When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?

When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?
A . How many credit card records are stored?
B . How many servers do you have?
C . What is the scope of the certification?
D . What is the value of the assets at risk?

Answer: C