One mitigation is to make your mother's maiden name the output of:

    head -c 20 /dev/random | base64

And keep track of the result in your favorite password manager.

Fortunately, fewer and fewer orgs are using security questions, but there are still some important ones that only use that and no MFA.