LOL, check their Facebook pictures and see if they are playing an instrument in any of them. Most people don't play more than 1 instrument, so it's probably their first.
It's not quite as bad as asking "what species was your first pet?" but not much better.
This is the real problem with security questions; the answer space is often so very small, and can be narrowed down even further with a little research.
Questions like "what was the first name of (your maternal grandmother, your first best friend, etc.)" are very common -- well, there are stats on most popular first names of given generations in different places. If you know what country the person is in, you can make a good guess at these.