They require advanced hashing algorithms for answers

They are only applicable to multi-factor authentication

They cannot be guessed by attackers

Social engineering and publicly available data make answers easy to find