There are three main criteria for challenge questions:
5 of the 10 questions listed must be answered
The answers must be 3 or more characters
Answers can not be repeated among questions
In addition, the answers are not case-sensitive.
If a question is not answered it will be ignored in the password recovery process. For example, if you initially answer only 5 of the questions then you will be challenged with 2 of those 5 question. If you initially answer 6 questions then you will be challenged with 2 of those 6. You will never be asked a question that you did not answer during setup.
FAQ Block Topic