Which of the following firewall rules only denies DNS zone transfers?

Which of the following firewall rules only denies DNS zone transfers?

A.
deny udp any any port 53

B.
deny ip any any

C.
deny tcp any any port 53

D.
deny all dns packets