That's no longer the case. With this new Two Factor authentication there are no security questions, no recovery key, and Apple can recover your account if you lose all of your trusted devices and forget your password.

Devices are automatically trusted the first time you login and enter a verification code.

When anyone tries to login to your account on the web or from an untrusted device, all of your trusted devices notify you with location of the login attempt. It's a pretty good setup.