Sometimes you get really rubbish security questions, that anyone whose known you for more than 5 minutes could answer about you. Sometimes, you get offered freeform security questions, where you have to make one up. Those can also be a struggle because the user will either divert to the standard “what’s your mothers maiden name” or get stuck trying to think of one.
I recently saw an example where I was asked to think of a security question, but was also prompted with some examples…
I found this to be an extremely effective solution. Allowing the user the increased security by not using the same security question that they’ve got on a number of other sites. And helping them to think of something unique.