I know my site has been on the spam lists for some time.
My Q+A has not let a single one through so far
Good QA's
The problem is, QA's are starting to become common, particularly since common CAPTCHA are failing, people are turning to it as their only core resort. So QA's are becoming a target, and they are very easy to extract and learn from.
Some QA's aren't bad at stopping bots
right now (against users that arent using the latest XRumer), but how a lot of people have used QA's is terrible
Common "baby" questions, and simple logic / maths questions are out of the window, don't even bother, bots can pass these
"What colour are ripe bananas" is very poor though! I can't imagine there is a modern bot that can not pass that QA
QA's are good (for now) as long as you use a very unique question where the answer can not be found using a search engine,
and then you also update them regularly to avoid people adding your QA to their personal textcaptcha.txt
I would also avoid using QA's where the answers contains any part of your URL (this is how I imagine most people are evolving their QA's and it's a very simple set of parameters for a bot to pull out and use ... expect it to be used in the near future).
The QA should also be easy to pass for your human target audience (that's very important to keep in mind)
For instance, if XenForo wasn't popular, you might think a good question would be something like
"what type of software does XenForo sell (begins with F)"
The hit list of objects stating with F is fairly large (so that's good).
However, unfortunately for XenForo, because it is popular, querying that with something like Google will result in a good small sample list for Xrumer to attempt (many of the results returned contain the target keyword) ... and XenForo also use this keyword quite a lot
But if you own a forum where that type of related query does not return the correct answer, then you have yourself a good QA to use
You've just got to be imaginative (which is the hard part of creating QAs)
Using lots of QA's you might think is a good idea... but that's not necessarily true. Think of it this way, how many times will a bot attempt a QA set and give up. There is no limit for a bot, they can keep trying until it finds the weak question in the set... So prune out any weak questions and have a small set of strong questions that you then update.
3 Strong questions is much better than 10 Strong questions + 1 weak one