A: Probably not, unless there is something special about your userbase.
When the user wants to reset their password, you can send them an email containing a one-time-use link that will let them reset it. This is standard practice across most login-based sites on the Internet. Is there a reason your site requires additional security, or some reason your users are not able to use this method?
The Citrix article linked in the comment is pretty conclusive about the usability issues of security questions:
Though while there might be some optimism for more
secure questions, usability remains a challenge. And while
further experiments should be performed on larger, more
diverse populations, and over longer periods of time, our
initial results indeed indicate usability issues regarding the
memorability and repeatability of answers. Novel solutions
that ensure security and usability are needed in this area.
B: There are different options you have if you think emailing a one-time link is not secure enough.
- A separate password is weird, and I haven't seen it before.
- A separate passcode, such as a 4-digit PIN, is/has been used by some banking companies such as ING. This is often more memorable than a password, since users tend to choose a PIN they use elsewhere, but also less secure than a completely independent piece of knowledge or authentication token.
- Some services, such as Backblaze or iCloud, instruct users to download a set of recovery keys, print them out, and store them somewhere safe in case they forget their password.
C: OWASP has a great set of articles on this. I would recommend their article on choosing and using security questions, as well as the site http://goodsecurityquestions.com/.
At the end of the day, any additional steps you put in front of your users' logging in or reset their password will make the site less usable. You need to decide if your users' security needs make the usability impact worth it.