"Security questions" in general are an incredibly stupid idea.
Any time you create a password, it's routine advice to say that you should not use personal information for a password, like where you went to high school or your favorite color or the make car you drive, because a hacker trying to break into your account might be able to discover or guess these things. Instead, you should use a meaningless string of letters and digits, that should be impossible for anyone to guess.
But ... we understand that meaningless strings of letters and digits are hard to remember. So let's create security questions, which function effectively as alternate passwords, and for these we'll use something easy to remember, like where you went to high school or your favorite color or the make car you drive. Because while a hacker might try to guess this kind of personal information for a password, it would never in a million years occur to a hacker to try to guess the answer to a security question.
At least if you used some personal information for a password, the hacker wouldn't know whether you used your high school or your favorite color or a car make. But with security questions, we TELL him which it is.
If someone knows you, many security questions would be easy to find or guess. Maybe you moved here from another city, but there's a fair chance you grew up where you live now, so guessing high schools in the area would have a fair chance of getting a hit. He might know what model car you drive. If not, there aren't all that many different car makes. If you ask people for their favorite color, most people will name one of a dozen or so. (Well, most men, anyway. Women tend to know the names of far more colors than men do.)
One system I just created an account on recently limited their security questions to things with a fairly small number of possibilities, and then provided drop downs for each of them! So tell the hacker, here are the 20 possible passwords someone was allowed to choose from! I've seen systems that make me choose a password that is at least 8 characters because if I just typed in 6 or 7, that's only a few billion possibilities, and a hacker might get it with a brute force attack. But then let's have an alternate password where we helpfully list the 20 choices. That saves the hacker from having to worry about being tripped up by capitalization or mis-spelling.