A web application uses 'security questions' (mother's maiden name, first pet's name) as the sole backup authentication factor. What are the key security weaknesses of this approach?

• A.Security questions are too difficult for users to remember, causing account lockouts
• B.Security question answers are often guessable (public information from social media, genealogy sites), discoverable via social engineering, shared across multiple sites (same answer to 'mother's maiden name' everywhere), and easily found through data breaches. NIST SP 800-63B deprecated knowledge-based authentication (KBA) for these reasons. Alternatives: backup codes, hardware tokens, SMS/email OTP with limited window
• C.Security questions require database storage which introduces SQL injection risk
• D.Security questions are only insecure on mobile platforms; desktop browsers protect them