ICS-200 Exam Questions, Answered (and What They Mean in a Real Incident)

Key takeaways

• The most-searched question in the family is the leadership one, and its answer is all of the above. Developing subordinates for the future, stepping out of a tactical role to take command, and ensuring tasks are understood are all on FEMA's own list of leader commitments; the exam is testing that leadership is a set of behaviors, not a rank.
• ICS 200 is the supervisory course. Where ICS 100 asks who owns the scene, ICS 200 asks what gets activated when the scene outgrows one crew: Command Staff, delegation of authority, incident typing, written Incident Action Plans, and transfer of command.
• Every answer below is per FEMA's own IS-200.C curriculum, with the operational meaning the answer sites skip. The letters get you the certificate; the structure gets you a response nobody has to improvise at 3 a.m.
• Incident typing is the quiet workhorse of the course. The Type 5 through Type 1 ladder is a readiness scale, and a cyber incident climbs the same ladder: one laptop, one shift, one team, one crisis. Knowing which rung you are on tells you what to stand up today.

The questions, with answers and what they mean

Which of the following demonstrates a leader's commitment to duty?

All of the above. Developing subordinates for the future, stepping out of a tactical role to assume a leadership role when needed, and ensuring tasks are understood are all on FEMA's own list of what a leader should do, alongside taking charge within your scope of authority, being proficient in your job, and making sound and timely decisions. This is the hardest part of commanding a breach in practice: your best forensicator stops working the box and starts running the incident, confirms the containment task was understood rather than assumed, and uses the incident to grow the people who will run the next one.

Which member of the Command Staff interfaces with other agencies to meet incident-related information requirements?

The Public Information Officer. FEMA's wording: the PIO interfaces with the public, media, and other agencies with incident-related information needs, gathering, verifying, and disseminating timely information, with one lead PIO designated when several agencies are involved so everyone speaks with one voice. In a breach this is your comms lead owning regulator, customer, and press notifications while everyone else redirects, the crisis communications one-voice rule, and it exists in ICS for the same reason it exists in breach response: five unauthorized voices make the incident worse.

Which Command Staff member monitors incident operations and advises the Incident Commander on the health and safety of incident personnel?

The Safety Officer. The Safety Officer monitors operations, advises the Incident Commander on all matters relating to the health and safety of incident personnel, establishes the systems to mitigate hazardous environments, and has the standing to stop or prevent unsafe acts, though ultimate safety responsibility stays with command and supervisors. The cyber translation is responder welfare plus evidence discipline: the person watching the rotation at hour thirty, forcing sleep, and halting the panicky wipe-and-rebuild that destroys the artifacts you will need for the claim.

Representatives from assisting or cooperating agencies and organizations coordinate through:

The Liaison Officer. The Liaison is the incident command's point of contact for representatives of agencies, jurisdictions, NGOs, and private organizations not part of the Unified Command, and through the Liaison they provide input on their policies and resource availability. The helpers exist because of paperwork signed earlier: mutual aid agreements are what NIMS calls the legal basis for two or more entities to share resources. In a breach this is whoever coordinates your outside IR firm, counsel, carrier, and cloud provider so the IC runs the incident instead of herding vendors.

When no single jurisdiction or agency has primary authority to manage an incident, what does ICS establish?

Unified Command. FEMA's wording: Unified Command may be established when no one jurisdiction, agency, or organization has primary authority and/or the resources to manage an incident on its own. There is no single Commander; the responsible agencies manage the incident together through a common set of objectives and strategies, at one command post, while every individual still reports to exactly one supervisor and no agency's legal authority is compromised. A breach spanning your network, a cloud provider, and a critical third party is exactly this shape, and without it the vendor quietly runs your response because it is "their" incident.

Which statement about span of control is true?

Span of control is accomplished by organizing resources into Teams, Divisions, Groups, Branches, or Sections. The optimal ratio is one supervisor to five subordinates, and the curriculum is explicit that the ratio is a guideline, applied with judgment to the incident at hand. When the span exceeds the manageable you add structure rather than direct reports, and you collapse it back down when the work shrinks. The math is identical in a breach: an incident commander with eleven live workstreams does not become a superhuman, they split the work into named groups with a lead for each.

Which incident type is limited to one operational period in the control phase, with no written Incident Action Plan required?

Type 4. A Type 4 runs on several single resources, activates Command and General Staff functions only if needed, is limited to one operational period in the control phase, and requires no written IAP for non-HazMat incidents, though it gets a documented operational briefing. One rung down, a Type 5 is the routine call: one or two single resources, up to six personnel, contained within the first operational period. Most cyber incidents live on these two rungs, and the discipline is the one the first 24 hours checklist encodes: even a one-shift incident gets a size-up, stated objectives, and a written handoff.

Which incident type may extend into multiple operational periods, with some or all of the Command and General Staff activated?

