25 Emergency Response Practice Questions & Answers

1. 1. During a multi-agency response at your site, the incident commander assigns each supervisor five people to direct. Under the ICS principle of span of control, this staffing is:

   • A.Above the ICS ceiling, since the system limits any supervisor to three subordinates and requires a new division
   • B.Outside ICS entirely, since span of control applies to fire crews and not to security staff working an incident
   • C.Within the recommended range, since ICS span of control runs from three to seven subordinates, with five preferred✓ Answer
   • D.Below the ICS minimum, since a supervisor is expected to direct at least eight subordinates before a unit is split

   ICS sets a manageable span of control of three to seven subordinates per supervisor, with one supervisor to five subordinates recommended, so no supervisor loses track of assigned people as an incident grows.

   Source: NIMS/ICS management characteristics — manageable span of control, 3 to 7 with 1:5 recommended (FEMA IS-100)Report a problem with this question

2. 2. Your post orders place you under the site security supervisor, but during an incident a fire officer, a police sergeant and your supervisor each give you a different assignment. Which ICS principle settles this?

   • A.Unified command: you take direction from whichever agency official happens to be closest to the hazard at that moment
   • B.Management by objectives: you pick the assignment that best fits the written objectives set for the incident
   • C.Transfer of command: you follow the agency that arrived most recently, since command shifts to it automatically
   • D.Unity of command: you take direction from one designated supervisor, and you confirm tasks through that person✓ Answer

   Unity of command means every responder reports to one and only one supervisor; unified command is the separate idea that several agencies jointly set objectives without giving up their own authority.

   Source: NIMS/ICS management characteristics — unity of command vs. unified command (FEMA IS-100)Report a problem with this question

3. 3. You are first at a small electrical fire on a loading dock and have taken initial actions. A fire department officer arrives. Under ICS, command passes to that officer when:

   • A.your security supervisor arrives on scene and formally releases you from the incident so the officer can work
   • B.you brief the officer on conditions and actions taken and the officer states that command has been assumed✓ Answer
   • C.the department's apparatus reaches the property, because command changes at the moment trained responders arrive
   • D.the incident is placed under control, since whoever arrives first keeps command through the whole operation

   ICS requires a transfer-of-command briefing covering conditions, actions taken and resources, and command shifts only when the incoming person announces they have assumed it — not by the mere arrival of another agency.

   Source: NIMS/ICS transfer of command and briefing requirement (FEMA IS-100)Report a problem with this question

4. 4. A gas odor is reported in a parking garage and you are transmitting to responding units on a shared radio channel. ICS communication practice requires you to:

   • A.use the fire department's own radio codes, since the responding agency's terminology governs the scene
   • B.use plain English for the location and the hazard, since agencies working together share no ten-codes✓ Answer
   • C.use your company's ten-code set, since numeric codes transmit faster and keep details off an open channel
   • D.use abbreviations for the building and the hazard, since shorthand keeps a busy channel from congesting

   ICS requires common terminology and clear text — plain English — because ten-codes, agency jargon and local abbreviations mean different things to different responders working the same incident.

   Source: NIMS/ICS common terminology and clear text (FEMA IS-100)Report a problem with this question

5. 5. Firefighters arrive for a smoke condition in a mechanical room and the incident commander asks what security can provide. The most useful contribution is:

   • A.a set of floor plans, master keys and utility shutoff locations, plus where occupants were last known to be✓ Answer
   • B.a sweep of the mechanical room ahead of the crews to confirm whether anyone is still inside it
   • C.a decision on which stairwell the crews should use and which doors they should force to reach the room
   • D.an assessment of what started the smoke and which unit failed, so crews can go straight to the cause

   The guard integrates into the command structure instead of commanding, diagnosing or searching; the unique value security adds is site knowledge — plans, keys, utility shutoffs and occupant locations.

   Source: NIMS/ICS integration of on-site personnel; BSIS Powers to Arrest manual, 'Getting Help'Report a problem with this question

6. 6. You watch a person photograph camera positions, the loading-dock gate and the guard rotation at your site, then walk away. Your report should describe:

   • A.the person's ethnicity, accent and apparent religion, since responders need that to identify the individual
   • B.the actions seen, the times, and the vehicle and direction of travel, leaving out the person's background✓ Answer
   • C.your conclusion that this was hostile surveillance, so that police know how to classify what you sent them
   • D.nothing yet, because photographing a building from a public sidewalk is not a reportable security concern

   Suspicious activity reporting rests on observed behavior and indicators, never on race, ethnicity, religion or national origin, and the guard documents what was done rather than drawing the conclusion.

