CompTIA CySA+ (CS0-004) practice questions: the prompt for ChatGPT, Claude and Gemini

You are writing exam-style multiple-choice practice questions for me. I am preparing for CompTIA CySA+ (CS0-004), set by CompTIA. Write questions that match the real exam's content, difficulty and style, drawn from the current official syllabus.

Write 20 questions. Each must be a standalone multiple-choice question that can be answered from its own stem and options, with exactly the right answer(s) marked and nothing ambiguous.

Set each question's `topic` to one of these names, copied exactly (same words, same capitalization; these are the only topic names the import accepts):
- Security Operations (subtopics: Explain concepts related to system and network architecture in security operations; Given a scenario, analyze indicators of potential malicious activity; Given a scenario, use tools to determine malicious activity; Explain threat intelligence and threat-hunting concepts; Explain the importance of efficiency and process improvement in security operations; Summarize concepts related to the use of AI in security operations)
- Vulnerability Management (subtopics: Given a scenario, implement the appropriate vulnerability scanning method; Given a scenario, analyze output from vulnerability assessment tools; Given a scenario, analyze data to prioritize and mitigate vulnerabilities; Explain concepts related to control types, risks, and vulnerability management)
- Incident Response and Management (subtopics: Summarize concepts related to attack methodology frameworks; Summarize the incident response process; Given a scenario, implement incident response techniques)
- Reporting and Communication (subtopics: Explain the importance of vulnerability management reporting and communication; Explain the importance of security operations and incident response reporting and communication)
Where subtopics are listed, set `subtopic` to one of them; otherwise choose a short, specific `subtopic` of your own or leave it out.

Spread the questions across the topics in the real exam's proportions, about:
- Security Operations: 7 (34% of the real exam)
- Vulnerability Management: 5 (26% of the real exam)
- Incident Response and Management: 5 (24% of the real exam)
- Reporting and Communication: 3 (16% of the real exam)

Give each question between 4 and 6 options. Options are plain text without letter prefixes (DoMcq labels them A, B, C… by position); make them similar in length and form so the right one does not stand out.
Write the real exam's two kinds of multiple-choice item, as CompTIA's own CySA+ practice questions show them. Most are single answer: exactly one correct option, so `answer` is a single letter, and almost always exactly 4 options (CompTIA's samples give a single-answer question 5 options only now and then, never 6). A few are multiple response: 5 or 6 options, two or more of them correct and at least one incorrect, and the stem says how many to choose ("Choose TWO.", "Choose THREE."); `answer` lists every correct letter in ascending order ("BD").
Never use these as an option: "all of the above", "none of the above". Avoid "both A and B" style options too.

Write stems the way the real exam does, for example: "Which of the following attacks has most likely occurred?"; "Which of the following is the next step?"; "Which of the following processes requires further investigation?"; "Which of the following should the analyst take into consideration for future scans?".
Keep each stem self-contained (any scenario the question needs is in the stem), concrete and free of trick wording. Do not refer to other questions, images, tables or exhibits.
Every item is a standard multiple-choice question: do not write performance-based, drag-and-drop items.

Mix the difficulty: about 6 easy, 10 medium and 4 hard, and set each question's `difficulty` to "easy", "medium" or "hard" accordingly.

In `explanation`, say in two to four sentences why the correct answer is correct, in a way that teaches the underlying point, not just restates the option.

In `source`, give a short reference I can check in my own study materials (a syllabus topic, a chapter or section name, a learning objective, or a standard's clause), at most 200 characters; never invent a page number or a quotation.

Leave out `rationales` and `id`.

Before you answer, check your own work: no two questions ask the same thing; no question gives away another's answer; the correct option sits in a different position from one question to the next (never always the same letter); every `answer` letter exists for that question; the correct option is correct according to the current official material, not folklore; facts are accurate. Fix anything you find.

Output the whole set as one JSON object in the `domcq/1` format (schema: https://domcq.com/schema/v1; this is the import format of https://domcq.com):

```json
{
  "format": "domcq/1",
  "exam": "comptia-cysa",
  "set": "CompTIA CySA+ (CS0-004) practice – [a short name for this set]",
  "questions": [
    {
      "stem": "[the question, 10–2000 characters]",
      "options": [
        "[option 1]",
        "[option 2]",
        "[option 3]",
        "[option 4]"
      ],
      "answer": "B",
      "explanation": "[why the correct answer is correct, 1–3000 characters]",
      "topic": "Security Operations",
      "subtopic": "[optional, more specific]",
      "difficulty": "medium",
      "source": "[a reference I can check]"
    }
  ]
}
```

Rules the import enforces: `format` is exactly "domcq/1"; `set` is 1–120 characters; `questions` holds all 20; each question has exactly the fields shown (no others); `stem` is 10–2000 characters and each option 1–500; `options` are all different; `answer` uses capital letters A–F naming options by position, in ascending order, never every option; `explanation` (1–3000 characters) and `topic` are required; `subtopic` (up to 120 characters), `difficulty` ("easy", "medium" or "hard") and `source` (up to 200 characters) are optional. Use plain double quotes in JSON strings (escape any inside text as \"), no trailing commas, no comments.

Reply with the JSON object inside a single ```json code fence and nothing else: no introduction, no commentary, no notes after it. If the set is long, keep going until every question is written and the JSON is complete and closed.