code: public function changeSecurityQuestion($data)
      {
          /* @var $user UserInterface */
          if (!($user = $this->hydrate($data, $this->getChangeSecurityQuestionForm()))) {
              return;
          }
  
          $eventManager = $this->getEventManager();
          $eventManager->trigger(__METHOD__, $this, $user);
  
          $this->getMapper()->update($user)->save();
  
          $eventManager->trigger(__METHOD__ . '.post', $this, $user);
  
          return $user;
      }
docs: Change user security question
  
  @param array|UserInterface $data
  @return UserInterface|void