Pass the IBFCSM Emergency and Disaster Professional CEDP Questions and answers with CertsForce

TheThreat and Hazard Identification and Risk Assessment (THIRA)is a specific, standardized process defined byFEMA in CPG 201. While maintaining and updating the document is a best practice for emergency managers, "Updating the threat list annually" (Option C) is a maintenance task or a requirement for grant compliance, but it is not one of the specific, analyticalstepsthat constitute the THIRA methodology itself.

The four steps of the THIRA process are:

Identify Threats and Hazards:Determine the specific natural, technological, and human-caused threats that could affect the community.

Give Threats and Hazards Context:Describe how those threats would affect the community at a specific time and place (e.g., "A magnitude 7.0 earthquake at 2:00 PM on a Tuesday").

Establish Capability Targets:Determine what the community needs to be able to do to manage that impact (e.g., "We must be able to rescue 500 people from collapsed buildings within 24 hours").

Estimate Resource Requirements:Determine the specific personnel and equipment needed to meet those targets.

For theCEDPexam, it is vital to distinguish between theprocessof doing the work and theadministrationof the document. Options A and B are the core "First" and "Third" steps of the analytical process. By confusing an administrative requirement (annual updates) with a process step, jurisdictions can fail to perform the deeper contextual analysis required by Step 2. The THIRA is designed to be a "risk-informed" foundation for the entireNational Preparedness System, and understanding its technical steps ensures that a community's preparedness goals are based on realistic, data-driven impacts rather than arbitrary list-making.

TheSelf-Contained Breathing Apparatus (SCBA)is the gold standard for respiratory protection inImmediately Dangerous to Life or Health (IDLH)environments because it provides the highest level of protection while maintaining maximumwearer flexibility. Unlike an air-purifying respirator (Option A), which only filters the air around the user and cannot be used in oxygen-deficient or highly toxic IDLH atmospheres, the SCBA provides a completely independent supply of Grade D breathing air.

While aLine Supplied Air Respirator (SAR)(Option B) also provides clean air, it severely limits flexibility because the wearer is "tethered" to a stationary air source by a hose (usually limited to 300 feet). If the hose becomes tangled, kinked, or severed, the wearer is in immediate danger. An SCBA allows the responder to move freely through complex disaster environments, such as collapsed buildings or hazardous chemical warehouses, without being restricted by an umbilical line.

According toOSHA 29 CFR 1910.134andNFPA 1981, any atmosphere that is unknown or contains concentrations of toxins above the IDLH level requires either a full-facepiece, positive-pressure SCBA or a combination SAR with an auxiliary self-contained air supply (an "escape bottle"). For theCEDPprofessional, selecting the right Personal Protective Equipment (PPE) is a critical life-safety decision. The SCBA is the only option that offers the mobility required for active search and rescue or fire suppression while ensuring the responder is not breathing the contaminated ambient air. This "self-contained" nature is what provides the tactical flexibility necessary for dynamic emergency operations where the hazards are unpredictable.

In the context of theNational Incident Management System (NIMS), the termInformation Managementspecifically describes the systematic process of gathering, analyzing, and disseminating emergency-related data. Information management is the backbone of theCommon Operating Picture (COP); without it, decision-makers are operating "in the dark" without a clear understanding of the incident's scope, resource status, or hazard progression.

Information management is distinct fromCommunication management(Option A), which focuses more on thehardwareandinfrastructureused to transmit data (e.g., radio frequencies and network interoperability).Knowledge assessment(Option B) is not a standard NIMS term. Information management involves several key steps:

Collection:Gathering raw data from the field (911 calls, responder reports, sensors).

Analysis:Turning that raw data into "intelligence" by identifying trends and impacts.

Dissemination:Getting the analyzed information to the right people (the Incident Commander, public officials, or the general public) at the right time.

For aCEDPprofessional, effective information management is what prevents "information overload." During a disaster, thousands of pieces of data flow into the Emergency Operations Center. The Information Management function (typically led by thePlanning Section) filters this data to ensure that the Incident Commander receives only the critical "actionable" information needed to make life-safety decisions. This process ensures that the "right information" gets to the "right person" at the "right time" in the "right format," which is the fundamental goal of any disaster information system.

TheGround Fault Circuit Interrupter (GFCI)is a life-safety device specifically designed to protect people from electrical shock. According toOSHA 29 CFR 1910.304, a GFCI works by constantly monitoring the current flowing through a circuit. It compares the amount of current going to an electrical component with the amount returning from it. In a normally functioning circuit, these two values should be nearly identical. However, if the GFCI detects a difference as small as 4 to 6 milliamperes—indicating that some of the current is "leaking" out of the circuit through an unintended path, such as a human body touching a conductive surface—it will break the circuit in as little as 1/30th of a second.

