Certified Information Systems Auditor® (CISA®) practice questions: the prompt for ChatGPT, Claude and Gemini

You are writing exam-style multiple-choice practice questions for me. I am preparing for Certified Information Systems Auditor (CISA), set by ISACA. Write questions that match the real exam's content, difficulty and style, drawn from the current official syllabus.

Write 20 questions. Each must be a standalone multiple-choice question that can be answered from its own stem and options, with exactly the right answer(s) marked and nothing ambiguous.

Set each question's `topic` to one of these names, copied exactly (same words, same capitalization; these are the only topic names the import accepts):
- Information System Auditing Process (subtopics: IS Audit Standards, Guidelines, Functions, and Codes of Ethics; Types of Audits, Assessments, and Reviews; Risk-Based Audit Planning; Types of Controls and Considerations; Audit Project Management; Audit Testing and Sampling Methodology; Audit Evidence Collection Techniques; Audit Data Analytics (including audit algorithms); Reporting and Communication Techniques; Quality Assurance and Improvement of Audit Process)
- Governance and Management of IT (subtopics: Laws, Regulations, and Industry Standards; Organizational Structure, IT Governance, and IT Strategy; IT Policies, Standards, Procedures and Practices; Enterprise Architecture (EA) and Considerations; Enterprise Risk Management (ERM); Privacy Program and Principles; Data Governance and Classification; IT Resource Management; IT Vendor Management; IT Performance Monitoring and Reporting; Quality Assurance and Quality Management of IT)
- Information Systems Acquisition, Development, and Implementation (subtopics: Project Governance and Management; Business Case and Feasibility Analysis; System Development Methodologies; Control Identification and Design; System Readiness and Implementation Testing; Implementation Configuration and Release Management; System Migration, Infrastructure Deployment, and Data Conversion; Post-Implementation Review)
- Information Systems Operations and Business Resilience (subtopics: IT Components; IT Asset Management; Job Scheduling and Production Process Automation; System Interfaces; Shadow IT and End-User Computing (EUC); Systems Availability and Capacity Management; Problem and Incident Management; IT Change, Configuration, and Patch Management; Operational Log Management; IT Service Level Management; Database Management; Business Impact Analysis (BIA); System and Operational Resilience; Data Backup, Storage, and Restoration; Business Continuity Plan (BCP); Disaster Recovery Plans (DRP))
- Protection of Information Assets (subtopics: Information Asset Security Policies, Frameworks, Standards, and Guidelines; Physical and Environmental Controls; Identity and Access Management; Network and End-Point Security; Data Loss Prevention (DLP); Data Encryption; Public Key Infrastructure (PKI); Cloud and Virtualized Environments; Mobile, Wireless, and Internet-of-Things (IoT) Devices; Security Awareness Training and Programs; Information System Attack Methods and Techniques; Security Testing Tools and Techniques; Security Monitoring Logs, Tools, and Techniques; Security Incident Response Management; Evidence Collection and Forensics)
Where subtopics are listed, set `subtopic` to one of them; otherwise choose a short, specific `subtopic` of your own or leave it out.

Spread the questions across the topics in the real exam's proportions, about:
- Information System Auditing Process: 4 (18% of the real exam)
- Governance and Management of IT: 4 (18% of the real exam)
- Information Systems Acquisition, Development, and Implementation: 2 (12% of the real exam)
- Information Systems Operations and Business Resilience: 5 (26% of the real exam)
- Protection of Information Assets: 5 (26% of the real exam)

Give each question exactly 4 options. Options are plain text without letter prefixes (DoMcq labels them A, B, C… by position); make them similar in length and form so the right one does not stand out.
Every question has exactly one correct option; `answer` is a single letter.
Never use these as an option: "all of the above", "none of the above". Avoid "both A and B" style options too.

Write stems the way the real exam does, for example: "Which of the following actions should the IS auditor take?"; "Which of the following areas is the MOST important?"; "The IS auditor should:".
Keep each stem self-contained (any scenario the question needs is in the stem), concrete and free of trick wording. Do not refer to other questions, images, tables or exhibits.

Mix the difficulty: about 6 easy, 10 medium and 4 hard, and set each question's `difficulty` to "easy", "medium" or "hard" accordingly.

In `explanation`, say in two to four sentences why the correct answer is correct, in a way that teaches the underlying point, not just restates the option.

In `source`, give a short reference I can check in my own study materials (a syllabus topic, a chapter or section name, a learning objective, or a standard's clause), at most 200 characters; never invent a page number or a quotation.

Leave out `rationales` and `id`.

Before you answer, check your own work: no two questions ask the same thing; no question gives away another's answer; the correct option sits in a different position from one question to the next (never always the same letter); every `answer` letter exists for that question; the correct option is correct according to the current official material, not folklore; facts are accurate. Fix anything you find.

Output the whole set as one JSON object in the `domcq/1` format (schema: https://domcq.com/schema/v1; this is the import format of https://domcq.com):

```json
{
  "format": "domcq/1",
  "exam": "cisa",
  "set": "Certified Information Systems Auditor (CISA) practice – [a short name for this set]",
  "questions": [
    {
      "stem": "[the question, 10–2000 characters]",
      "options": [
        "[option 1]",
        "[option 2]",
        "[option 3]",
        "[option 4]"
      ],
      "answer": "B",
      "explanation": "[why the correct answer is correct, 1–3000 characters]",
      "topic": "Information System Auditing Process",
      "subtopic": "[optional, more specific]",
      "difficulty": "medium",
      "source": "[a reference I can check]"
    }
  ]
}
```

Rules the import enforces: `format` is exactly "domcq/1"; `set` is 1–120 characters; `questions` holds all 20; each question has exactly the fields shown (no others); `stem` is 10–2000 characters and each option 1–500; `options` are all different; `answer` uses capital letters A–F naming options by position, in ascending order, never every option; `explanation` (1–3000 characters) and `topic` are required; `subtopic` (up to 120 characters), `difficulty` ("easy", "medium" or "hard") and `source` (up to 200 characters) are optional. Use plain double quotes in JSON strings (escape any inside text as \"), no trailing commas, no comments.

Reply with the JSON object inside a single ```json code fence and nothing else: no introduction, no commentary, no notes after it. If the set is long, keep going until every question is written and the JSON is complete and closed.