PagerDuty Foundational Practitioner study materials

PagerDuty Foundational Practitioner practice questions

One question at a time. Build your PagerDuty Foundational Practitioner understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident Management

In PagerDuty, what is the primary purpose of an escalation policy?

To store the runbook links attached to a service
To configure the email templates sent to stakeholders
To define the ordered set of users or schedules notified as an incident progresses Correct answer.
To group services into business services for reporting

Explanation

An escalation policy defines who is notified and in what order, moving through escalation levels until someone acknowledges the incident. It is attached to services and determines the on-call routing behavior. Runbooks, stakeholder emails, and reporting groupings are separate configuration objects.

Question 2Incident Management

An incident has been triggered on a service. Which statement best describes what happens at the first escalation level if no one acknowledges?

The incident is automatically resolved after the acknowledgement timeout
All responders are removed and the incident is closed
The policy escalates to the next level and notifies those targets Correct answer.
The incident is reassigned to the account owner permanently

Explanation

Each escalation level has a timeout; if the incident is not acknowledged within it, PagerDuty advances to the next escalation level and notifies its targets. Escalation continues until the final level is reached or the incident is acknowledged. Incidents are never auto-resolved by escalation alone.

Question 3Incident Management

What does acknowledging an incident in PagerDuty signify to the rest of the response team?

That the escalation policy has been permanently disabled
That the underlying problem has been fully resolved
That the incident should be suppressed from all future alerts
That a responder has taken ownership and is working on it Correct answer.

Explanation

Acknowledging signals that someone has seen the alert and taken ownership, which stops further escalation for that incident. It does not mean the issue is fixed; resolution is a separate action. Suppression and policy changes are unrelated to acknowledgement.

Question 4Incident Management

Which incident status indicates that the issue has been addressed and the incident no longer needs active work?

Escalated
Triggered
Acknowledged
Resolved Correct answer.

Explanation

Resolved is the terminal status meaning the incident has been addressed and closed out. Triggered means it is newly created and unacknowledged, and acknowledged means a responder has taken ownership. Escalated describes a routing event, not a status.

Question 5Incident Management

What is the role of a service in PagerDuty incident management?

It is a log aggregation pipeline for storing event data
It represents a distinct component or functionality that can have incidents and an assigned escalation policy Correct answer.
It is a user account with administrative privileges
It is a billing construct used to allocate costs across teams

Explanation

A service models a discrete piece of functionality or infrastructure that can experience incidents. Each service is linked to an escalation policy that determines who is notified. Services are not user accounts, billing constructs, or log pipelines.

Question 6Incident Management

A team wants the same person notified at multiple steps within one escalation level. What is the recommended approach?

Add the user to each escalation level separately with duplicate entries
Create a separate escalation policy for each duplicate notification
Add the user once to the level and rely on the level's single notification
Use a schedule that contains only that user and add it to the level Correct answer.

Explanation

To notify the same person multiple times within a level, you add a schedule containing that user rather than duplicating the user. PagerDuty deduplicates identical targets within a level. Creating extra policies or duplicate user entries does not achieve repeated notification.

Question 7Incident Management

An on-call schedule is configured with a daily rotation. A responder wants to swap a shift with a colleague. What is the most appropriate PagerDuty feature?

Using an override on the schedule for the specific time range Correct answer.
Changing the service's urgency setting
Deleting and recreating the schedule with new members
Editing the escalation policy to add the colleague temporarily

Explanation

Schedule overrides let you assign a specific user to a time range without altering the underlying rotation. This preserves the regular schedule while covering the swap. Editing policies, recreating schedules, or changing urgency are disruptive and do not target the shift.

Question 8Incident Management

What determines the order in which responders are notified when an incident triggers on a service?

The number of incidents previously handled by each user
The escalation policy attached to the service Correct answer.
The alphabetical order of user last names
The time zone configured on each user profile

Explanation

The escalation policy attached to the service defines the sequence of targets and timeouts. Notification order follows the policy's escalation levels, not user attributes. Names, historical counts, and time zones do not drive routing order.

Question 9Incident Management

A service is configured to create a high-urgency incident. Which responder behavior is expected from high-urgency notifications?

Notifications are suppressed until the next escalation level
Notifications are delivered only during business hours
Notifications are batched into a daily digest
Notifications are delivered immediately through configured channels such as push and phone Correct answer.

