Certified Information Security Manager® (CISM®) practice questions: the prompt for ChatGPT, Claude and Gemini

You are writing exam-style multiple-choice practice questions for me. I am preparing for Certified Information Security Manager (CISM), set by ISACA. Write questions that match the real exam's content, difficulty and style, drawn from the current official syllabus.

Write 20 questions. Each must be a standalone multiple-choice question that can be answered from its own stem and options, with exactly the right answer(s) marked and nothing ambiguous.

Set each question's `topic` to one of these names, copied exactly (same words, same capitalization; these are the only topic names the import accepts):
- Information Security Governance (subtopics: Organizational Culture; Legal, Regulatory, and Contractual Requirements; Organizational Structures, Roles, and Responsibilities; Information Security Strategy Development; Information Governance Frameworks and Standards; Strategic Planning (e.g., budgets, resources, business case))
- Information Security Risk Management (subtopics: Emerging Risk and Threat Landscape; Vulnerability and Control Deficiency Analysis; Risk Assessment and Analysis; Risk Treatment / Risk Response Options; Risk and Control Ownership; Risk Monitoring and Reporting)
- Information Security Program (subtopics: Information Security Program Resources (e.g., people, tools, technologies); Information Asset Identification and Classification; Industry Standards and Frameworks for Information Security; Information Security Policies, Procedures, and Guidelines; Information Security Program Metrics; Information Security Control Design and Selection; Information Security Control Implementation and Integrations; Information Security Control Testing and Evaluation; Information Security Awareness and Training; Management of External Services (e.g., providers, suppliers, third parties, fourth parties); Information Security Program Communications and Reporting)
- Incident Management (subtopics: Incident Response Plan; Business Impact Analysis (BIA); Business Continuity Plan (BCP); Disaster Recovery Plan (DRP); Incident Classification/Categorization; Incident Management Training, Testing, and Evaluation; Incident Management Tools and Techniques; Incident Investigation and Evaluation; Incident Containment Methods; Incident Response Communications (e.g., reporting, notification, escalation); Incident Eradication and Recovery; Post-incident Review Practices)
Where subtopics are listed, set `subtopic` to one of them; otherwise choose a short, specific `subtopic` of your own or leave it out.

Spread the questions across the topics in the real exam's proportions, about:
- Information Security Governance: 3 (17% of the real exam)
- Information Security Risk Management: 4 (20% of the real exam)
- Information Security Program: 7 (33% of the real exam)
- Incident Management: 6 (30% of the real exam)

Give each question exactly 4 options. Options are plain text without letter prefixes (DoMcq labels them A, B, C… by position); make them similar in length and form so the right one does not stand out.
Every question has exactly one correct option; `answer` is a single letter.
Never use these as an option: "all of the above", "none of the above". Avoid "both A and B" style options too.

Write stems the way the real exam does, for example: "Which of the following would be the BEST approach of the information security manager?"; "Which of the following may BEST be expected from this remediation?".
Keep each stem self-contained (any scenario the question needs is in the stem), concrete and free of trick wording. Do not refer to other questions, images, tables or exhibits.

Mix the difficulty: about 6 easy, 10 medium and 4 hard, and set each question's `difficulty` to "easy", "medium" or "hard" accordingly.

In `explanation`, say in two to four sentences why the correct answer is correct, in a way that teaches the underlying point, not just restates the option.

In `source`, give a short reference I can check in my own study materials (a syllabus topic, a chapter or section name, a learning objective, or a standard's clause), at most 200 characters; never invent a page number or a quotation.

Leave out `rationales` and `id`.

Before you answer, check your own work: no two questions ask the same thing; no question gives away another's answer; the correct option sits in a different position from one question to the next (never always the same letter); every `answer` letter exists for that question; the correct option is correct according to the current official material, not folklore; facts are accurate. Fix anything you find.

Output the whole set as one JSON object in the `domcq/1` format (schema: https://domcq.com/schema/v1; this is the import format of https://domcq.com):

```json
{
  "format": "domcq/1",
  "exam": "cism",
  "set": "Certified Information Security Manager (CISM) practice – [a short name for this set]",
  "questions": [
    {
      "stem": "[the question, 10–2000 characters]",
      "options": [
        "[option 1]",
        "[option 2]",
        "[option 3]",
        "[option 4]"
      ],
      "answer": "B",
      "explanation": "[why the correct answer is correct, 1–3000 characters]",
      "topic": "Information Security Governance",
      "subtopic": "[optional, more specific]",
      "difficulty": "medium",
      "source": "[a reference I can check]"
    }
  ]
}
```

Rules the import enforces: `format` is exactly "domcq/1"; `set` is 1–120 characters; `questions` holds all 20; each question has exactly the fields shown (no others); `stem` is 10–2000 characters and each option 1–500; `options` are all different; `answer` uses capital letters A–F naming options by position, in ascending order, never every option; `explanation` (1–3000 characters) and `topic` are required; `subtopic` (up to 120 characters), `difficulty` ("easy", "medium" or "hard") and `source` (up to 200 characters) are optional. Use plain double quotes in JSON strings (escape any inside text as \"), no trailing commas, no comments.

Reply with the JSON object inside a single ```json code fence and nothing else: no introduction, no commentary, no notes after it. If the set is long, keep going until every question is written and the JSON is complete and closed.