🔍

PCSE — questions

Page 13 of 18 · 356 total questions.

PCSE Question 241

Single page →
Topic 1 · Question 241

You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle. What should you do?

  • A1. Create a general service account “g-sa” to orchestrate the batch jobs.2. Create one service account per batch job ‘b-sa-[1-5]’. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
  • B1. Create a general service account “g-sa” to execute the batch jobs.2. Grant the permissions required to execute the batch jobs to g-sa.3. Execute the batch jobs with the permissions granted to g-sa.
  • C1. Create a workload identity pool and configure workload identity pool providers for each batch job.2. Assign the workload identity user role to each of the identities configured in the providers.3. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts.4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
  • D1. Create a general service account “g-sa” to orchestrate the batch jobs.2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts.3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: 1. Create a general service account “g-sa” to orchestrate the batch jobs.2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the servic...

Explanation

Google Cloud Batch schedules and runs batch jobs at scale without managing infrastructure. A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 242

Single page →
Topic 1 · Question 242

Your Google Cloud environment has one organization node, one folder named “Apps”, and several projects within that folder. The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization. The “Apps” folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property. You attempt to grant access to a project in the “Apps” folder to the user [email protected] . What is the result of your action and why?

  • AThe action succeeds because members from both organizations, terramearth.com or flowlogistic.com, are allowed on projects in the “Apps” folder.
  • BThe action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.
  • CThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
  • DThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 243

Single page →
Topic 1 · Question 243

An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials. What should you do?

  • AConfigure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
  • BModify the VPC routing with the default route point to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
  • CConfigure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application.
  • DConfigure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale. A VPC provides a global, software-defined private network for your Google Cloud resources. Identity-Aware Proxy enforces per-request access control to apps without a VPN.

PCSE Question 244

Single page →
Topic 1 · Question 244

Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?

  • AAssign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours. (correct answer)
  • BRun a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
  • CAssign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours.
  • DConfigure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraint for BigQuery during the specified working hours.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 245

Single page →
Topic 1 · Question 245

You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Cloud Storage, without traversing the internet. What should you do?

  • AEnable Private Google Access for the private subnet. (correct answer)
  • BConfigure Private Service Connect for the private subnet's Virtual Private Cloud (VPC) and allocate an IP range for the Compute Engine instances.
  • CReserve and assign static external IP addresses for the Compute Engine instances.
  • DCreate a Cloud NAT gateway for the region where the private subnet is configured.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable Private Google Access for the private subnet.

Explanation

Private Google Access lets internal instances reach Google APIs without external IPs.

PCSE Question 246

Single page →
Topic 1 · Question 246

Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You must ensure that containers with vulnerabilities rated above a common vulnerability scoring system (CVSS) score of "medium" are not deployed to production. What should you do?

  • AImplement vulnerability scanning as part of the Cloud Build process. If any medium or higher vulnerabilities are detected, manually rebuild the image with updated components.
  • BPerform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a manual security-engineer-driven remediation process.
  • CConfigure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold. (correct answer)
  • DUtilize a vulnerability scanner during the Cloud Build stage and set Artifact Registry permissions to block images containing vulnerabilities above "medium."
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead.

PCSE Question 247

Single page →
Topic 1 · Question 247

You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organization can access the application. The proposed solution must support browser access with single sign-on. What should you do?

  • AChange Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
  • BCreate a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
  • CChange the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known IP addresses.
  • DActivate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Activate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale. Identity-Aware Proxy enforces per-request access control to apps without a VPN.

PCSE Question 248

Single page →
Topic 1 · Question 248

During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?

  • AEnable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
  • BReview Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
  • CRun a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
  • DCheck Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs.

Explanation

Security Command Center centralizes security findings, threats, and compliance posture. Cloud Audit Logs record administrative and data-access activity for auditing and governance.

PCSE Question 249

Single page →
Topic 1 · Question 249

Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must describe the security responsibilities for the image classification model. What should you do?

  • AExplain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.
  • BExplain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.
  • CExplain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity. (correct answer)
  • DExplain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious...

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 250

Single page →
Topic 1 · Question 250

You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage class of objects older than 365 days to Coldline storage. What should you do?

  • AUse Cloud Asset Inventory to generate a report of the configuration of all storage buckets. Examine the Lifecycle management policy settings and ensure that they are set correctly.
  • BSet up a CloudRun Job with Cloud Scheduler to execute a script that searches for and removes flies older than 365 days from your Cloud Storage.
  • CEnable the Autoclass feature to manage all aspects of bucket storage classes.
  • DDefine a lifecycle policy JSON with an action on SetStorageClass to COLDLINE with an age condition of 365 and matchStorageClass STANDARD. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Define a lifecycle policy JSON with an action on SetStorageClass to COLDLINE with an age condition of 365 and matchStorageClass STANDARD.

