I feel like you could have just asked them to type 'a'. If the threat was automated bots, all generic ones are defeated by a simple "do X" request. Especially if the request was in text, where a lazy human attacker could just copy paste.
One of our public facing systems I put up a silly "what is the capital of x country?" While we waited on some other stuff. I think it's still in production.
And to my knowledge no bot has gotten past it or even bothered.
we ask similar questions in my EMS (Paramedic) job to patients to determine if they're alert & oriented. Most providers ask name, year, location, president or something similar and many patients are used to being asked routine questions. I like to see if they can answer stuff like "Name a large city in Florida."