Explanation

High-urgency incidents are intended to interrupt responders and are delivered promptly through configured contact methods. They are not restricted to business hours or batched. Suppression is not the default behavior for high urgency.

Question 10Incident Management

Which action best describes resolving an incident that was caused by a transient network blip and requires no further work?

Merge the incident into an unrelated open incident
Acknowledge the incident and leave it open indefinitely
Resolve the incident with a brief note describing the cause Correct answer.
Escalate the incident to the next level for visibility

Explanation

When no further action is needed, resolving the incident with a short note preserves context for post-incident review. Acknowledging without resolving leaves it open and can clutter active incident views. Escalation and merging are inappropriate for a self-clearing blip.

Question 11Incident Management

What is the purpose of a maintenance window on a service?

To convert all incidents into low-urgency incidents
To permanently disable the service's escalation policy
To archive resolved incidents for compliance
To temporarily suppress incident creation during planned work Correct answer.

Explanation

A maintenance window suppresses alerts and incident creation for a defined period during planned work. It is temporary and does not alter the escalation policy permanently. It also does not change urgency or archive historical incidents.

Question 12Incident Management

A responder is on a schedule but has not received any notifications. Which configuration is most likely the cause?

The user has no contact method configured or the notification rule does not match the incident urgency Correct answer.
The user's schedule rotation length is one week
The escalation policy has more than one level
The service has too few incidents in its history

Explanation

Notifications require a valid contact method and a notification rule that matches the incident's urgency and any other conditions. Without a matching rule or contact method, the responder receives nothing. Rotation length, policy level count, and incident history do not block notification delivery.

Question 13Incident Management

An incident is triggered on a service whose escalation policy has three levels. Level one targets a schedule, level two targets a user, and level three targets a manager. No one acknowledges. What happens after the level three timeout?

The service is disabled until acknowledged
Escalation stops because the final level has been reached Correct answer.
The incident is automatically resolved
The policy loops back to level one and repeats indefinitely

Explanation

Escalation advances through levels until the final level is reached; after the last level's timeout, no further escalation targets exist, so escalation stops. The policy does not loop automatically. Incidents are not auto-resolved and services are not disabled by escalation.

Question 14Incident Management

A team wants incidents from a low-priority service to notify only during business hours, while a critical service must page at any time. Which configuration best achieves this?

Disable notifications for the low-priority service entirely
Assign different escalation policies and notification rules aligned to each service's urgency and coverage Correct answer.
Use the same escalation policy for both services to simplify management
Set both services to high urgency and rely on responders to triage

Explanation

Different escalation policies combined with notification rules let each service route and notify according to its needs. A shared policy cannot express different coverage requirements. Disabling notifications loses visibility, and forcing both to high urgency defeats prioritization.

Question 15Incident Management

What is the effect of setting an incident's urgency to low on notification behavior?

It forces phone calls to every responder
It prevents the incident from being resolved
It follows notification rules configured for low urgency, which often use fewer channels Correct answer.
It bypasses all escalation policies

Explanation

Low urgency incidents follow notification rules designated for low urgency, which commonly use fewer or less intrusive channels. Urgency does not bypass escalation policies or force phone calls. It also has no effect on the ability to resolve an incident.

Question 16Incident Management

Which PagerDuty concept allows multiple related incidents to be combined so responders work from a single record?

Reassigning incidents
Merging incidents Correct answer.
Snoozing incidents
Suppressing incidents

Explanation

Merging combines related incidents into one so responders coordinate from a single incident record. Suppression hides alerts, snoozing delays notifications, and reassignment changes ownership. Only merging consolidates incidents into one.

Question 17Incident Management

A responder needs to temporarily stop notifications for an incident they are actively investigating without resolving it. Which action is most appropriate?

Change the service to low urgency
Resolve the incident
Snooze the incident for a defined period Correct answer.
Delete the escalation policy

Explanation

Snoozing pauses notifications for a set period while keeping the incident open and owned. Resolving would falsely close the incident, and deleting the policy or changing urgency affects broader configuration. Snooze is the targeted, reversible action.

Question 18Incident Management

What does the incident timeline primarily capture?

The configuration history of escalation policies
A chronological record of actions and events on the incident Correct answer.
The list of all users in the account
The billing history for the service

Explanation

The incident timeline records chronological events such as triggers, acknowledgements, notes, escalations, and resolutions. This supports coordination and later review. Billing, account user lists, and policy configuration history are separate records.

