My recommendation for this would be:

1. These "questions" are basically 2nd passwords with hints. They are not 2FA. They should be treated like passwords. Storing in UserData is probably the best location. They need to be hashed and not stored in plain text. argon2 is generally considered the best password hashing algorithm these days. https://argon2-cffi.readthedocs.io/en/stable/ Bcrypt is a good alternative if for some reason argon2 is not possible.

2. Store the list of possible questions as configs in wedge address config. store user's answers (as hashes) in UserData. Maintain the map of question text to UserDataElements in the wedge address config.