Which configuration directive could be used for this purpose?

A BIND server should never answer queries from certain networks or hosts. Which configuration directive could be used for this purpose?

A.
deny-query { …; };

B.
no-answer { …; };

C.
deny-answer { …; };

D.
deny-access { …; };

E.
blackhole { …; };