PCSE Question 251

Single page →
Topic 1 · Question 251

Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials. What should you do?

  • AEnable Secure Web Proxy. Create a proxy subnet for each region that Secure Web Proxy will be deployed. Deploy an SSL certificate to Certificate Manager. Create a Secure Web Proxy policy and rules that allow access to Google Cloud services.
  • BEnable Workforce Identity Federation. Create a workforce identity pool and specify the on-premises identity provider as a workforce identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create an IAM binding that binds the required role(s) to the external identity by specifying the project ID, workload identity pool, and attribute that should be matched.
  • CEnable Identity-Aware Proxy (IAP). Configure IAP by specifying the groups and service accounts that should have access to the application. Grant these identities the IAP-secured web app user role.
  • DEnable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create a service account with the necessary permissions for the workload. Grant the external identity the Workload Identity user role on the service account. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity prov...

Explanation

Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely. This option needs the least custom development effort.

PCSE Question 252

Single page →
Topic 1 · Question 252

Your organization is migrating a sensitive data processing workflow from on-premises infrastructure to Google Cloud. This workflow involves the collection, storage, and analysis of customer information that includes personally identifiable information (PII). You need to design security measures to mitigate the risk of data exfiltration in this new cloud environment. What should you do?

  • AEncrypt all sensitive data in transit and at rest. Establish secure communication channels by using TLS and HTTPS protocols.
  • BImplement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts. (correct answer)
  • CRestrict all outbound network traffic from cloud resources. Implement rigorous access controls and logging for all sensitive data and the systems that process the data.
  • DRely on employee expertise to prevent accidental data exfiltration incidents.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltratio...

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 253

Single page →
Topic 1 · Question 253

Your organization is building a chatbot that is powered by generative AI to deliver automated conversations with internal employees. You must ensure that no data with personally identifiable information (PII) is communicated through the chatbot. What should you do?

  • AEncrypt data at rest for both input and output by using Cloud KMS, and apply least privilege access to the encryption keys.
  • BDiscover and transform PII data in both input and output by using the Cloud Data Loss Prevention (Cloud DLP) API. (correct answer)
  • CPrevent PII data exfiltration by using VPC-SC to create a safe scope around your chatbot.
  • DScan both input and output by using data encryption tools from the Google Cloud Marketplace.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Discover and transform PII data in both input and output by using the Cloud Data Loss Prevention (Cloud DLP) API.

PCSE Question 254

Single page →
Topic 1 · Question 254

Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived access credentials to maintain security across the clouds. What should you do?

  • ACreate a managed workload identity. Bind an attested identity to the Compute Engine workload.
  • BCreate a service account key. Download the key to each application that requires access to the Google Cloud resource.
  • CCreate a workload identity pool with a workload identity provider for each external cloud. Set up a service account and add an IAM binding for impersonation. (correct answer)
  • DCreate a VPC firewall rule for ingress traffic with an allowlist of the IP ranges of the external cloud applications.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a workload identity pool with a workload identity provider for each external cloud. Set up a service account and add an IAM binding for impersonation.

Explanation

Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 255

Single page →
Topic 1 · Question 255

Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application code is old and poorly understood by your current software engineers. Recent threat modeling exercises have highlighted the potential risk of sophisticated side-channel attacks against the application while the application is running. You need to further harden the Google Cloud solution to mitigate the risk of these side-channel attacks, ensuring maximum protection for the confidentiality of financial data during processing, while minimizing application problems. What should you do?

  • AEnforce stricter access controls for Compute Engine instances by using service accounts, least privilege IAM policies, and limit network access.
  • BImplement a runtime library designed to introduce noise and timing variations into the application's execution which will disrupt side-channel attack.
  • CMigrate the application to Confidential VMs to provide hardware-level encryption of memory and protect sensitive data during processing. (correct answer)
  • DUtilize customer-managed encryption keys (CMEK) to ensure complete control over the encryption process.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Migrate the application to Confidential VMs to provide hardware-level encryption of memory and protect sensitive data during processing.

PCSE Question 256

Single page →
Topic 1 · Question 256

Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exfiltration risk, only allow required connections, and follow the principle of least privilege. What should you do?

  • AConfigure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved.
  • BConfigure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-B.
  • CConfigure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B. (correct answer)
  • DConfigure a bidirectional egress/ingress rule for the Cloud Storage buckets in Perimeter-A and Perimeter-B.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed.

