The best thing you can do when prompted for these things is to have a system to obfuscate your answers so they'd be unguessable unless someone knows the system you use. It can be as simple as reversing the letters. i.e., 'green' becomes 'neerg'.
Other possibilities would be to rot13 your answer, thus "green" becomes "terra"
or you can hash it using any of several available hash algorithms.
Here is "green" passed through some hashes
md5sum: 9f27410725ab8cc8854a2769c7a516b8
sha1sum: bc74f4f071a5a33f00ab88a6d6385b5e6638b86c
sha224sum: c8b29243e82a83e40317ca514c43b5ceb291abb7bf59c4eafa8e190d
sha256sum: ba4788b226aa8dc2e6dc74248bb9f618cfa8c959e0c26c147be48f6839a0b088
You don't have to use the entire string the first or last 8 or so characters would be sufficient.
Yes, this is a pain.
However, it protects your accounts from malicious folk. It also makes it so that you're not giving valuable information to folks that they can use to hack you.
Picture this: you sign up for a website, and they use "security questions". However, unknown to you the website has been hacked, and the site stores your answers as plain text in a database. Now the malicous individual or organization now has a bunch of your answers to these security questions. Suckage
One thing to keep in mind when using this kind of system is that you should be consistent, or at least have a record for each site you use as to what method you used to generate it. Keep in mind that consistency may sound like a good idea, but it still opens you up to someone getting the string you use. i.e., if you always answer "terra" for when the answer is 'green', then it really doesn't matter what method you use, because someone might know what your answer is.
I'm more paranoid than your average bear, so I have a program that keeps track of all my passwords and stuff. The data used by this password program is maintained in an encrypted file, and I put information about the method used to generate any "security" answers in the comments for the entry for that site. Thus, knowing that 'green' on site A is 'terra', won't help you to know the answer to what 'green' is on another one.
One final note: make absolutely SURE whatever method you use is reproducible, and that you have a record of your method that you're not going to use when your hard drive dies. (You do have backups right?)
I advocate not answering a security question with anything close to a true answer.
For example, if the first security question is "What is your paternal grandmother's first name?" answer "mashedpotato1stQ". To the second security question is "In what city did you meet your spouse?" answer "mashedpotato2ndQ". And, of course to the third security question "What is your all time favorite movie?" answer "mashedpotato3rdQ".
I keep a record of these false answers in an encrypted file but usually they are easy to remember because the key is that the false word is based on the first letter of the main name of the site. I.E., Bank of America would be under A for "America" but not "Bank" because the differentiating name in the site is " America" because there are many banks. . . so I might use "Applesauce" or "Applecobbler" as the main word in my security question.
This may result in a few duplications, but the odds are pretty good it won't hit a malicious site. . . or if it did, the malicious site would not find a real site that duplicates the nonsense security answers it has to allow it to break in.