Question 19Incident Management

During a major incident, a responder adds a note to the incident. What is the main benefit?

It documents findings and actions for other responders and later review Correct answer.
It automatically resolves the incident
It changes the escalation policy for future incidents
It permanently deletes related alerts

Explanation

Notes capture findings and actions so other responders have shared context and post-incident review has a record. Notes do not resolve incidents, modify escalation policies, or delete alerts. They are informational entries on the incident.

Question 20Incident Management

A service receives a flood of duplicate alerts from the same underlying failure. Which PagerDuty behavior helps reduce noise?

Increasing the number of escalation levels
Shortening the schedule rotation
Alert grouping or deduplication based on the integration's dedup key Correct answer.
Adding more users to each escalation level

Explanation

Deduplication uses a dedup key so repeated events from the same source update an existing alert rather than creating new ones, and grouping consolidates related alerts. More escalation levels, more users, or shorter rotations do not reduce duplicate alert volume.

Question 21Incident Management

What is the function of an on-call schedule in PagerDuty?

To determine the severity of incoming alerts
To manage billing for the account
To define which users are responsible for responding during specific time periods Correct answer.
To store the runbook for each service

Explanation

A schedule assigns responsibility for response across time periods through rotations and layers. Escalation policies reference schedules to know whom to notify. Schedules do not store runbooks, determine severity, or handle billing.

Question 22Incident Management

An escalation policy level targets a schedule with a one-hour timeout. The schedule has no one on call at the moment the incident triggers. What is the most likely outcome?

The level's timeout elapses and escalation proceeds to the next level Correct answer.
The schedule automatically assigns a random user
The incident is immediately resolved
The incident is moved to a different service

Explanation

If no one is on call for a targeted schedule, no notification is delivered to that target, and after the level timeout escalation proceeds to the next level. PagerDuty does not resolve the incident, assign a random user, or move it to another service in this scenario.

Question 23Incident Management

Which statement accurately describes the relationship between services and escalation policies?

A service can have no escalation policy and still route incidents
Escalation policies are assigned per user rather than per service
An escalation policy can only exist without any services
A service references one escalation policy that governs its incident routing Correct answer.

Explanation

Each service is associated with an escalation policy that determines routing for its incidents. An escalation policy is a reusable object that can serve multiple services. Services require a policy to route incidents, and policies are not assigned per user.

Question 24Incident Management

What is the recommended first step when an on-call responder receives a high-urgency page for an unfamiliar service?

Acknowledge the incident and begin following the service's runbook or documentation Correct answer.
Immediately resolve the incident to stop notifications
Ignore the page until the next escalation level
Disable the service's integration

Explanation

Acknowledging stops further escalation and signals ownership, then the responder follows the runbook or documentation to investigate. Ignoring the page, resolving prematurely, or disabling the integration are unsafe or disruptive actions.

Question 25Incident Management

A team wants a secondary layer of responders to be notified only if the primary on-call does not respond. Which configuration supports this?

Setting the service to low urgency
Shortening the primary schedule rotation
A second escalation level targeting the secondary responders Correct answer.
Adding secondary responders to the same level as the primary

Explanation

Placing secondary responders at a later escalation level ensures they are notified only after the primary level times out without acknowledgement. Adding them to the same level notifies everyone simultaneously. Urgency and rotation length do not create conditional notification.

Question 26Incident Management

In PagerDuty, which incident state indicates that a responder has seen the incident and is actively working to restore service?

Suppressed
Acknowledged Correct answer.
Resolved
Triggered

Explanation

An incident moves from Triggered to Acknowledged when a responder takes ownership of it, signalling that someone is actively working on it. Resolution is a later, separate step that records restoration of service. Triggered simply means the incident fired and notifications are in progress.

Question 27Incident Management

A service is set to high urgency and its escalation policy level one targets a user directly rather than a schedule. What happens when an incident triggers on that service?

The targeted user is paged immediately at that level regardless of who is on call. Correct answer.
The incident is held until the user acknowledges a low-urgency notification.
The escalation policy is skipped and the incident is auto-resolved.
The on-call rotation for that user's team is paged first, then the user.

