I have attempted to get this to work and have given up at this point. Here is what I know.
It is possible to configure this via a setting in web.config by setting the following value to "true":
requiresQuestionAndAnswer="true" This is a setting in the "AspNetSqlMembershipProvider" section.
This will set the requirement for all portals in the DNN instance and I have not found any way to set this for a specific portal. You must use encrypted passwords. The questions are not set by you, the user determines what single question they will be asked and provide their own answer.
Under the portal user settings, if you check the "Require valid profile to login" and "Require valid profile to register" (might not be exact wording), exisiting users will have to fill in the question/answer, as will new registrants.
OK. Now the problem. When the "forgot password?" link is selected on the login page, the dialog presented provides no mechanism to actually request the question/answer form. So unless this has been fixed in 4.3.6, it just doesn't work.
I should have posted this in gemini when I found the problem, as I did when I originally found problems with allowing the user to actually see and enter the question/answer fields. That got fixed in 4.3.5, but when I couldn't use it, and needed to move on, I gave up and resorted to allowing passwords sent in emails, which I really don't like.
Rob Ralston