It is essential for disaster professionals to distinguish a GFCI from a standardCircuit Breaker(Option C). A circuit breaker is designed to protectequipment and the building structurefrom fires caused by overloads or short circuits; it typically only trips when the current exceeds 15 or 20 amperes. This level of current is far above the "let-go" threshold for humans and can be fatal. A GFCI, by contrast, is a "personnel protection" device.Voltage interrupters(Option A) is a generic term that does not refer to this specific safety technology.

In disaster management, GFCIs are mandatory for all temporary power setups, particularly in wet or damp environments common after floods or storms. Under theNational Electrical Code (NEC)andNFPA 70E, GFCIs must be used with portable generators and power tools on-site. TheCEDPcurriculum emphasizes that "stray voltage" is a major hazard in disaster zones. By ensuring all power sources are GFCI-protected, emergency managers mitigate the risk of accidental electrocution for both responders and victims who may be navigating flooded structures or using emergency power systems.

The most accurate statement regarding modern emergency operations planning is that it should beorganized around functions and not hazards. This is the core principle of theAll-Hazards Approachadvocated byFEMA in CPG 101(Comprehensive Preparedness Guide). A functional EOP focuses on the capabilities that a community needs to respond toanyincident (e.g., Communications, Evacuation, Mass Care, Public Information) rather than creating separate, redundant plans for every possible hazard (e.g., a "Flood Plan," a "Fire Plan," a "Tornado Plan").

A functional organization is more efficient for several reasons:

Simplicity:It avoids duplicating common activities that are required in almost every disaster (e.g., searching for victims).

Flexibility:A functional plan can be adapted to novel or unexpected threats (like a pandemic or a new type of cyber-attack) because the "building blocks" of the response are already in place.

Training:Responders only need to learn one set of procedures for their function (e.g., "Transportation") regardless of the cause of the disaster.

While the EOP isinformedby the Hazard Vulnerability Analysis (HVA), the response is not "limited" to those events (Option A); a good plan must be adaptable to the unknown. Similarly, while an EOP includes recovery elements, its primary focus is theResponsephase; detailed recovery p2lanning is often handled in a separate3Long-Term Recovery Plan(Option C). For aCEDPprofessional, the functional EOP is the "Swiss Army Knife" of emergency management. By perfecting the "Functional Annexes," a jurisdiction ensures it has a robust, scalable capability that can be deployed at a moment's notice to manage any challenge, fulfilling the mission of "All-Hazards" resilience.

TheCenters for Disease Control and Prevention (CDC), in collaboration with the American Water Works Association (AWWA), is the primary agency that publishes technical guidelines for hospital emergency water management.1Their seminal document, theEmergency Water Supply Planning Guide for Hospitals and Healthcare Facilities, provides a comprehensive roadmap for healthcare institutions to prepare for and respond to water supply interruptions.2

While CMS (Option C) mandates that hospitals have an emergency preparedness plan to maintain accreditation, they do not provide the granular technical guidance found in the CDC materials. The CDC guidelines focus on the public health implications of water loss, emphasizing the "four-step process" for developing an Emergency Water Supply Plan (EWSP): performing a water use audit, analyzing alternatives, developing the plan, and exercising it. These guidelines help hospitals calculate the minimum amount of water needed for patient care, sanitation, HVAC (chillers), and laundry during a crisis.

For the CEDP professional, the CDC’s water management guidelines are critical because a hospital cannot function without water for more than a few hours. The guidance includes specific advice on "Short-term" versus "Long-term" alternatives, such as using municipal backup lines, private wells, or tankered water. It also details the chemical and microbiological monitoring required when transitioning between water sources to prevent outbreaks of waterborne illnesses likeLegionella. By following CDC standards, disaster professionals ensure that even when the municipal grid fails, the clinical and life-support systems of the facility remain safe for patients and staff.

TheFederal Interagency Operational Plans (FIOPs)are the documents that describe theConcept of Operations (CONOPS)for how the federal government delivers the 32 Core Capabilities described in the National Preparedness Goal.4While the National Response Framework (NRF) provides the "high-level doctrine," the FIOPs provide the "operational detail" for federal agencies to work together and with state/local partners. There is a specific FIOP for each of the five mission areas: Prevention, Protection, Mitigation, Response, and Recovery.5

The FIOPs describe:

Critical Tasks:Specific actions that must be taken to deliver a core capability.

Responsibilities:Which federal department or agency (e.g., FEMA, HHS, EPA) is responsible for which task under variousEmergency Support Functions (ESFs).

Resource Requirements:The types and quantities of resources typically needed for a "national-level" response.

Integration:How federal operations mesh with state, local, tribal, and territorial (SLTT) efforts, as well as the private sector.

For theCEDPcandidate, the FIOP is the "How-To" manual for federal integration. Option A is partially correct in sentiment, but FIOPs are designed around known core capabilities, not just "unseen contingencies." Option C refers specifically to Healthcare Coalitions, which are addressed inASPRdocuments rather than the broader interagency FIOPs. By detailing theConcept of Operations, the FIOPs ensure that when a federal disaster is declared, the massive machinery of the U.S. government moves in a synchronized, predictable fashion.6It ensures that the "Tiered Response" is not just a theory, but a functional reality where federal support is tailored to the specific gaps identified by local and state commanders on the ground.

