code: public function changeSecurityQuestionAction()
      {
          // if the user is not logged in, we can't change security question
          if (!$this->cmsAuthentication()->hasIdentity()) {
              // redirect to the login redirect route
              return $this->redirect()->toRoute($this->getOptions()->getLoginRoute());
          }
  
          $url = $this->url()->fromRoute(null, ['action' => 'change-security-question']);
          $prg = $this->prg($url, true);
          if ($prg instanceof ResponseInterface) {
              return $prg;
          }
  
          $post = $prg;
  
          $form = $this->getUserService()->getChangeSecurityQuestionForm();
          $form->setObject($this->cmsAuthentication()->getIdentity());
          $form->setAttribute('action', $url);
  
          if ($post) {
  
              $identity = $this->getUserService()->changeSecurityQuestion($post);
  
              // Return early if an user service returned a response
              if ($identity instanceof ResponseInterface) {
                  return $identity;
              } elseif ($identity) { // Security question changed successfully
                  $viewModel = new ViewModel(compact('identity'));
                  $viewModel->setTemplate('cms-user/index/change-security-question-success');
  
                  return $viewModel;
              }
          }
  
          return new ViewModel(compact('form'));
      }
docs: Change security question action
  
  @return ResponseInterface|ViewModel