Explanation

Targeting a user directly at an escalation level pages that named user when the level is reached, independent of any schedule. Schedules only matter when a level targets a schedule. High urgency affects notification channels and retry behavior, not the routing target.

Question 28Incident Management

Which statement best describes the purpose of an incident's priority field in PagerDuty?

It communicates business impact so responders can triage and sequence work. Correct answer.
It determines which integration key is allowed to open the incident.
It sets the maximum number of times the escalation policy will repeat.
It controls the length of the on-call shift for the assigned responder.

Explanation

Priority is a triage signal that conveys business impact and helps responders decide ordering and communication. It does not change routing, notification retries, or schedule lengths. Escalation repetition is configured in the escalation policy itself.

Question 29Incident Management

During an active incident, a responder wants to record that the database failover completed at 14:32. Which PagerDuty action preserves this for the post-incident review?

Change the incident urgency to low so the event is logged.
Resolve the incident and reopen it to capture the timestamp.
Reassign the incident to another responder to create an audit entry.
Add a note to the incident so it is timestamped on the incident timeline. Correct answer.

Explanation

Notes are timestamped entries on the incident timeline and are the standard way to capture investigation milestones for later review. Changing urgency, reassigning, or resolving do not document the event itself. The timeline is the authoritative record used during retrospectives.

Question 30Incident Management

An incident is triggered and level one of the escalation policy targets a schedule with a 30-minute timeout. No responder acknowledges within 30 minutes. What occurs next?

The incident is automatically resolved and the timeline is closed.
The same level-one schedule is paged again indefinitely.
The incident urgency is downgraded and notifications stop.
The incident escalates to level two and its targets are notified. Correct answer.

Explanation

When a level's timeout elapses without acknowledgement, the escalation policy advances to the next level and notifies its targets. This continues until someone acknowledges or the policy's final level is exhausted. Auto-resolution and indefinite re-paging are not the default escalation behavior.

Question 31Incident Management

A responder is assigned to an incident but the incident is currently in the Triggered state. Which statement is accurate about that responder's responsibility?

They should acknowledge the incident to signal ownership and stop further escalation. Correct answer.
They are required to reassign the incident to a manager first.
They must resolve the incident before any other responder can view it.
They should wait for the escalation policy to page them at level two.

Explanation

Acknowledging is the action that takes ownership and halts escalation to higher levels. Assigned responders are expected to acknowledge promptly when they begin work. Resolution comes after mitigation, and reassignment is optional rather than mandatory.

Question 32Incident Management

A service's escalation policy has a single level with no timeout configured. A responder acknowledges an incident and then goes offline without resolving it. What is the most likely outcome?

The incident escalates to an implicit secondary level after one hour.
The incident automatically re-triggers and pages the same responder again.
The incident is resolved automatically once the responder goes offline.
The incident stays acknowledged with no further escalation until someone resolves or reassigns it. Correct answer.

Explanation

Once acknowledged, escalation stops, and with only one level and no timeout there is no further path to notify anyone else. The incident remains acknowledged until a responder resolves or reassigns it. PagerDuty does not invent implicit escalation levels or auto-resolve acknowledged incidents.

Question 33Incident Management

Two services, one critical and one internal tool, share the same escalation policy. The team wants the critical service to notify more aggressively. Which approach respects PagerDuty's configuration model?

Increase the number of incidents the internal tool can open per hour.
Set the critical service's urgency to high and leave the shared policy unchanged.
Create a separate escalation policy with shorter timeouts and more levels for the critical service. Correct answer.
Add the internal tool's on-call schedule as an extra level in the shared policy.

Explanation

Notification aggressiveness is governed by the escalation policy attached to a service, so differing needs call for distinct policies. Urgency influences notification channels but does not change timeouts or level structure. Adding unrelated schedules would page the wrong people.

Question 34Incident Management

A responder wants to hand an active incident to a teammate who will take over investigation. Which action correctly transfers ownership in PagerDuty?

Add a note naming the teammate and take no other action.
Resolve the incident so the teammate can open a new one.
Change the incident priority to reflect the new owner.
Reassign the incident to the teammate, who then acknowledges it. Correct answer.

Explanation

Reassignment changes the assigned responder, and the new assignee acknowledges to confirm ownership. This keeps a single incident record and preserves the timeline. Notes alone do not transfer responsibility, and resolving would fragment the record.