   Source: DHS 'If You See Something, Say Something' / Nationwide SAR Initiative behavior-based reporting standardReport a problem with this question

7. 7. Over two weeks, three different people separately test a side door after hours, ask staff how fast officers respond, and leave when a guard appears. This is best reported as:

   • A.attempted burglary, which is reported only if property is later found missing from inside the building
   • B.probing of security response, a pre-incident indicator that belongs in a suspicious activity report✓ Answer
   • C.ordinary trespassing, which is closed out in the daily activity log once each person leaves the property
   • D.employee misconduct, which the client's human resources office handles instead of a security report

   Testing or probing security response is a listed pre-incident indicator alongside surveillance, elicitation and attempted breaches, so a repeated pattern by different people is reported rather than logged as routine trespass.

   Source: DHS/FBI pre-incident terrorism indicators — surveillance, elicitation, tests of securityReport a problem with this question

8. 8. After an explosion in a parking structure, responders and evacuees are gathering at the obvious entrance nearest the blast. As an unarmed guard you should:

   • A.hold the group at that entrance so arriving units have one predictable place to check in and get assignments
   • B.move people from that entrance and set another staging point, since secondary devices target responders✓ Answer
   • C.return to your post and leave scene layout to the fire department, since it is never a security decision
   • D.walk the structure looking for a second device so responders know the area is clear before committing crews

   Secondary devices are placed to kill responders and are aimed at the obvious approach route and the natural gathering point, so staging is moved away from that spot and kept upwind and at a distance.

   Source: DHS/CISA secondary device awareness; FEMA responder scene-safety guidanceReport a problem with this question

9. 9. A package in the mailroom has no return address, excessive tape, oily stains and a strong odor. You should:

   • A.leave it where it sits, clear and close the room, wash your hands, and list everyone who was in that room✓ Answer
   • B.carry it outside to an open area away from the building, then call 911 and wait with it for officers
   • C.open one corner to see whether the contents explain the stains before escalating to emergency services
   • D.seal it in a plastic bag and lock it in the security office so no one else can be exposed to it

   Suspicious mail indicators include no return address, excessive tape, stains and odor; the item is left undisturbed, the room is cleared and closed, and everyone who was exposed is listed for responders.

   Source: USPS/FBI suspicious mail and package indicators; CISA suspicious item guidanceReport a problem with this question

10. 10. A backpack has sat alone by a food-court table for twenty minutes. It is in plain view, looks like ordinary school gear, and shows no wires or unusual components. Correct handling is to:

    • A.open it to look for identification, since a name is the fastest way to return the bag to its owner
    • B.treat it as a device and evacuate the food court now, since any bag left this long is presumed dangerous
    • C.carry it to the lost-and-found desk and log it, since removing it ends any risk to people in the court
    • D.treat it as unattended and look for the owner by asking nearby staff and making a public announcement✓ Answer

    HOT — Hidden, Obviously suspicious, not Typical — separates a suspicious item from a merely unattended one; without those indicators the first step is to find the owner, and the item is never opened or moved.

    Source: CISA/DHS suspicious item guidance — HOT criteria and unattended vs. suspicious itemsReport a problem with this question

11. 11. Under a stairwell you find a taped box with wires protruding from one end. Standing a few feet away, you should:

    • A.move the box outside to an open area away from people and call 911 from behind cover there
    • B.call it in on your portable radio at once so the description reaches dispatch while you watch it
    • C.photograph the box with your cell phone where you stand so responders know what they are facing
    • D.leave the stairwell, move well away, and use a phone or radio from that distance to notify 911✓ Answer

    Radio and cellular transmissions are kept away from a suspected device because they can act as an initiator, and RAIN — Recognize, Avoid, Isolate, Notify — puts distance before notification.

    Source: CISA/DHS bomb threat response — RAIN and the radio/cell restriction near suspicious itemsReport a problem with this question

12. 12. On patrol of an occupied assembly hall you find the rear exit chained shut and a fire door propped open with a wedge. You should:

    • A.log both for the morning maintenance crew, since the building will be empty for most of the night
    • B.leave the chain until management approves removal, since the door was secured to prevent theft
    • C.close the fire door and leave the chain, since one working exit is enough while the hall is full
    • D.remove the chain and the wedge now, then report both conditions in writing and notify the client✓ Answer

    The means of egress must be a continuous and unobstructed path to a public way, so a chained exit in an occupied building is corrected at once, and a propped fire door defeats the compartmentation that protects that path.

    Source: NFPA 101 Life Safety Code — means of egress must be continuous and unobstructed; fire door integrityReport a problem with this question

13. 13. A fire alarm sounds on the third floor of a hospital that uses defend-in-place procedures. As the guard responding to that floor you should:

    • A.prop the stairwell doors so smoke clears and gather walking patients at the top of the stairs
    • B.start a full building evacuation and move every patient out to the parking-lot assembly point
    • C.help staff move patients past the smoke doors into the next compartment and close the doors behind them✓ Answer
    • D.wait at the elevator lobby to bring crews up and leave all patient movement to the nursing staff

    Health care occupancies protect patients by horizontal evacuation into an adjacent smoke compartment behind closed doors rather than by emptying the building, and the guard supports the clinical staff doing it.

