I think for this feature, first you need to store selected security question and answer submitted by user in a table.
When user clicks on forgot password : on forgot password screen, you can ask user to answer the security question and ask for some unique identifier in the application like username, email etc. When user submit security question answer check it against database and if pass then proceed with forgot password request otherwise show error.