A web application uses 'security questions' (mother's maiden name, first pet's name) as the sole backup authentication factor. What are the key security weaknesses of this approach?

• A.Security question answers are often stored in plaintext in a separate table (an unsalted copy of each reply), and an attacker with read access to the database can use them directly, though NIST SP 800-63B accepts knowledge-based authentication when the answers are hashed. Alternatives: a hardware token, a push prompt, or an SMS message with a limited window, each rated below a memorized secret by the standard's authenticator tables
• B.The main weakness is usability: answers are case sensitive (users mistype 'Smith' with a lowercase s), and lockouts often follow after a few wrong attempts, the property NIST SP 800-63B objects to most in recovery flows when a customer calls the helpdesk after a failed attempt
• C.Security question answers are often guessable (public information from social media, genealogy sites), discoverable via social engineering, shared across multiple sites (same answer to 'mother's maiden name' everywhere), and easily found through data breaches. NIST SP 800-63B deprecated knowledge-based authentication (KBA) for these reasons. Alternatives: backup codes, hardware tokens, SMS/email OTP with limited window