This happened to me also, because I made my first iTunes purchase on my new iPhone. (1)
First thing is first: I used this very iPhone to purchase a $3000 27" iMac and no secuirty question was asked. But for a $ 0.99 iTunes purchase it makes sense to ask the security questions.
Anyway, I don't care to remember security questions that I cannot write myself. So here I was locked out.
Second, below is how I got the security password reset, and this shows how pointless the security setup is when compared to the existing password
So I called the apple support, asked for security team and stated "I cannot remember my security questions".
I was immediately asked the to answer the security questions. Apparently this is procedure. It definitely is also absurd.
Then I was asked to read a code that was asked the iTunes account for which I forgot the security questions.
A code was sent to all devices connected with that iTunes account. I read this out to the support person. (2)
Then I was asked to login to the internet account site appleid.apple.com. I did this (3).
From there I clicked a special PIN button and this generated another code that I read out to the support person. (4)
From there the security passwords were reset.
Why is this security no better than the iCloud password ? Quite simply (refer to numbers in text)
(1) in this case the security questions are asked because I am doing a purchase. This means I have an unlocked iPhone and the iTunes account is connected. So I am nearly in.
(2) the code was sent to all devices linked to the account, this includes the device I am holding in my hands, and it is unlocked since I can use iTunes.
(3) here I agree, I need to know the password
(4) if I know the password I can login, press the PIN button and read the code
So for steps 1-4 above the only thing I need to know is the account password.
Why the hell does Apple make my life miserable with a security setup that - in the end - is equivalent to the password ?
I thought Apple cared about me, both in terms of security and user experience. Here both fail miserably.