Question 35Incident Management

A monitoring integration sends a second alert for the same failure after an incident already exists on the service. What is the default effect on the existing incident?

A brand-new incident is always created alongside the original.
The new alert is appended to the existing incident, incrementing its alert count. Correct answer.
The alert is discarded and never recorded.
The existing incident is automatically resolved and replaced.

Explanation

When a subsequent event matches an open incident on the same service, PagerDuty associates it with that incident and increments the alert count rather than opening duplicates. This keeps responders working from one record. Duplicate incidents, auto-resolution, and silent discard are not the default.

Question 36Incident Management

An incident was triggered by a transient failure and service is confirmed healthy. A responder wants the incident closed with a clear record of the cause. Which action is most appropriate?

Reassign the incident to the integration that created it.
Resolve the incident and add a note describing the transient cause and verification steps. Correct answer.
Acknowledge the incident and leave it open for the next on-call shift.
Delete the incident so it does not skew reporting metrics.

Explanation

Resolving closes the incident, and a note captures the cause and verification so the timeline supports later analysis. Leaving it open misrepresents current service health and skews metrics. Deleting incidents removes valuable history.

Question 37Incident Management

A team's service pages the on-call responder for every minor warning, causing fatigue. Which PagerDuty capability most directly reduces the volume of low-value pages reaching responders?

Shortening the acknowledgement timeout at level one.
Increasing the number of escalation levels in the policy.
Configuring alert grouping and event rules so only actionable events open incidents. Correct answer.
Adding more responders to the on-call schedule.

Explanation

Event rules and alert grouping filter and consolidate incoming events so only actionable ones create incidents. This attacks the source of low-value pages. More levels, shorter timeouts, and larger schedules change who is paged and how fast, not how often.

Question 38Incident Management

A major incident affects several services, each with its own triggered incident. Responders want one place to coordinate. Which PagerDuty feature addresses this need?

Adding every responder to each incident's escalation policy.
Creating a maintenance window covering all affected services.
Raising the priority of each incident individually.
Merging the related incidents into a single major incident. Correct answer.

Explanation

Merging consolidates related incidents into one major incident so responders coordinate from a single record while the children remain linked. Maintenance windows suppress notifications rather than organize response. Priority changes and policy edits do not unify the work.

Question 39Incident Management

An escalation policy level targets a schedule whose rotation has a gap because the assigned user's shift ended and no one replaced them. What is the most reliable design change to prevent unacknowledged incidents?

Rely on the integration to retry the original event.
Add a second escalation level targeting a backup schedule or manager. Correct answer.
Convert the service to low urgency so fewer people are paged.
Remove the timeout from level one so the page repeats forever.

Explanation

A backup level ensures someone is notified when the primary schedule has no available responder. Removing the timeout only repeats the same unreachable target, and urgency changes do not fix coverage gaps. Integration retries resend events but do not reach new people.

Question 40Incident Management

A responder receives a page for a service they do not recognize and cannot identify the owning team. What is the most effective first action to protect service availability?

Acknowledge the incident, then use the service's escalation policy and on-call information to reach the owning team. Correct answer.
Ignore the page and let the escalation timeout notify someone else.
Resolve the incident immediately since the service is unfamiliar.
Disable notifications for the service until ownership is clarified.

Explanation

Acknowledging stops escalation and signals ownership while the responder investigates. The service and escalation policy reveal the owning team and on-call contacts, enabling a fast handoff. Ignoring, resolving, or disabling notifications risks an unhandled outage.

Question 41Signal Intelligence

In PagerDuty, what is the primary purpose of a Service?

To bill each team for the incidents they resolve
To represent a functional component that signals can be routed to and that groups related incidents Correct answer.
To define an on-call rotation schedule for responders
To store runbook documentation for the organization

Explanation

A Service is the central object that represents a functional component of your system, such as an application or microservice. Events and integrations are attached to a Service, and incidents raised against it are grouped and routed there. Schedules and escalation policies operate on responders rather than defining the Service itself.

Question 42Signal Intelligence

An integration key (routing key) on a PagerDuty Service is used for which purpose?

Encrypting incident notes stored in the PagerDuty database
Authenticating the PagerDuty mobile app when a responder logs in
Authorizing an external monitoring tool to trigger events into that Service Correct answer.
Signing the escalation policy so it cannot be edited

Explanation

Each Events API v2 integration on a Service generates a routing key that identifies the target Service when an event is sent. Monitoring tools include this key so PagerDuty knows which Service should receive the alert. It is an event-routing identifier, not a user login credential or encryption artifact.

