Yes, the plan is to have them on a single form. So, in your opinion, you think it's overkill. Would it do better to just simply implement stringent password criteria instead? This is my first application that will have security questions in it possibly. Still in the design phase of it so I'm open to better ways to doing this.