Require SecurityQuestion only if needed