PCSE Question 257

Single page →
Topic 1 · Question 257

You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Pods access to the bucket while minimizing management overhead. What should you do?

  • ACreate a service account. Grant bucket access to the Pods by using Workload Identity Federation for GKE. (correct answer)
  • BCreate a service account with keys. Store the keys in Secret Manager with a 30-day rotation schedule. Reference the keys in the Pods.
  • CCreate a service account with keys. Store the keys as a Kubernetes secret. Reference the keys in the Pods.
  • DCreate a service account with keys. Store the keys in Secret Manager. Reference the keys in the Pods.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a service account. Grant bucket access to the Pods by using Workload Identity Federation for GKE.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 258

Single page →
Topic 1 · Question 258

Your organization is adopting Google Cloud and wants to ensure sensitive resources are only accessible from devices within the internal on-premises corporate network. You must configure Access Context Manager to enforce this requirement. These considerations apply: • The internal network uses IP ranges 10.100.0.0/16 and 192.168.0.0/16. • Some employees work remotely but connect securely through a company-managed virtual private network (VPN). The VPN dynamically allocates IP addresses from the pool 172.16.0.0/20. • Access should be restricted to a specific Google Cloud project that is contained within an existing service perimeter. What should you do?

  • ACreate an access level named "Authorized Devices." Utilize the Device Policy attribute to require corporate-managed devices. Apply the access level to the Google Cloud project and instruct all employees to enroll their devices in the organization's management system.
  • BCreate an access level titled "Internal Network Only." Add a condition with these attributes:• IP Subnetworks: 10.100.0.0/16, 192.168.0.0/16• Device Policy: Require OS as Windows or macOS. Apply this access level to the sensitive Google Cloud project.
  • CCreate an access level titled "Corporate Access." Add a condition with the IP Subnetworks attribute, including the ranges: 10.100.0.0/16, 192.168.0.0/16, 172.16.0.0/20. Assign this access level to a service perimeter encompassing the sensitive project. (correct answer)
  • DCreate a new IAM role called "InternalAccess. Add the IP ranges 10.100.0.0/16, 192.16.0.0/16, and 172.16.0.0/20 to the role as an IAM condition. Assign this role to IAM groups corresponding to on-premises and VPN users. Grant this role the necessary permissions on the resource within this sensitive Google Cloud project.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an access level titled "Corporate Access." Add a condition with the IP Subnetworks attribute, including the ranges: 10.100.0.0/16, 192.168.0.0/16, 172.16.0.0/20. Assign this access level to a service perimeter...

PCSE Question 259

Single page →
Topic 1 · Question 259

Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within your organization for analysis purposes. You must share the BigQuery dataset with the other team while protecting the PII. What should you do?

  • AUtilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities. (correct answer)
  • BExport the BigQuery dataset to Cloud Storage. Create a VPC Service Control perimeter and allow only their team's project access to the bucket.
  • CImplement data pseudonymization techniques to replace the PII fields with non-identifiable values. Grant the other team access to the pseudonymized dataset.
  • DCreate a filtered copy of the dataset and replace the sensitive data with hash values in a separate project. Grant the other team access to this new project.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Utilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage.

PCSE Question 260

Single page →
Topic 1 · Question 260

Your organization uses Google Cloud to process large amounts of location data for analysis and visualization. The location data is potentially sensitive. You must design a solution that allows storing and processing the location data securely, minimizing data exposure risks, and adhering to both regulatory guidelines and your organization's internal data residency policies. What should you do?

  • AEnable location restrictions on Compute Engine instances and virtual disk resources where the data is handled. Apply labels to tag geographic metadata for all stored data.
  • BUse the Cloud Data Loss Prevention (Cloud DLP) API to scan for sensitive location data before any storage or processing. Create Cloud Storage buckets with global availability for optimal performance, relying on Cloud DLP results to filter and control data access.
  • CCreate regional Cloud Storage buckets with Object Lifecycle Management policies that limit data lifetime. Enable fine-grained access controls by using IAM conditions. Encrypt data with customer-managed encryption keys (CMEK) generated within specific Cloud KMS key locations.
  • DStore data within BigQuery in a specified region by using dataset location configuration. Use authorized views and row-level security to enforce geographic access restrictions. Encrypt data within BigQuery tables by using customer-managed encryption keys (CMEK). (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Store data within BigQuery in a specified region by using dataset location configuration. Use authorized views and row-level security to enforce geographic access restrictions. Encrypt data within BigQuery tables by u...

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage.

Showing questions 241–260 of 356 · Page 13 of 18