    Source: NFPA 101 health care occupancy — defend-in-place and horizontal evacuationReport a problem with this question

14. 14. You call 911 for a worker who fell from a ladder in a rear warehouse on a large campus. After stating the nature of the emergency, the most important thing to add is:

    • A.the worker's full name, date of birth and employer, so the hospital can start the admission paperwork
    • B.the client's insurance carrier and policy number, so billing is settled before the patient moves
    • C.your assessment of which bones are broken, so the crew prepares the right equipment before arriving
    • D.the gate and dock number that gets an ambulance closest, your callback number, and any hazards✓ Answer

    The dispatcher needs the exact access point on a large site, a callback number and any hazards, because the delay that kills is an ambulance that cannot find the patient; diagnosis and billing are not the caller's job.

    Source: 16 CCR 643 Communication course (emergency/first responder coordination); standard 911 reporting elementsReport a problem with this question

15. 15. A visitor has fallen down a short flight of stairs, is conscious, and complains of neck pain. EMS is three minutes out. You should:

    • A.carry the visitor to the entrance so the ambulance crew does not lose time finding the stairs
    • B.keep the visitor still where they lie, keep the stairway clear, and stay there with them✓ Answer
    • C.roll the visitor onto one side and put a folded jacket under the head to support the neck
    • D.help the visitor up and walk them to a lobby chair so they are comfortable when EMS arrives

    An injured person is not moved unless staying put creates greater danger, because movement can turn a spinal injury into permanent damage; the guard contributes scene control and continuous presence.

    Source: Scope-of-training limits in first aid response; BSIS Powers to Arrest manual, 'Getting Help'Report a problem with this question

16. 16. A conscious, alert employee cuts a hand and refuses both your first aid kit and your offer to call an ambulance. You should:

    • A.treat the wound over the objection, since an injury on the client's property is the guard's responsibility
    • B.call 911 anyway and tell the dispatcher the employee consented so the crew is not turned away
    • C.respect the refusal, notify your supervisor as post orders require, and record the refusal and time✓ Answer
    • D.have the employee sign a release you write out, since the client is liable without a signature

    A conscious, competent adult may refuse care and touching them anyway can be a battery; consent is only implied when a person is unresponsive, so the guard documents the refusal and the notification.

    Source: Consent and refusal of care doctrine; Good Samaritan protection covers a volunteer acting within trainingReport a problem with this question

17. 17. Shots are fired inside a mall. You are an unarmed guard in a corridor with several shoppers who cannot reach an exit. You should:

    • A.move them into a room, lock or barricade the door, silence every phone and stay out of the shooter's view✓ Answer
    • B.hold the corridor and confront the shooter, since a uniformed guard is expected to stop the threat
    • C.lead them toward the sound of the shots so you can see the shooter and relay a description to police
    • D.gather them in the open atrium where arriving officers can see the group and escort everyone out

    Run, Hide, Fight is an order of preference: when escape is impossible the group hides behind a locked or barricaded solid door, silent and out of view, and an unarmed guard does not pursue or confront.

    Source: DHS/ready.gov Run-Hide-Fight; BSIS Powers to Arrest manual, active shooter sectionReport a problem with this question

18. 18. A driver stopped at the gate smells of alcohol, slurs his words and staggers. In the incident report you should write:

    • A.that the driver was intoxicated, which is the clearest way to convey his condition to a later reader
    • B.the odor, the slurred speech and the unsteady walk you saw, with the driver's own words in quotes✓ Answer
    • C.your estimate of how much the driver had consumed, so the client can decide about future entry
    • D.that the driver appeared to be under the influence, which conveys it without stating a conclusion

    An incident report records observations, not diagnoses: what you saw, heard and smelled plus direct quotes, because 'intoxicated' and 'appeared under the influence' are both conclusions a guard cannot certify in court.

    Source: 16 CCR 643 Observation and Documentation (mandatory report writing) — facts and observations, not opinionsReport a problem with this question

19. 19. Partway through a handwritten incident report you notice you entered the wrong time for the police notification. You should:

    • A.erase it and rewrite the whole page, since a clean report carries more weight if it is read in court
    • B.draw one line through the entry, write the correct time beside it, and initial and date the change✓ Answer
    • C.leave the wrong time and note the correct one at the end, since an entry once written is not touched
    • D.cover the entry with correction fluid and write the correct time over it so the page stays readable

    A report is a legal document, so an error is corrected in a way that leaves the original entry readable and attributable — one line through it, the correction beside it, initialed and dated; erasures look like concealment.

