Stateful rules that allow or deny ingress or egress traffic by source, destination, protocol, and port. They apply to all VMs or to those with a network tag or service account. Cloud NGFW adds hierarchical and network firewall policies, which can use IAM-governed secure Tags.
The ACE asks about priority (a lower number wins) and about limiting targets to specific VMs. Hierarchical policies are associated with the organization or a folder and apply to all its VPCs.
VPC firewall rules and Cloud NGFW is a concept that can show up on the exam. Check the full guide to see it in context.