IS-700 Exam Questions, Answered (and What NIMS Means in a Real Incident)

Key takeaways

• NIMS is a system, not a plan. The exam's defining question asks what NIMS is and the answer is a systematic approach to incident management, not a response plan, not a communications plan, not something used only during large-scale incidents. It is the structure response runs inside at every size.
• "The three NIMS guiding principles are..." is the most-searched question in the family. The answer: flexibility, standardization, and unity of effort. Nearly every other answer in the bank hangs off one of those three.
• Every answer below is per FEMA's own curriculum, with the operational meaning the quiz sites skip. Each one is checked against the current IS-700.b course materials, not against answer-key folklore, and the folklore is wrong on at least two circulated questions.
• The exam is really a map of four structures. ICS runs the scene, EOCs support it from off site, MAC Groups set policy and prioritize resources, and the Joint Information System keeps the public voice unified. A cyber response already contains an analogue of every one of them.

The questions, with answers and what they mean

Which of the following correctly describes NIMS?

A systematic approach to incident management. NIMS is a comprehensive, nationwide, systematic approach that covers the command and coordination of incidents, resource management, and information management, and every wrong option on the exam is a thing people confuse it with: a response plan, a communications plan, a static system used only during large-scale incidents. It is none of those. It is the operating system your plans run on. In a cyber incident the distinction is the same one your organization already lives: the playbook is the plan, NIMS is how the response actually runs while you execute it.

The three NIMS guiding principles are...

Flexibility, standardization, and unity of effort. Flexibility lets one system scale from a routine local incident through interstate mutual aid up to federal assistance. Standardization gives you common structures, practices, and terminology so that strangers can integrate. Unity of effort means separate organizations coordinate toward shared objectives while each one keeps its own authority and accountability. For a security team this is the whole design brief in three words: the same response scales from one laptop to the whole estate, uses the same roles and words at every size, and lets legal, communications, and engineering each keep their own mandate while working the same objectives.

Which NIMS guiding principle supports interoperability among multiple organizations?

Standardization. NIMS defines standard organizational structures, standard practices, and common terminology precisely so multiple organizations can work together, and interoperability is the direct product. The other principles are the other distractors: flexibility is scalability, unity of effort is coordination across separate authorities, and adaptability is not a NIMS guiding principle at all. The cyber translation is concrete: your severity scale and role names should match your retainer firm's and your carrier's before the incident, because the only way that happens is agreeing to a standard in advance.

Which NIMS component includes the Incident Command System (ICS)?

Command and Coordination. NIMS has three major components, Resource Management, Command and Coordination, and Communications and Information Management, and ICS lives inside the second one alongside three other structures: Emergency Operations Centers, Multiagency Coordination Groups, and the Joint Information System. The relationship the exam is really testing: NIMS is the umbrella system and ICS is its on-scene piece, the structure we walk through in the ICS 100 exam guide. In a breach, your technical leads doing containment are the ICS layer, and everything supporting them from off scene belongs to the rest of the component.

Which major NIMS component describes systems and methods that help to ensure that incident personnel and other decision makers have the means and information they need to make and communicate decisions?

Communications and Information Management. This component covers the communications and information systems that give every command and coordination site a common operating picture, built on principles of interoperability, reliability, scalability, and portability, with resilience, redundancy, and security. The exam wording says the quiet part out loud: decision makers need both the means and the information, and decisions rot without shared information. In a cyber incident this is your single incident log and one shared timeline, the thing that keeps executives, responders, and counsel working from one set of facts instead of three.

When an incident expands...

Only the functions and positions that are necessary are filled. ICS and EOC organizations are modular, building blocks put in place as needed based on the incident's size, complexity, and hazards. As complexity increases the structure expands and responsibilities divide, but nothing gets staffed for the sake of an org chart: each activated element has a person in charge, and span of control stays sane. In a breach you do not stand up a twenty-person command structure for one contained laptop, and you do not run a multi-region ransomware event on a solo incident commander, the structure grows to match the work. This question also circulates in the ICS-200 bank, whose questions we walk in the ICS 200 guide.

Which NIMS structure makes cooperative multi-agency decisions?

MAC Groups. A Multiagency Coordination Group is a policy-level body of agency administrators, executives, or their designees that prioritizes and allocates scarce resources and makes cooperative decisions among elected and appointed officials and the incident commander. The defining limit, and the part the exam checks: a MAC Group does not perform incident command functions and does not replace the EOC. The cyber translation is the executive call on ransom posture, disclosure strategy, and emergency spend: that is a MAC Group in everything but name, it sets policy and resources, then gets out of the way of the people running the incident.

Which of the following is an EOC function?

All of the above. Collecting, analyzing, and sharing information. Coordinating plans and determining resource needs. Providing coordination and policy direction in some cases. Every listed option is a real EOC function, which is why the answer is all of them. An EOC is an off-site location where staff from multiple agencies come together to support on-scene command, and EOCs activate in levels, from normal steady state through partial activation to full. In a breach, your war room and standing bridge call are the EOC analogue, the place where procurement, legal, and leadership coordinate so that the people doing containment are not also chasing approvals.

