No right answer.
I hate security questions though. Never remember them. Usually fill them with random stuff. If I do need to recover the site, I'll call the company or file a support ticket anyways.
You didn't give enough information to really understand the situation, so here are some options.
Option 1
1. creates account
2. confirms email
3. answers sec questions
4. Uses site
Option 2
1. creates account
2. answers sec questions
3. confirms email
4. uses site
Option 1 and 2 are the same. Both questions and confirmation are required before the user can do anything.
Option 3
1. creates account
2. Uses site
3. Tries to do something (save data, print, email, etc)
4. Forced to confirm email
5. Forced to answers security questions
I like option 3 if your site supports it. The user can use the site, but you block them from any real functionality until they confirm their email. It gives the user a chance to evaluate the site before committing extra time.
Option 4
1. Creates account
2. Confirms email
3. Uses site
4. Next Login, asked security questions
Option 4 is how gmail approaches extra security features. The present the user with an option to enter phone numbers, and other recovery items. Of course, they don't do security questions. They use phones. Which is a lot less burden on the user.