An IP address always belongs to the most specific zone. Suppose that Zone A includes the IP network 10.0.0.0/8 and Zone B includes the network 10.0.1.0/24. In this case, a client machine with the 10.0.1.100/32 IP address belongs to both zones from an IP addressing point of view. But Zone B is more specific (in CIDR terms), so the client machine belongs to Zone B.