Make sure it is a plausible-sounding answer. Don't give an attacker an opportunity to social engineer and say, "it was a bunch of random letters or words" and

Make sure it is a plausible-sounding answer. Don't give an attacker an opportunity to social engineer and say, "it was a bunch of random letters or words" and the customer service person lets them in because it looked like someone was just typing random stuff. (Insert xkcd here)