I'm willing to bet that for many companies, it's part of their regulations or pushed by their security teams as a best practice. The point was to add a second f

I'm willing to bet that for many companies, it's part of their regulations or pushed by their security teams as a best practice. The point was to add a second factor of authentication, but one that didn't require you to have a cell phone on hand. The problem is that it's very rare to find good questions that you can remember years from now that's not easily discoverable by a hacker. (I'm currently locked out of an Apple account because of this, especially with their practice of requiring you to get all 3 verification questions correct.)