Typically using a secret question also requires you to have access to the email account you signed up with, so it's almost 2FA at that point.