In the Enterprise world, we use Azure Active Directory Self-Service Password Reset, which includes multiple factors of validation such as text or phone, application prompts and as above questions as one option. We get to set the number of factors required and the questions (if any) that are offered.