Two VPC firewall rules exist in the same network: Rule A (priority 100) denies TCP port 22 from 0.0.0.0/0, Rule B (priority 200) allows TCP port 22 from 203.0.113.0/24. A VM receives an SSH connection from 203.0.113.5. Which firewall decision is applied to that connection?

In Google Cloud VPC firewall rules, priority determines which rule takes precedence when multiple rules match a connection. Lower numeric values indicate higher priority. In this scenario, Rule A has a priority of 100, which is lower (higher priority) than Rule B's priority of 200. Since both rules match the SSH connection from 203.0.113.5 (Rule A denies all TCP 22, Rule B allows TCP 22 from that specific range), the higher-priority Rule A (deny) is applied, and the connection is denied. Specificity does not override priority, nor do allow rules inherently override deny rules; priority is the deciding factor. VPC routes determine traffic forwarding, not firewall decisions.