Type 3. Type 3 is the pivot of the ladder: capabilities exceed initial response, some or all Command and General Staff positions activate, an Incident Management Team manages significant resources, the incident may extend into multiple operational periods, and a written IAP may be required for each one. Above it, Type 2 pulls regional or national resources with most or all Command and General Staff filled, typically capped at 200 operations personnel per operational period and 500 total, and Type 1 is the national incident: all positions activated, Branches established, often 500-plus per operational period, with a possible disaster declaration. A written IAP is required for every operational period at both. A ransomware event climbs this ladder in days, not weeks.

When command is transferred, then all personnel with a need to know should be told:

The effective time and date of the transfer. The procedure around it: transfer face-to-face where possible, with a complete briefing that captures essential information for continuing safe and effective operations, covering situation status, objectives, the current organization, resources, facilities, communications, and open concerns. A more qualified person arriving does not by itself transfer command; they may assume command per agency guidelines, keep command as is, or request a more qualified IC. In a breach this is shift change done seriously: the log, the timeline, the open decisions, and the do-not-do list transfer with a timestamp, so you never have two commanders issuing conflicting orders.

A delegation of authority may be needed when:

The incident scope is complex or beyond existing authorities. It is also needed when the incident falls outside the Incident Commander's jurisdiction, or when law or procedure requires it. The delegation is issued by the jurisdiction's chief elected official, the organization's chief executive officer, or the agency administrator, in writing or verbally; it allows the IC to assume command; and it does not relieve the granting authority of ultimate responsibility. In private organizations this is the pre-incident signature page in your incident response plan template: what the IC may spend, take offline, and notify, agreed before the incident so hour one is not spent hunting for an approver.

Which General Staff position conducts tactical operations, develops the tactical objectives and organization, and directs all tactical resources?

The Operations Section Chief. Per the curriculum, the Operations Section Chief is responsible to the Incident Commander for the direct management of all incident-related operational activities, establishes tactical objectives for each operational period, and has direct involvement in preparing the Incident Action Plan. Resource discipline lives here too: resources are ordered by kind, what the resource is, and type, its minimum capability to perform its function, and asking for a kind without a type is how a request for "forensics support" gets you a team that cannot do the job; say Windows-heavy, cloud-native, or OT.

When is a written Incident Action Plan required?

At Type 2 and Type 1 incidents, for every operational period, and often at Type 3; the smallest incident types run without one. The plan has four elements per the curriculum: what must be done, who is responsible, how information will be communicated, and what should be done if someone is injured, and it covers exactly one operational period. In a multi-day breach that per-shift plan keeps eight responders pointed at the same objectives instead of running three private wars, and it doubles as the record your carrier, your regulators, and your post-incident review will all ask for.

Mutual aid agreements:

Assist agencies and jurisdictions when existing resources are inadequate. NIMS describes mutual aid agreements as the legal basis for two or more entities to share resources, running between neighboring communities, across a state, between states, or nationally through compacts like EMAC. What makes them work is the boring list: reimbursement, recognition of licensure across boundaries, mobilization procedures, and interoperable communications. In cyber terms this is your outside-IR retainer, the peer bench you can actually call, and your information-sharing relationships, all of which only function if the agreements existed before the incident.

Why this matters beyond the exam

ICS 200 is the course that turns the ICS diagram into staffing decisions. Nothing in it is ceremonial: delegation of authority is what lets one person act in hour one, the written Incident Action Plan is what keeps a multi-day response pointed at the same objectives, and transfer of command is how a response survives its own shift changes. The exam answers above are per FEMA's curriculum as last reviewed; always check your current course material before testing. The courses are free, ICS 200 among them, and they take an afternoon.

Frequently asked questions

What is ICS 200, and who is it for? FEMA's Basic Incident Command System for Initial Response, course IS-200.C: the follow-on to ICS 100, built for personnel who are likely to assume a supervisory position within ICS.

How long does ICS 200 take, and what score passes? About four hours online, worth 0.4 CEUs. FEMA sets the pass mark at 75 percent on the final exam, and the questions are scrambled between attempts to protect the exam's integrity.

What does the IS-200.C exam cover? Leadership values and commitment to duty, delegation of authority, management by objectives, the Command and General Staff, briefings, organizational flexibility, incident typing, and transfer of command. The answers are stable year to year; FEMA adjusts course material occasionally, so verify against your current course.

Does ICS 200 apply to cybersecurity incidents? Yes, and increasingly organizations run cyber incidents on this structure: an incident commander, an operations lead, planning as the incident log and per-shift plan, and a single public information voice. The supervisory questions are the same ones a breach asks, which roles to activate and when the incident needs a written plan per shift.

Learn the role behind the exam answers. The incident commander, explained →

Free download: the command chapter of this family is compiled in The Incident Response Handbook (PDF, 20 pages) →.