Answer should be A as per https://cloud.google.com/vpc/docs/firewalls#priority_order_for_firewall_rules

"Lower integers indicate higher priorities" - hence, a rule with 100 will be matched before a rule with 1000. Therefore, AD rule should be 100, deny rule 1000.

Answer C is wrong
https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules
Implied rules
Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console:

Implied allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by Google Cloud. A higher priority firewall rule may restrict outbound access. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a Cloud NAT instance. For more information, see Internet access requirements.

Implied deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming traffic to them. A higher priority rule might allow incoming access. The default network includes some additional rules that override this one, allowing certain types of incoming traffic

The answer should be A.Please clarify if its B
An egress rule with priority 1000 is applicable to VM 2. This rule denies all outgoing traffic to all destinations (0.0.0.0/0). Outgoing traffic to other instances in the VPC is blocked, regardless of the ingress rules applied to the other instances. Even though VM 2 has an external IP address, this firewall rule blocks its outgoing traffic to external hosts on the Internet.

The answer should be A.Please clarify if its B
An egress rule with priority 1000 is applicable to VM 2. This rule denies all outgoing traffic to all destinations (0.0.0.0/0). Outgoing traffic to other instances in the VPC is blocked, regardless of the ingress rules applied to the other instances. Even though VM 2 has an external IP address, this firewall rule blocks its outgoing traffic to external hosts on the Internet.

The answer of this question should be A , as per me, x
Create an egress rule with priority 1000 to deny all traffic for all instances. Create another egress rule
with priority 100 to allow the Active Directory traffic for all instances.
however correct answer shows as B, could you please help me to understand how?