` request bodies. However, one technical correction is important: current Slack documentation explicitly states that the Web API is not a REST API. Slack describes it more precisely as a collection of HTTP RPC-style methods with endpoints such as `https://slack.com/api/METHOD_FAMILY.method`. Therefore, “REST with JSON” is not perfectly worded, but it is still the only defensible choice among A–D because SOAP/XML, GraphQL, and gRPC are incorrect. For current Slack terminology, “HTTP RPC-style methods with JSON responses” would be more precise.

Slack applications declare their requested OAuth permissions through application configuration. These permissions can be configured in the app settings under OAuth & Permissions or represented declaratively in an app manifest. Within a manifest, scopes reside under `oauth_config.scopes`, with separate fields for bot and user scopes. Slack's current platform also supports optional scopes through `bot_optional` and `user_optional`. The scopes determine what actions and data the application's tokens may access after authorization. Browser cookies do not define Slack app permissions, and the Slack CLI's local configuration is not the authoritative location for declaring the application's OAuth scope requirements. Scopes absolutely can—and normally should—be determined before installation so users and administrators can review the requested permissions during OAuth authorization. Therefore, A is correct.

A clear privacy policy is a mandatory requirement for applications listed in what Slack now calls the Slack Marketplace. Slack requires the application's public landing page to provide a clear link to that privacy policy. The policy must explain, at minimum, what third-party data is collected, how that information is used, how long it is retained, and how individuals can request access, transfer, or deletion of their information. It must also provide a means of contacting the service regarding data-related requests. Slack specifically notes that even applications that do not actively use certain received data may nevertheless receive identifiers or other information through platform payloads, and this handling must be disclosed. Bank-account information is not a universal Marketplace submission requirement. A security assessment or penetration-testing report may become relevant for certain applications or review circumstances but is not the general listing requirement represented here. Slack also does not require every Marketplace description to be translated into every supported language. Therefore, B is correct. This belongs to Distribute Your App, specifically Marketplace listing requirements, privacy governance, and public application documentation.

Workflow Builder is Slack's no-code environment for creating automated workflows directly within Slack. Authorized users can combine triggers, built-in actions, connector actions, forms, conditional logic, and other workflow steps to automate repeatable business processes without implementing a complete custom application. Slack describes Workflow Builder as a no-code way to build workflows in which users combine supported steps and triggers to create automations. Developers can extend these workflows by supplying custom workflow steps when business logic exceeds the built-in capabilities. Workflow Builder is not primarily an app-manifest editor, a Bolt compilation environment, or an OAuth-token management interface. Those responsibilities belong to Slack app configuration, development tooling, and authentication mechanisms respectively. Consequently, B accurately captures the principal role of Workflow Builder within Slack's automation architecture.

A Slack app manifest is a reusable, declarative representation of an application's configuration. Slack describes manifests as portable configurations that can define major application settings, including display information, features, OAuth scopes, event subscriptions, interactivity settings, and other platform capabilities. A manifest can be used to create, configure, copy, and reproduce Slack applications without manually re-entering every setting through the app-management interface. This is particularly useful for teams maintaining multiple environments or applications with similar configurations. Manifests can also be stored in source control so collaborators can review and track configuration changes alongside application code. They are unrelated to billing invoices, API error logs, or Slack user permission groups. Therefore, option B accurately captures both the declarative nature and primary purpose of a Slack app manifest.

App Home provides an application with a dedicated, private space for interacting with each individual Slack user. Slack defines App Home as a one-to-one space shared between a user and an app. Its Home tab is fully customizable using Block Kit and can contain dashboards, personalized information, application controls, workflow entry points, settings, and interactive components. Applications publish and update Home-tab content dynamically, allowing the surface to function as persistent application real estate rather than a transient interaction. A modal is temporary and focused, while slash commands are invocation mechanisms rather than persistent surfaces. Workflow steps are reusable automation components and likewise do not provide an app-specific sidebar destination. Therefore, App Home is the correct dedicated application surface represented by option A.

Interactive Block Kit components such as buttons generate interaction payloads when users activate them. Slack delivers the payload to the application through its configured interactivity request endpoint or through Socket Mode when that transport mechanism is enabled. The payload identifies the user, application, workspace, conversation context, and specific action through properties such as the component's `action_id`. The application should acknowledge the interaction promptly and can then perform business logic, update the original message, call a Web API method, or open another interface such as a modal. Clicking a button does not automatically delete its containing message or revoke the user's OAuth authorization. Slack also does not simply ignore a properly configured interactive action. Therefore, B accurately describes Slack's interactive-component processing architecture.

Slack AI agents are built on the core Slack application platform rather than an entirely isolated development system. Slack's agent documentation describes Slack as particularly suitable for agent experiences because it already provides a conversational environment, Block Kit interaction model, multiple application surfaces, identity, permissions, and contextual information. The official Agent quickstart demonstrates an agent using familiar Slack application mechanisms such as Bolt, App Home, modals, direct messages, app mentions, reactions, and threaded messaging. Developers can therefore combine AI reasoning and external model frameworks with established Slack primitives for events, messages, interfaces, authentication, and Web API actions. Agent functionality may introduce specialized capabilities and scopes, but it does not replace the underlying Slack platform. Agents can also post and stream responses. Consequently, B is the technically correct answer.