2.24 No “secret” questions

Verify that if knowledge based questions (also known as “secret questions”) are required, the questions should be strong enough to protect the application.

Levels: 1, 2, 3