The system is initially delivered with two-factor authentication set "on", and challenge question prompting at login set "off".  You can change either or both of these settings in Authentication Preferences.

Click 'Play' to watch a short demo of how to change your organization's authenication scheme preferences.