I'm guessing you mean inline and not API based policies (API everything is evaluated). If the DLP policies are in separate Real-Time Protection policies, then it will fire on the first match and exit (top-down). There is a new feature that can be turned on, in the backend, called "Alert and Continue" that will allow you to process multiple policies until a block is triggered. In general, if you have multiple DLP policies in a single RTP policy, then all of them will be evaluated, but only the most restrictive action will trigger.
As for you second question, it depends on how the DLP rule is configured. If both are part of the rule, then both will hit. Entities inside of a rule are AND'd. Rules inside of a Policy are OR'd. Unless you are mixing Financial and PII entities in a custom rule, US Bank Account numbers and SSN will not fire together.
In the screenshot, INTL-PAN-Exp-Address must all have hits together to fire that rule. The other rules are variations, but all data in the rule must hit for a match.