[RandomBacon]

Make sure it is a plausible-sounding answer.

Don't give an attacker an opportunity to social engineer and say, "it was a bunch of random letters or words" and the customer service person lets them in because it looked like someone was just typing random stuff.

(Insert xkcd here)