I use the following, which blocks the login page and forgot password page (because they usually contain the "?to=" parameter so you get duplicate content).
User-agent: *
Disallow: /qa/login
Disallow: /qa/forgot
"qa/" here is the subfolder you have Q2A in - if you're using a root domain remove that bit.