ICS 100 Exam Questions, Answered (and What They Mean in a Real Incident)

Key takeaways

• The answer to most ICS questions is a role, not a concept. ICS is built so that one named person owns each function; the exam tests whether you know who that is.
• "Who has overall responsibility for managing the on-scene incident?" is the most-searched question in the family. The answer: the Incident Commander. One person, designated in advance, holding the pen for the whole scene.
• Every answer below is per FEMA's own curriculum, with the operational meaning the quiz sites skip. The real value of ICS is not passing the exam; it is running an incident where nobody has to ask who owns what.
• Cyber teams run the same structure. The incident commander, the operations lead, the communications lead, and counsel map onto the ICS command and general staff almost one-to-one.

The questions, with answers and what they mean

Who has overall responsibility for managing the on-scene incident?

The Incident Commander. One named person holds overall responsibility for everything at the scene: the response, the resources, the safety of everyone on it. The point of the rule is accountability, having one throat to choke and one brain making the trade-offs. In a cyber incident the same person owns the technical response, the notification decisions, and what leadership hears. (What the role actually involves.)

Who designates the Incident Commander?

The jurisdiction or organization with primary responsibility for the incident. The IC is not self-appointed and not elected; the organization that owns the incident names the person, ideally before the incident, with the authority to spend and decide. In your organization that means: your plan names the IC in advance, in writing. (The plan template has the slot for it.)

Which NIMS management characteristic includes maintaining accurate and up-to-date inventories of personnel, equipment, teams, and supplies?

Comprehensive Resource Management. You cannot deploy what you have not inventoried. The cyber translation is the contact tree: named responders, named counsel, named carriers, verified quarterly, because numbers decay silently.

Which ICS functional area establishes tactics and directs all operational resources?

Operations. Command sets objectives; Operations decides how and with what. In a breach that is your technical containment and investigation work, the people isolating systems and imaging machines, under the IC's direction but not waiting for it.

Which general staff member directs all responses and tactical actions to achieve the incident objectives?

The Operations Section Chief. Same family as the last answer, one level up: the named person who turns the IC's objectives into assignments and keeps the tactical work coherent. If your technical lead is buried in a disk image, they are doing Operations and should not also be commanding; the IC steers so experts can focus.

At the incident scene, who handles media inquiries?

The Public Information Officer. One authorized voice; everyone else redirects to it. That rule is why organizations under attack do not have five executives freelancing on social media, it is the crisis communications one-voice rule, and it exists in ICS for the same reason it exists in breach response.

Which ICS function is responsible for documentation of incident activities?

Planning. The Planning Section collects, evaluates, and documents everything: the timeline, the decisions, the resource use. In a breach, the incident log is the Planning function, and it becomes your notification record, your insurance claim, and your post-incident review. The organizations that skip it lose the claim and the lesson.

Which ICS supervisory title is used at the division level?

Supervisor. ICS titles are deliberately plain: Chiefs lead Sections, Directors lead Branches, Supervisors lead Divisions and Groups, Leaders run Units. The flatness is the feature, you always know exactly who owns the piece in front of you, and the titles carry no rank, only accountability.

Span of control refers to...

The number of subordinates one supervisor can effectively manage. ICS puts it between three and seven, with five as optimal. Past that, supervision fails and things fall through, which is why incident structure grows (adding Branches and Divisions) instead of just adding people under one manager. The same math is why a solo incident commander in a serious breach needs deputies, not more direct reports.

Which ICS management characteristic helps to eliminate confusion caused by multiple, conflicting directives?

Chain of Command and Unity of Command. Everyone reports to exactly one supervisor and receives direction through that line. In an incident this is the difference between coordinated response and five managers issuing contradictory instructions, which in a cyber incident is how evidence gets destroyed and wrong containment calls get made.

When command is transferred, the process should include...

A briefing that captures all essential information for continuing safe and effective operations. The transfer itself is not the event; the briefing is. In a breach, when the night commander hands to the day commander, the log, the timeline, the open decisions, and the do-not-do list transfer with it. Command transfers that skip the briefing restart the incident from zero.

Who has the authority to change the incident objectives?

The Incident Commander. Objectives are the IC's to set and to change, on the record, in the log. That is what makes the objectives useful: they are not a committee's suggestions, they are the direction a single accountable person has chosen and can be questioned against later.

Before leaving an incident assignment, you must...

Complete the checkout process. Demobilization is planned, not improvised: equipment accounted for, assignments handed off, documentation filed. On a breach it is why responders do not "just go home" at hour thirty, they hand the log, the evidence chain, and the open items to a named person first.

Why this matters beyond the exam

ICS is not certification theater. It is the operating system your local fire department runs on at 3 a.m., and the reason a hundred strangers can work a scene without a planning meeting. Security teams that adopt it get the same benefit, which is why the incident commander role, the response plan, and the first-24-hours checklist on this site all use its logic. FEMA's courses are free, ICS 100 among them, and they take an afternoon. The exam answers above are per FEMA's curriculum as last reviewed; always check your current course material before testing.

Frequently asked questions

Who has overall responsibility for managing the on-scene incident? The Incident Commander, one named person designated in advance by the organization responsible for the incident, holding accountability for the response, the resources, and everything on the scene.

What are the ICS 100 exam answers based on? FEMA's ICS curriculum: command staff roles, the four general staff sections, span of control, chain of command, and resource management. The answers are stable year to year; FEMA adjusts course material occasionally, so verify against your current course.

Does ICS apply to cybersecurity incidents? Yes, and increasingly organizations run cyber incidents on ICS structure: an incident commander, operations, planning as the incident log, logistics, and a single public information voice. The roles map one-to-one with the incident command roles in our incident commander guide.

Where do I take ICS 100? Through FEMA's Emergency Management Institute, free online, with ICS 200, 700, and 800 as the natural follow-ons. Security teams benefit most from ICS 100 and 200.

Learn the role behind the exam answer. The incident commander, explained →