NIMS ICS 400 – Advanced Incident Command
System for Command and General Staff–Complex
Incidents Study Guide, Original Practice Questions
& Answers, ICS-400 Exam Preparation,
Comprehensive NIMS & Incident Management
Review, Command and General Staff, Unified
Command, Area Command, Multiagency
Coordination, Complex Incident Management,
Incident Action Planning, Resource Management,
Operational Periods, Strategic Objectives,
Emergency Operations Centers & Advanced Incident
Command
Question 1: Which of the following best describes the primary difference
between a Type 3 Incident Management Team (IMT) and a Type 1 IMT?
A. Type 1 IMTs are pre-designated regional or national teams, while Type 3 IMTs are
typically assembled at the local level from existing resources.
B. Type 1 IMTs manage incidents with a 24-hour operational period, while Type 3 IMTs
use 12-hour operational periods.
C. Type 1 IMTs are used exclusively for incidents requiring federal assistance, while
Type 3 IMTs are used for all state-level incidents.
D. Type 1 IMTs primarily perform strategic functions, while Type 3 IMTs are limited to
tactical operations only.
CORRECT ANSWER: A. Type 1 IMTs are pre-designated regional or national
teams, while Type 3 IMTs are typically assembled at the local level from
existing resources.
Rationale: Under NIMS, incident management teams are categorized by type based on
their capabilities, training, and composition. Type 1 IMTs are national or regional level
teams that are pre-formed and ready for rapid deployment, while Type 3 IMTs are
generally formed at the local or state level from existing personnel. The distinction lies
in their level of readiness and complexity of incidents they handle [citation:1].
Question 2: In the context of NIMS, what is the primary purpose of the
"Resource Management" component during a complex incident?
A. To ensure that all resources are purchased from approved federal vendors.
B. To coordinate the identification, ordering, mobilization, and demobilization of
personnel and equipment.
C. To create a daily budget for all resources deployed to the incident.
D. To assign specific resources to the Public Information Officer for media briefings.
,CORRECT ANSWER: B. To coordinate the identification, ordering,
mobilization, and demobilization of personnel and equipment.
Rationale: Resource Management in NIMS is the systematic management of resources,
including personnel, teams, facilities, equipment, and supplies. It encompasses the
processes of identifying, ordering, mobilizing, tracking, and demobilizing resources to
support incident management, ensuring that the right resources are available at the right
time.
Question 3: A Unified Command is established at an incident involving
multiple jurisdictions. Who holds the ultimate responsibility for the safety of
the responders and the public?
A. The Incident Commander from the jurisdiction with the most personnel on scene.
B. The Unified Command members collectively share the responsibility.
C. The senior elected official from the affected jurisdiction.
D. The State Emergency Management Agency Director.
CORRECT ANSWER: B. The Unified Command members collectively share the
responsibility.
Rationale: In a Unified Command, all designated representatives from different
agencies or jurisdictions share the responsibility for safety and all incident management
functions. This does not remove safety responsibility from any single command member,
but ensures that safety considerations are integrated from all perspectives.
Question 4: Which of the following statements is true regarding the transfer of
command process?
A. The transfer of command should always occur at the beginning of an operational
period.
B. The transfer of command can only occur when the incident is stabilized.
C. The transfer of command should include a full briefing for the incoming Incident
Commander.
D. The transfer of command must be approved by the Finance/Administration Section
Chief.
CORRECT ANSWER: C. The transfer of command should include a full briefing
for the incoming Incident Commander.
Rationale: The transfer of command process is essential for continuity and must
include a formal briefing that covers the current situation, status of resources, safety
issues, and other critical information. It can occur at any time and is not limited to the
beginning of an operational period.
,Question 5: What is the primary function of the "Intelligence/Investigations"
function in an Incident Command System (ICS) organization?
A. To manage all media inquiries related to the incident.
B. To gather and analyze information regarding the incident to support decision-making.
C. To manage the distribution of food and water to victims.
D. To handle the financial documentation for all investigative actions.
CORRECT ANSWER: B. To gather and analyze information regarding the
incident to support decision-making.
Rationale: The Intelligence/Investigations function is responsible for collecting,
analyzing, and disseminating information and intelligence relevant to the incident. This
is distinct from media relations (Public Information Officer) and logistics (food/water
supply). It supports strategic and operational decision-making by the command
staff [citation:1].
Question 6: A single incident is complex and requires a multi-agency response.
What is the recommended organizational structure to manage this effectively?
A. A single Incident Commander from the first responding agency.
B. A Unified Command structure.
C. A separate Emergency Operations Center (EOC) established for each agency.
D. A single Incident Commander appointed by the state governor.
CORRECT ANSWER: B. A Unified Command structure.