Under theUnited States Constitutionand theStafford Act, the federal government generally doesnotexercise "Command Authority" over state or local governments. The principle ofTiered Responsedictates that incidents are managed at the lowest possible jurisdictional level, with the federal government providing "support and coordination." However, in specific situations involvingBio-terrorism(Option C) or other acts of terrorism, the federal government may assume a lead "Command" role through theFBI(for investigation/law enforcement) and theDepartment of Defense(if the situation is deemed an act of war or a threat to national security).

In a natural disaster (Option A) or a pandemic (Option B), the federal government's role is governed byEmergency Support Functions (ESFs)where they act as "Coordinators." For example, during a pandemic, the CDC provides guidance and the ASPR manages the stockpile, but the actual "Police Power" (the authority to mandate masks or lockdowns) remains with the Governors of the states. It is only when an incident transitions from a "Civil Disaster" to a "National Security Threat" (like a biological attack) that the federal government invokes specific authorities under theNational Strategy for Homeland Securityto take a more direct "Command" stance regarding the neutralization of the threat.

For theCEDPcandidate, it is crucial to understand that even when the federal government "takes the lead" in a bio-terrorism event, they typically do so through aUnified Commandstructure. They do not "order" local fire departments or police to act; rather, they integrate their assets to solve a problem that is beyond the scope of a single state. The only exception where "Command" is truly vertical from the federal level is during afederalization of the National Guardor in "Exclusive Federal Jurisdictions" (like military bases or federal buildings). Understanding these jurisdictional boundaries prevents "Command Confusion" during a multi-state crisis and ensures that local leaders understand they retain their constitutional authority even when a massive federal presence is on the ground.

In the event of a building fire, elevator safety and communication are governed byASME A17.1 (Safety Code for Elevators and Escalators)and theNFPA 101 (Life Safety Code). These codes require that two-way emergency communication systems between the elevator car and a constantly attended central location (such as a security desk or an off-site monitoring service) be maintained for a minimum of60 minutesduring a power failure or fire emergency. While the primary communication systems must have back-up power for a longer duration (often 4 hours for voice), the specific operational survival and signaling requirement for the two-way emergency system and its audible alarm often centers on the 60-minute mark to ensure that passengers trapped during a fire-related shutdown can be located and comforted by rescue personnel.

The 60-minute duration is critical because elevator cars often enter "Phase I Emergency Recall" or "Phase II Emergency In-Car Operation" during a fire. If a car becomes stuck between floors due to a power outage or mechanical failure caused by the fire, the occupants' only link to the outside world is the emergency phone. Providing a minimum of one hour of operational time allows fire departments and building engineers to prioritize their initial life-safety tasks while maintaining contact with anyone potentially trapped in the vertical transport system.

For aCEDPprofessional or a Facility Safety Manager, verifying this 60-minute communication capability is a vital part of theHazard Vulnerability Analysis (HVA)for high-rise structures. If the battery backup for the elevator's internal communication panel fails before this time, it creates a "communication blackout," significantly increasing the risk of panic and complicating the rescue mission. This standard ensures that even if the building's main power grid is compromised by the fire, the "lifeline" to the elevator remains intact long enough for theIncident Commandto execute a coordinated extraction.

In the immediate aftermath of a cyber-attack, the operational focus is governed by the "Containment, Eradication, and Recovery" cycle defined by theNIST Special Publication 800-61 (Computer Security Incident Handling Guide). Within this framework,Reporting to local law enforcement(Option C) is considered the lowest operational priority relative to the immediate technical response. While reporting is an essential legal and compliance step, it does not stop the spread of malware or restore critical business functions.

The highest priority is alwaysDefining the scope and impact(Option A) because you cannot fix what you have not identified. This involves forensic analysis to determine which systems are compromised and whether the attack is ongoing. Following closely isIsolating affected systems(Option B), which is a "Life Safety" equivalent in the digital world. By disconnecting infected servers or segments of the network, the incident response team prevents the "lateral movement" of the attacker, thereby protecting remaining assets and preparing for the restoration of services.

According to theIBFCSM CEDPbody of knowledge, emergency managers must distinguish between "Technical Response" and "Investigative Support." Law enforcement’s primary goal is the preservation of evidence for prosecution, which can sometimes conflict with the organization’s need for rapid service restoration. Therefore, a well-designed Incident Response Plan (IRP) ensures that the technical team stabilizes the "patient" (the network) first. Only once the threat is neutralized and the impact is understood should the organization transition its resources toward external reporting and legal proceedings. For most local cyber incidents, federal agencies (like the FBI or CISA) are often more relevant than local law enforcement, further lowering the priority of a "local" report during the high-stress execution phase of the response.