Question 43Signal Intelligence

Which PagerDuty feature transforms raw monitoring alerts into deduplicated incidents?

Event Orchestration
Status Dashboard
Alert Grouping Correct answer.
Postmortem Reports

Explanation

Alert Grouping combines related alerts on a Service into a single incident, reducing noise from flapping or multi-host failures. Event Orchestration routes and enriches events but does not itself perform the grouping behavior described. Status Dashboards and Postmortems are reporting features rather than alert consolidation.

Question 44Signal Intelligence

What does an escalation policy define in PagerDuty?

The list of integrations enabled on a Service
The severity level that a monitoring tool must send for an incident to be created
The retention period for resolved incident logs
The order in which responders are notified and after what delay, until the incident is acknowledged Correct answer.

Explanation

An escalation policy is a set of escalation rules, each targeting a user or schedule with a defined escalation timeout. If the incident is not acknowledged within that timeout, the next rule fires and notifies the next target. Severity, log retention, and integrations are configured elsewhere.

Question 45Signal Intelligence

Which statement best describes the role of a Schedule in PagerDuty?

It defines the severity mapping for incoming alerts
It lists the runbooks attached to an incident
It specifies which responders are on call during defined time windows Correct answer.
It stores the routing rules that determine which Service receives an event

Explanation

A Schedule defines on-call coverage over time, typically using rotations and layers, so escalation policies know who should be notified. Routing rules belong to integrations and orchestration, and severity mapping is part of event processing. Runbooks are separate documentation attached to Services or incidents.

Question 46Signal Intelligence

A monitoring tool sends an event to the PagerDuty Events API v2 with a dedup_key. What behavior does the dedup_key enable?

It sets the incident priority automatically
It encrypts the event payload in transit
It lets subsequent events with the same key be correlated to the same incident Correct answer.
It determines which escalation policy is used

Explanation

The dedup_key is a unique identifier that PagerDuty uses to correlate events. Reusing the same key lets a later trigger, acknowledge, or resolve event apply to the previously created incident instead of opening a new one. It does not encrypt payloads or choose escalation policies.

Question 47Signal Intelligence

In PagerDuty, what is the function of a Maintenance Window?

It reassigns on-call duty to a backup schedule
It temporarily suppresses incident creation for selected Services during planned work Correct answer.
It permanently disables a Service from receiving any events
It archives resolved incidents older than a set number of days

Explanation

A Maintenance Window is a defined time range during which PagerDuty suppresses notifications and incident creation for the Services you select, typically for planned maintenance. It does not permanently disable a Service, and it has no effect on incident retention or on-call assignment.

Question 48Signal Intelligence

Which PagerDuty concept represents a single actionable problem that requires a responder's attention?

A Team
An Incident Correct answer.
A Service
An Integration

Explanation

An incident is the unit of work in PagerDuty: it is created from one or more alerts and is assigned, acknowledged, and resolved by responders. Services and integrations are configuration objects that feed incidents, and Teams group users and resources.

Question 49Signal Intelligence

A team wants alerts from a single noisy Service to be grouped only when they arrive within a short time window, without writing custom rules. Which approach fits best?

Enable time-based Alert Grouping on the Service Correct answer.
Create a separate Service for every host and disable alert grouping
Add every responder to the escalation policy twice
Convert the integration to a generic email integration

Explanation

Time-based Alert Grouping consolidates alerts that arrive within a configurable interval into one incident, which suits bursty or flapping noise without custom logic. Splitting into many Services would fragment incidents rather than group them, and duplicating responders or changing integration type does not address grouping.

Question 50Signal Intelligence

An engineer needs one Service to accept events from three different monitoring tools, each with its own routing key, while still producing incidents on the same Service. What should they configure?

One Event Orchestration rule per tool with no integration
Three integrations on the same Service, each providing its own integration key Correct answer.
One integration shared by all tools using the same key
Three separate Services, one per tool, each with its own escalation policy

Explanation

A Service can host multiple integrations, and each Events API integration issues its own routing key. Pointing all three tools at different integrations on the same Service keeps incidents consolidated on that Service. Separate Services would fragment the incidents, and orchestration rules still require an inbound integration to receive events.