All Compute Engine instances must only egress Active Directory traffic on specific ports; all other egress must be blocked. How should you configure VPC firewall rules?

VPC firewall rules are evaluated by priority, with lower numbers indicating higher priority. To achieve the desired outcome, you need to explicitly allow Active Directory traffic and explicitly deny all other egress traffic. By creating an allow rule for Active Directory with a higher priority (lower number, e.g., 100) and a deny-all rule with a lower priority (higher number, e.g., 1000), the allow rule will be evaluated first. If traffic matches the allow rule, it passes. If it doesn't match the allow rule, it proceeds to the deny-all rule and is blocked. The implied deny egress rule has a priority of 65535, which is too low to override specific allow rules.