Reset password with MFA

I need to implement a reset password feature with MFA. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.

I think the order of these should be answer qs---> send code ---> create new password. But our current wireframe has send code --> answer the qs ---> create new password.

Thoughts?