Security Policy <QuestionNumber> contradiction

In "SecurityPolicy.xml" if question number attribute value is setting wrongly, when pressing save button system doesn't show an error and it seems be like everything is okey for user.
By the way when user want to reset Security Question, system throwing some error and actually operating doesn't occur. At this moment system is throwing IndexOutOfBound exception in the catalina.out

During this scenario, user doesn't inform from the system. And stil in the page, it seems be like everything works smoothly but actually user can't set his/her password questions.