Rationale: Unified Command is the preferred structure for managing complex multi-
jurisdictional incidents. It allows all agencies with legal or functional responsibility to
establish a common set of incident objectives and strategies without losing their
individual authority or accountability.
Question 7: Which of the following is a key characteristic of an "Area
Command"?
A. It is established for incidents that are primarily law enforcement-related.
B. It is responsible for the management of multiple incidents that are geographically or
functionally distinct.
C. It is the same as an Emergency Operations Center (EOC).
D. It is established for incidents that are expected to last less than 12 hours.
CORRECT ANSWER: B. It is responsible for the management of multiple
incidents that are geographically or functionally distinct.
Rationale: Area Command is an ICS organization established to oversee the
management of multiple incidents or a very large incident with multiple Incident
, Management Teams. Its purpose is to provide overall coordination and strategic
guidance for the separate incident management activities.
Question 8: In the context of NIMS, what does the term "Span of Control" refer
to?
A. The total number of personnel assigned to an incident.
B. The number of subordinates one supervisor can effectively manage.
C. The geographical area controlled by an Incident Commander.
D. The extent of damage caused by the incident.
CORRECT ANSWER: B. The number of subordinates one supervisor can
effectively manage.
Rationale: Span of Control refers to the number of individuals a supervisor can
effectively manage. NIMS recommends a ratio of one supervisor to three to seven
subordinates (ideally 1:5) to maintain adequate supervision and avoid overloading any
single manager.
Question 9: Which General Staff Section is responsible for all incident logistics,
including facilities, transportation, and supplies?
A. Operations Section
B. Planning Section
C. Logistics Section
D. Finance/Administration Section
CORRECT ANSWER: C. Logistics Section
Rationale: The Logistics Section is responsible for providing facilities, services, and
material support for the incident. This includes the procurement of supplies,
transportation, communications, food services, and medical support for the incident
personnel.
Question 10: The demobilization of resources is a planned process. Where is
the demobilization plan typically documented?
A. In the Incident Action Plan (IAP) for the final operational period.
B. In the Demobilization Plan, which is a separate document from the IAP.
C. In the Logistics Section's daily shift schedule.
D. In the initial incident briefing.
CORRECT ANSWER: B. In the Demobilization Plan, which is a separate
document from the IAP.
System for Command and General Staff–Complex
Incidents Study Guide, Original Practice Questions
& Answers, ICS-400 Exam Preparation,
Comprehensive NIMS & Incident Management
Review, Command and General Staff, Unified
Command, Area Command, Multiagency
Coordination, Complex Incident Management,
Incident Action Planning, Resource Management,
Operational Periods, Strategic Objectives,
Emergency Operations Centers & Advanced Incident
Command
Question 1: Which of the following best describes the primary difference
between a Type 3 Incident Management Team (IMT) and a Type 1 IMT?
A. Type 1 IMTs are pre-designated regional or national teams, while Type 3 IMTs are
typically assembled at the local level from existing resources.
B. Type 1 IMTs manage incidents with a 24-hour operational period, while Type 3 IMTs
use 12-hour operational periods.
C. Type 1 IMTs are used exclusively for incidents requiring federal assistance, while
Type 3 IMTs are used for all state-level incidents.
D. Type 1 IMTs primarily perform strategic functions, while Type 3 IMTs are limited to
tactical operations only.
CORRECT ANSWER: A. Type 1 IMTs are pre-designated regional or national
teams, while Type 3 IMTs are typically assembled at the local level from
existing resources.
Rationale: Under NIMS, incident management teams are categorized by type based on
their capabilities, training, and composition. Type 1 IMTs are national or regional level
teams that are pre-formed and ready for rapid deployment, while Type 3 IMTs are
generally formed at the local or state level from existing personnel. The distinction lies
in their level of readiness and complexity of incidents they handle [citation:1].
Question 2: In the context of NIMS, what is the primary purpose of the
"Resource Management" component during a complex incident?
A. To ensure that all resources are purchased from approved federal vendors.
B. To coordinate the identification, ordering, mobilization, and demobilization of
personnel and equipment.
C. To create a daily budget for all resources deployed to the incident.
D. To assign specific resources to the Public Information Officer for media briefings.
,CORRECT ANSWER: B. To coordinate the identification, ordering,
mobilization, and demobilization of personnel and equipment.
Rationale: Resource Management in NIMS is the systematic management of resources,
including personnel, teams, facilities, equipment, and supplies. It encompasses the
processes of identifying, ordering, mobilizing, tracking, and demobilizing resources to
support incident management, ensuring that the right resources are available at the right
time.
