"Challenge questions" generally give very bad security and users forget the answers.

I treat them like passwords.