CISSP® practice questions: the prompt for ChatGPT, Claude and Gemini

You are writing exam-style multiple-choice practice questions for me. I am preparing for CISSP, set by ISC2. Write questions that match the real exam's content, difficulty and style, drawn from the current official syllabus.

Write 20 questions. Each must be a standalone multiple-choice question that can be answered from its own stem and options, with exactly the right answer(s) marked and nothing ambiguous.

Set each question's `topic` to one of these names, copied exactly (same words, same capitalization; these are the only topic names the import accepts):
- Security and Risk Management (subtopics: Understand, adhere to, and promote professional ethics; Understand and apply security concepts; Evaluate and apply security governance principles; Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context; Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards); Develop, document, and implement security policy, standards, procedures, and guidelines; Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements; Contribute to and enforce personnel security policies and procedures; Understand and apply risk management concepts; Understand and apply threat modeling concepts and methodologies; Apply Supply Chain Risk Management (SCRM) concepts; Establish and maintain a security awareness, education, and training program)
- Asset Security (subtopics: Identify and classify information and assets; Establish information and asset handling requirements; Provision information and assets securely; Manage data lifecycle; Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support); Determine data security controls and compliance requirements)
- Security Architecture and Engineering (subtopics: Research, implement and manage engineering processes using secure design principles; Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula); Select controls based upon systems security requirements; Understand security capabilities of Information Systems (IS); Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements; Select and determine cryptographic solutions; Understand methods of cryptanalytic attacks; Apply security principles to site and facility design; Design site and facility security controls; Manage the information system lifecycle)
- Communication and Network Security (subtopics: Apply secure design principles in network architectures; Secure network components; Implement secure communication channels according to design)
- Identity and Access Management (IAM) (subtopics: Control physical and logical access to assets; Design identification and authentication strategy (e.g., people, devices, and services); Federated identity with a third-party service; Implement and manage authorization mechanisms; Manage the identity and access provisioning lifecycle; Implement authentication systems)
- Security Assessment and Testing (subtopics: Design and validate assessment, test, and audit strategies; Conduct security control testing; Collect security process data (e.g., technical and administrative); Analyze test output and generate report; Conduct or facilitate security audits)
- Security Operations (subtopics: Understand and comply with investigations; Conduct logging and monitoring activities; Perform Configuration Management (CM) (e.g., provisioning, baselining, automation); Apply foundational security operations concepts; Apply resource protection; Conduct incident management; Operate and maintain detection and preventative measures; Implement and support patch and vulnerability management; Understand and participate in change management processes; Implement recovery strategies; Implement Disaster Recovery (DR) processes; Test Disaster Recovery Plans (DRP); Participate in Business Continuity (BC) planning and exercises; Implement and manage physical security; Address personnel safety and security concerns)
- Software Development Security (subtopics: Understand and integrate security in the Software Development Life Cycle (SDLC); Identify and apply security controls in software development ecosystems; Assess the effectiveness of software security; Assess security impact of acquired software; Define and apply secure coding guidelines and standards)
Where subtopics are listed, set `subtopic` to one of them; otherwise choose a short, specific `subtopic` of your own or leave it out.

Spread the questions across the topics in the real exam's proportions, about:
- Security and Risk Management: 3 (16% of the real exam)
- Asset Security: 2 (10% of the real exam)
- Security Architecture and Engineering: 3 (13% of the real exam)
- Communication and Network Security: 3 (13% of the real exam)
- Identity and Access Management (IAM): 3 (13% of the real exam)
- Security Assessment and Testing: 2 (12% of the real exam)
- Security Operations: 2 (13% of the real exam)
- Software Development Security: 2 (10% of the real exam)

Give each question exactly 4 options. Options are plain text without letter prefixes (DoMcq labels them A, B, C… by position); make them similar in length and form so the right one does not stand out.
Every question has exactly one correct option; `answer` is a single letter.
Never use these as an option: "all of the above", "none of the above". Avoid "both A and B" style options too.

Keep each stem self-contained (any scenario the question needs is in the stem), concrete and free of trick wording. Do not refer to other questions, images, tables or exhibits.
Every item is a standard multiple-choice question: do not write advanced innovative questions items.

Mix the difficulty: about 6 easy, 10 medium and 4 hard, and set each question's `difficulty` to "easy", "medium" or "hard" accordingly.

In `explanation`, say in two to four sentences why the correct answer is correct, in a way that teaches the underlying point, not just restates the option.

In `source`, give a short reference I can check in my own study materials (a syllabus topic, a chapter or section name, a learning objective, or a standard's clause), at most 200 characters; never invent a page number or a quotation.

Leave out `rationales` and `id`.

Before you answer, check your own work: no two questions ask the same thing; no question gives away another's answer; the correct option sits in a different position from one question to the next (never always the same letter); every `answer` letter exists for that question; the correct option is correct according to the current official material, not folklore; facts are accurate. Fix anything you find.

Output the whole set as one JSON object in the `domcq/1` format (schema: https://domcq.com/schema/v1; this is the import format of https://domcq.com):

```json
{
  "format": "domcq/1",
  "exam": "cissp",
  "set": "CISSP practice – [a short name for this set]",
  "questions": [
    {
      "stem": "[the question, 10–2000 characters]",
      "options": [
        "[option 1]",
        "[option 2]",
        "[option 3]",
        "[option 4]"
      ],
      "answer": "B",
      "explanation": "[why the correct answer is correct, 1–3000 characters]",
      "topic": "Security and Risk Management",
      "subtopic": "[optional, more specific]",
      "difficulty": "medium",
      "source": "[a reference I can check]"
    }
  ]
}
```

Rules the import enforces: `format` is exactly "domcq/1"; `set` is 1–120 characters; `questions` holds all 20; each question has exactly the fields shown (no others); `stem` is 10–2000 characters and each option 1–500; `options` are all different; `answer` uses capital letters A–F naming options by position, in ascending order, never every option; `explanation` (1–3000 characters) and `topic` are required; `subtopic` (up to 120 characters), `difficulty` ("easy", "medium" or "hard") and `source` (up to 200 characters) are optional. Use plain double quotes in JSON strings (escape any inside text as \"), no trailing commas, no comments.

Reply with the JSON object inside a single ```json code fence and nothing else: no introduction, no commentary, no notes after it. If the set is long, keep going until every question is written and the JSON is complete and closed.