Certified in Risk and Information Systems Control® (CRISC®) practice questions: the prompt for ChatGPT, Claude and Gemini

You are writing exam-style multiple-choice practice questions for me. I am preparing for Certified in Risk and Information Systems Control (CRISC), set by ISACA. Write questions that match the real exam's content, difficulty and style, drawn from the current official syllabus.

Write 20 questions. Each must be a standalone multiple-choice question that can be answered from its own stem and options, with exactly the right answer(s) marked and nothing ambiguous.

Set each question's `topic` to one of these names, copied exactly (same words, same capitalization; these are the only topic names the import accepts):
- Governance (subtopics: Strategy, Goals, and Objectives; Organizational Structure, Roles, and Responsibilities; Organizational Culture and Ethics; Policies and Standards; Business Processes and Resilience (e.g., DRP, BCP); Organizational Asset Management; Enterprise Risk Management (ERM); Lines of Defense; Risk Profile; Risk Appetite and Risk Tolerance; Risk Frameworks, Legal, Regulatory, and Contractual Requirements)
- Risk Assessment (subtopics: Risk Events; Threat Modeling and Threat Landscape; Vulnerability Management; Risk Scenario Development and Evaluation; Risk Assessment Concepts and Standards; Business Impact Analysis (BIA); Risk Register; Risk Analysis Methodologies; Inherent and Residual Risk)
- Risk Response and Reporting (subtopics: Risk Response Options; Risk and Control Ownership; Vendor/Supply Chain Risk Management; Issues, Findings, Exceptions and Exemptions Management; Control Frameworks, Types, and Standards; Control Design, Selection, Implementation, and Analysis; Control Testing Methodologies; Risk Action Plans; Data Collection, Aggregation, Analysis, and Validation; Risk and Control Metrics (e.g., KRIs, KCIs, KPIs); Risk and Control Monitoring Techniques; Risk and Control Reporting Techniques (e.g., heatmap, scorecards, dashboards); Monitoring and Reporting of Emerging Risks)
- Technology and Security (subtopics: Technology Roadmaps and Enterprise Architecture (EA); Operations Management (e.g., change management, assets, DevOps, problems, incidents); System Development Life Cycle (SDLC); Data Lifecycle Management; Portfolio and Project Management (e.g. Agile); Technology Resilience and Disaster Response/Recovery; Emerging Technologies; Security Concepts, Frameworks, and Standards; Security/Risk Awareness and Training; Data Privacy and Data Protection Principles)
Where subtopics are listed, set `subtopic` to one of them; otherwise choose a short, specific `subtopic` of your own or leave it out.

Spread the questions across the topics in the real exam's proportions, about:
- Governance: 5 (26% of the real exam)
- Risk Assessment: 5 (22% of the real exam)
- Risk Response and Reporting: 6 (32% of the real exam)
- Technology and Security: 4 (20% of the real exam)

Give each question exactly 4 options. Options are plain text without letter prefixes (DoMcq labels them A, B, C… by position); make them similar in length and form so the right one does not stand out.
Every question has exactly one correct option; `answer` is a single letter.
Never use these as an option: "all of the above", "none of the above". Avoid "both A and B" style options too.

Write stems the way the real exam does, for example: "Which of the following is MOST important to determine when defining risk management strategies?"; "Which of the following BEST ensures that appropriate mitigation occurs on identified information systems vulnerabilities?"; "The GREATEST risk posed by an absence of strategic planning is:".
Keep each stem self-contained (any scenario the question needs is in the stem), concrete and free of trick wording. Do not refer to other questions, images, tables or exhibits.

Mix the difficulty: about 6 easy, 10 medium and 4 hard, and set each question's `difficulty` to "easy", "medium" or "hard" accordingly.

In `explanation`, say in two to four sentences why the correct answer is correct, in a way that teaches the underlying point, not just restates the option.

In `source`, give a short reference I can check in my own study materials (a syllabus topic, a chapter or section name, a learning objective, or a standard's clause), at most 200 characters; never invent a page number or a quotation.

Leave out `rationales` and `id`.

Before you answer, check your own work: no two questions ask the same thing; no question gives away another's answer; the correct option sits in a different position from one question to the next (never always the same letter); every `answer` letter exists for that question; the correct option is correct according to the current official material, not folklore; facts are accurate. Fix anything you find.

Output the whole set as one JSON object in the `domcq/1` format (schema: https://domcq.com/schema/v1; this is the import format of https://domcq.com):

```json
{
  "format": "domcq/1",
  "exam": "crisc",
  "set": "Certified in Risk and Information Systems Control (CRISC) practice – [a short name for this set]",
  "questions": [
    {
      "stem": "[the question, 10–2000 characters]",
      "options": [
        "[option 1]",
        "[option 2]",
        "[option 3]",
        "[option 4]"
      ],
      "answer": "B",
      "explanation": "[why the correct answer is correct, 1–3000 characters]",
      "topic": "Governance",
      "subtopic": "[optional, more specific]",
      "difficulty": "medium",
      "source": "[a reference I can check]"
    }
  ]
}
```

Rules the import enforces: `format` is exactly "domcq/1"; `set` is 1–120 characters; `questions` holds all 20; each question has exactly the fields shown (no others); `stem` is 10–2000 characters and each option 1–500; `options` are all different; `answer` uses capital letters A–F naming options by position, in ascending order, never every option; `explanation` (1–3000 characters) and `topic` are required; `subtopic` (up to 120 characters), `difficulty` ("easy", "medium" or "hard") and `source` (up to 200 characters) are optional. Use plain double quotes in JSON strings (escape any inside text as \"), no trailing commas, no comments.

Reply with the JSON object inside a single ```json code fence and nothing else: no introduction, no commentary, no notes after it. If the set is long, keep going until every question is written and the JSON is complete and closed.