All Compute Engine instances in your VPC should be able to connect to an Active Directory server on specific ports. Any other traffic emerging from your instances is not allowed. You want to enforce this using VPC firewall rules. How should you configure the firewall rules?

VPC firewall rules are evaluated by priority, with lower numbers indicating higher priority. To allow specific traffic while denying all other traffic, the "allow" rule must have a higher priority (lower number) than the "deny all" rule. Therefore, creating an egress rule with priority 100 to allow Active Directory traffic ensures it is evaluated and permitted first. A subsequent egress rule with priority 1000 to deny all other traffic will then block anything not explicitly allowed. The incorrect options either reverse the priority, which would block the desired traffic, or incorrectly rely on the implied deny rule, which has the lowest priority (65535) and would be overridden by a higher-priority deny rule.