Question 3: A Unified Command is established at an incident involving
multiple jurisdictions. Who holds the ultimate responsibility for the safety of
the responders and the public?
A. The Incident Commander from the jurisdiction with the most personnel on scene.
B. The Unified Command members collectively share the responsibility.
C. The senior elected official from the affected jurisdiction.
D. The State Emergency Management Agency Director.
CORRECT ANSWER: B. The Unified Command members collectively share the
responsibility.
Rationale: In a Unified Command, all designated representatives from different
agencies or jurisdictions share the responsibility for safety and all incident management
functions. This does not remove safety responsibility from any single command member,
but ensures that safety considerations are integrated from all perspectives.
Question 4: Which of the following statements is true regarding the transfer of
command process?
A. The transfer of command should always occur at the beginning of an operational
period.
B. The transfer of command can only occur when the incident is stabilized.
C. The transfer of command should include a full briefing for the incoming Incident
Commander.
D. The transfer of command must be approved by the Finance/Administration Section
Chief.
CORRECT ANSWER: C. The transfer of command should include a full briefing
for the incoming Incident Commander.
Rationale: The transfer of command process is essential for continuity and must
include a formal briefing that covers the current situation, status of resources, safety
issues, and other critical information. It can occur at any time and is not limited to the
beginning of an operational period.
,Question 5: What is the primary function of the "Intelligence/Investigations"
function in an Incident Command System (ICS) organization?
A. To manage all media inquiries related to the incident.
B. To gather and analyze information regarding the incident to support decision-making.
C. To manage the distribution of food and water to victims.
D. To handle the financial documentation for all investigative actions.
CORRECT ANSWER: B. To gather and analyze information regarding the
incident to support decision-making.
Rationale: The Intelligence/Investigations function is responsible for collecting,
analyzing, and disseminating information and intelligence relevant to the incident. This
is distinct from media relations (Public Information Officer) and logistics (food/water
supply). It supports strategic and operational decision-making by the command
staff [citation:1].
Question 6: A single incident is complex and requires a multi-agency response.
What is the recommended organizational structure to manage this effectively?
A. A single Incident Commander from the first responding agency.
B. A Unified Command structure.
C. A separate Emergency Operations Center (EOC) established for each agency.
D. A single Incident Commander appointed by the state governor.
CORRECT ANSWER: B. A Unified Command structure.
Rationale: Unified Command is the preferred structure for managing complex multi-
jurisdictional incidents. It allows all agencies with legal or functional responsibility to
establish a common set of incident objectives and strategies without losing their
individual authority or accountability.
Question 7: Which of the following is a key characteristic of an "Area
Command"?
A. It is established for incidents that are primarily law enforcement-related.
B. It is responsible for the management of multiple incidents that are geographically or
functionally distinct.
C. It is the same as an Emergency Operations Center (EOC).
D. It is established for incidents that are expected to last less than 12 hours.
CORRECT ANSWER: B. It is responsible for the management of multiple
incidents that are geographically or functionally distinct.
Rationale: Area Command is an ICS organization established to oversee the
management of multiple incidents or a very large incident with multiple Incident
, Management Teams. Its purpose is to provide overall coordination and strategic
guidance for the separate incident management activities.
Question 8: In the context of NIMS, what does the term "Span of Control" refer
to?
A. The total number of personnel assigned to an incident.
B. The number of subordinates one supervisor can effectively manage.
C. The geographical area controlled by an Incident Commander.
D. The extent of damage caused by the incident.
CORRECT ANSWER: B. The number of subordinates one supervisor can
effectively manage.
Rationale: Span of Control refers to the number of individuals a supervisor can
effectively manage. NIMS recommends a ratio of one supervisor to three to seven
subordinates (ideally 1:5) to maintain adequate supervision and avoid overloading any
single manager.
Question 9: Which General Staff Section is responsible for all incident logistics,
including facilities, transportation, and supplies?
A. Operations Section
B. Planning Section
C. Logistics Section
D. Finance/Administration Section
CORRECT ANSWER: C. Logistics Section
Rationale: The Logistics Section is responsible for providing facilities, services, and
material support for the incident. This includes the procurement of supplies,
transportation, communications, food services, and medical support for the incident
personnel.
Question 10: The demobilization of resources is a planned process. Where is
the demobilization plan typically documented?
A. In the Incident Action Plan (IAP) for the final operational period.
B. In the Demobilization Plan, which is a separate document from the IAP.
C. In the Logistics Section's daily shift schedule.
D. In the initial incident briefing.
CORRECT ANSWER: B. In the Demobilization Plan, which is a separate
document from the IAP.
