It's 2018, And...
"...Windows 10’s password reset questions are in effect hard-coded; you cannot define your own questions..."
"Hard-coded" is bad enough, but I've seen too many really lame security questions--with topics that some people chat about on social media--seriously, and that crap has to stop.
And, it can be done by way of the registry. I... just... don't... know... what else to say.