I worked with a system administrator once. He didn't understand two factor security. So he told everyone to remember two passwords.

Maybe he now works at American Express.

I see exactly the same thing with most "security improvements". Hence treat each answer as just another password! a random string of characters, numbers and punctuations.