Enforce organization-wide SSH access rules: always allow SSH from a corporate IP and deny SSH from all other IPs across multiple projects/VPCs, preventing bypass by other VPC firewall rules.

The correct approach uses hierarchical firewall policies at the organization node to enforce rules across all projects and VPCs, preventing bypass. A lower priority number indicates higher precedence. Therefore, an "allow" rule with priority 0 will always take precedence over a "deny" rule with priority 1. This ensures SSH from the corporate IP is always allowed, and all other SSH is denied, regardless of other VPC firewall rules. VPC firewall rules (options B and C) are project-specific and can be overridden or bypassed by other VPC rules within different projects, failing to meet the "organization-wide" requirement. Option D incorrectly assigns priorities, as a deny rule with priority 0 would block all SSH before the allow rule with priority 1 could take effect.