Back in 2007 I wrote a whitepaper on how to evaluate security questions which you are welcome to read in full but I'll summarize my thoughts here.
I applied five characteristics to evaluate security questions as authenticators, those being
Affordability is pretty consistent across all security questions, so I'll focus on the other four.
What percent of your users can truthfully answer the security question? If I have never had a pet I can't provide a truthful answer to 'What was your first pet's name?' There may be regional or cultural differences that make certain questions difficult to answer. For instance the question 'what state did you grow up in' doesn't apply to people whose countries don't have states. Privacy may also be a concern, depending on what the question is asking.
Memorability plays a role in usability, which I'll discuss further in the Accuracy section.
How different are the possible and likely answers users will give to the security question? If an answer isn’t unique enough then it provides unreliable authentication of the user’s identity. Asking 'what color are your eyes?' has a very limited number of possible answers. Asking 'what is your favorite color?' has more possible answers but has very predictable likely answers.
The better distributed the likely answers are in a sufficiently large pool of possibilities, the better the question tends to be. This is a difficult challenge to overcome for security questions since truthful answers to many questions will stand out as statistically more likely answers.
How difficult is it for users to avoid disclosing valid answers to a security question? Some answers to questions are not considered secrets and may be known to family, friends, coworkers, or even strangers with access to social networks.
This will also rely, in part, on the user’s commitment to keeping the security question answers a secret. A user will have to not only attempt to keep from providing answers to this question in the future, but will have to think about whether they've provided answers in the past that could be looked up. If they've disclosed an answer then the associated security question really shouldn't be considered appropriate to ever use again.
Integrity is also a very complicated challenge for security questions since they are, by design, based on non-secret information. Consider the difficulty of a user not disclosing the answer to a specific security question through normal behavior.
How frequently will the user successfully recall the security question answer and enter it correctly? This is related to usability. Ideally you want an answer that isn't going to change over time and one that is unlikely to be forgotten. Questions can usually be broken into the categories of facts and opinions. Facts are "what was your first pet's name" versus an opinion like "what is your favorite animal". As you might suspect facts seem to be a bit easier for people to remember than opinions.
Many security question systems ignore things like the case sensitivity or punctuation of answers, and may even allow character to be added or left off. If you set minimum answer lengths you may also force users to modify legitimately short answers into something that they may not recall later.
These factors can help you compare different security questions, but as others have pointed out there don't tend to be any really 'great' security questions because of their inherent limitations. I only recommend their use when you can eliminate the poorest questions and prompt users for valid answers to at least three at a time.
I actually was able to analyze real user security questions and answers last year and shared my findings in a few talks. The data supports a lot of our suspicions about uniqueness problems, and further discourages reliance on them for strong authentication.