Requiring a password question and answer provides an additional layer of security when retrieving or resetting a user's password. Users can supply a question and answer when their user name is created that they can later use to retrieve or reset a forgotten password.

Membership.RequiresQuestionAndAnswer is checked when MembershipUser.ResetPassword(string) or MembershipUser.GetPassword is called. The provider provided with the .NET Framework throws a NotSupportedException if Membership.RequiresQuestionAndAnswer is true and the supplied password answer is null.

If Membership.EnablePasswordReset and Membership.EnablePasswordRetrieval are both false, Membership.RequiresQuestionAndAnswer can still be used to enforce the creation of questions and answers when new users are created; however, the question and answer will not be used. You will be able to retrieve the question by using the System.Web.Security.MembershipUser class.

For more information, see MembershipUser.ResetPassword(string) and MembershipUser.GetPassword.