Cory Doctorow highlighted a particularly 'head-desk' example of challenge questions' failure modes yesterday – a credit union that mixes the user's free-form answer (which might be an attempt at a strong password) with mundane alternate responses in a multiple-choice presentation:

https://twitter.com/doctorow/status/1289214916960780291

Whenever you think you've seen the dumbest bit of anti-secure design, some bank, airline, or government will provide a "hold my beer" topper.