    Source: 16 CCR 643 Observation and Documentation; standard incident report correction rule (single line, initial, date)Report a problem with this question

20. 20. At the assembly point after an evacuation, a floor warden tells you one employee is not accounted for. You should:

    • A.re-enter with another guard and search that floor, since you know the layout better than crews
    • B.call the employee's cell phone and, if there is no answer, note it in the end-of-shift report
    • C.report the name and the person's last known floor to the fire department incident commander✓ Answer
    • D.wait for a second head count before saying anything, since first counts are frequently wrong

    An emergency action plan must include procedures to account for everyone after evacuation, and the value of the head count is giving the incident commander a name and a last known location; search is done by trained crews.

    Source: OSHA 29 CFR 1910.38(c)(4) — procedures to account for all employees after evacuationReport a problem with this question

21. 21. Three employees saw an assault in the parking lot and are standing together comparing what they saw while you wait for police. You should:

    • A.release them back to their shift and give police the names later, since no one can be held
    • B.separate them, take each one's name and contact number, and ask them not to discuss it any further✓ Answer
    • C.take one written statement signed by all three, since a single agreed account saves time
    • D.let them talk it through so their accounts line up by the time officers take statements

    Witnesses who talk to each other blend their memories into a single account, which destroys the independent value of each statement, so the guard separates them and captures contact details before anyone leaves.

    Source: 16 CCR 643 Preserving the Incident Scene — securing the immediate area and witness handlingReport a problem with this question

22. 22. After a theft from a stockroom you must move a dropped tool blocking the only fire exit, and the site's CCTV overwrites itself every 72 hours. You should:

    • A.wipe the tool clean before moving it so no one else's prints confuse the officers who examine it
    • B.leave the tool blocking the exit until police arrive and let them decide about pulling the video
    • C.bag the tool and lock it in the office safe, and let the video overwrite since police can pull it
    • D.note the tool's position and condition, then flag and export the video before it is lost✓ Answer

    Life safety outranks the scene, so the blocked exit is cleared, but the guard records the item's original position and condition to preserve the chain of custody and flags the video at once because systems overwrite.

    Source: 16 CCR 643 Preserving the Incident Scene; chain-of-custody documentation principleReport a problem with this question

23. 23. A tanker leaks chlorine on the street outside your five-story office building and the plume is drifting toward it. You should:

    • A.evacuate everyone through the street-level exits to the outdoor assembly point across the lot
    • B.keep the HVAC running to push clean air in and hold occupants in the ground-floor lobby
    • C.move occupants to an upper interior floor, shut down the HVAC and seal gaps around the doors✓ Answer
    • D.move occupants to the basement, since heavier-than-air gas will stay above them at street level

    In a chemical release the outside air is the hazard, so occupants shelter in place by moving inward and upward away from ground level, with the HVAC shut down so the building stops drawing the plume inside.

    Source: Ready.gov / CISA shelter-in-place for a chemical release — go inside and up, seal the room, shut off HVACReport a problem with this question

24. 24. Two people are stuck in an elevator between floors. Neither is injured, but one is becoming agitated. You should:

    • A.pry the doors open with a bar so they can step down to the floor below and end the entrapment
    • B.cut power to the car so it cannot move, then leave them to wait for the service technician
    • C.talk with them continuously, tell them help is on the way, and call the elevator service company✓ Answer
    • D.climb onto the car roof and open the hatch so they get air and can be lifted out from above

    Elevator entrapment is not itself a medical emergency, and self-rescue kills: forcing doors or exiting through the hatch puts people in a shaft with a car that can move, so contact is kept and the service company called.

    Source: Elevator entrapment response standard — no self-rescue; call elevator service, fire department if medicalReport a problem with this question

25. 25. A terminated employee returns to the lobby, is shouting, and steps toward the receptionist. As an unarmed guard you should:

    • A.keep an arm's-length gap and an even tone, offer a choice of where to talk, and call for help✓ Answer
    • B.close the distance and take hold of an arm to guide the person out before this goes further
    • C.match the volume so the person knows you are in charge and order them off the property now
    • D.step back behind the desk and say nothing until police arrive, since words will only escalate

    De-escalation works through time, distance and cover: holding a reactionary gap, keeping a calm tone and offering choices instead of ultimatums while help is summoned; an unarmed guard uses hands only against imminent danger.

    Source: BSIS Powers to Arrest manual, de-escalation concepts; 16 CCR 643 Workplace Violence courseReport a problem with this question

Practice questions cover the uniform security-guard training core (observe-and-report, legal limits, emergencies). Not affiliated with any state agency. State licensing requirements and statutes vary — study your state's official course. Guard licensing info →