Which NIMS structure develops, recommends, and executes public information plans and strategies?

The Joint Information System (JIS). The JIS integrates incident information and public affairs into a unified organization so the public receives consistent, coordinated, accurate, accessible, timely, and complete information, and it operates across ICS, the EOC, and the MAC Group, supporting all of them. The PIO is not the JIS: the Public Information Officer is a person, a key member of the ICS or EOC organization who advises command and handles media and public inquiries, while the JIS is the structure that keeps every public information voice saying the same thing. This is the crisis communications one-voice rule at FEMA scale.

The ___ is a central location that houses Joint Information System (JIS) operations and where public information staff perform public affairs functions.

The Joint Information Center (JIC). The JIS is the system, the JIC is the place: a central location, normally one per incident, where public information staff do the work of gathering, verifying, coordinating, and releasing information. FEMA's reason for co-locating them is operational, not administrative: rumor control and message consistency fail when the writers are scattered. In a breach, the room or bridge where communications, counsel, and the response team gather to draft and clear every statement is your JIC, and it should have one door in and one voice out.

Establishing mutual aid agreements to obtain resources from neighboring jurisdictions is an example of which resource management activity?

Planning for Resources. Mutual aid is the sharing of resources and services between jurisdictions or organizations, and the agreements that make it legal are negotiated in advance as part of resource planning, alongside stockpiling, vendor contracts, and plans for reassigning resources from non-essential tasks. The curriculum is blunt about the alternative: jurisdictions never own enough for every scenario, so the gaps get managed before the incident or not at all. Cyber translation: your MDR retainer, outside counsel, and forensics firm under contract are mutual aid agreements, they belong in the incident response plan template with named contacts, and the receiving side can decline resources that do not meet its needs, which is exactly why you test the retainer before you need it.

Which resource management task determines the type, quantity, receiving location, and users of resources?

Identify Requirements. This is the first task of the incident resource lifecycle: identify requirements, order and acquire, mobilize, track and report, recover and demobilize, reimburse and restock. Identification means stating the type and quantity needed, where resources should go, and who will receive and use them, and doing it continuously, because needs change as the incident progresses. The cyber parallel is the difference between "we need help" and "we need two Windows forensic investigators at the corporate office reporting to the containment lead by Friday": the first is a feeling, the second is an order that can actually be filled.

Which resource management task establishes and maintains the readiness of resources and ensures providers are paid in a timely manner?

Reimburse and Restock. The last task of the lifecycle closes the loop: reimbursement pays resource providers for expenses they incurred, restocking replenishes what the incident consumed, and together they keep resources ready for the next one. The reason it is a named task rather than an afterthought is operational: providers stop answering when payment is slow, and the shelf stays empty when nobody restocks. In a breach this means retainer hours replenished, spare hardware re-imaged and staged, and costs tracked while the incident runs, because the bill becomes the insurance claim and the next incident starts with whatever readiness you have left.

Why this matters beyond the exam

NIMS is not certification theater. It is the reason a hundred responders from a dozen agencies can work one scene at 3 a.m. without first agreeing on vocabulary, and it is the reason the structures exist that keep policy, operations, and public messaging from stepping on each other during a multi-day event. Security teams that adopt its logic get the same benefit: named structures instead of improvised ones, resources lined up before the incident, and one public voice when the pressure is highest. FEMA's courses are free, IS-700.b among them, and they take an afternoon. The exam answers above are per FEMA's curriculum as last reviewed; always check your current course material before testing.

Frequently asked questions

What are the three NIMS guiding principles? Flexibility, standardization, and unity of effort: NIMS scales to any incident, standardizes structures and terminology so that organizations interoperate, and coordinates separate organizations toward common objectives while each keeps its own authority and accountability.

What are the IS-700 exam answers based on? FEMA's NIMS curriculum: the guiding principles, the three NIMS components, the four Command and Coordination structures, the NIMS management characteristics, and the resource management lifecycle. The answers are stable year to year; FEMA adjusts course material occasionally, so verify against your current course.

Does NIMS apply to cybersecurity incidents? Yes. The structures map directly: ICS to your technical response under an incident commander, the EOC to your war room and bridge calls, MAC Groups to the executive policy group on disclosure and spend, and the JIS to your single public voice. NIMS is deliberately all-hazards, it does not care what caused the incident, which is the point.

Where do I take IS-700? Through FEMA's independent study program at training.fema.gov, free online, about three and a half hours for the current IS-700.b, with ICS 100, ICS 200, and IS-800 as the natural companions for a security team.

Learn the role behind the exam answers. The incident commander, explained →

Free download: the command chapter of this family is compiled in The Incident Response Handbook (PDF, 20 pages) →.