When is the default deny all policy an exception in zon…

When is the default deny all policy an exception in zone-based firewalls?

A.
When traffic traverses two interfaces in in the same zone

B.
When traffic terminates on the router via the self zone

C.
When traffic sources from the router via the self zone

D.
When traffic traverses two interfaces in different zones