Deny is in mod_authz_host rather than mod_access.

<section id="flag_f"><title>F|forbidden</title>

<p>Using the [F] flag causes the server to return a 403 Forbidden status

code to the client. While the same behavior can be accomplished using

the <directive module="mod_access">Deny</directive> directive, this 

the <directive module="mod_authz_host">Deny</directive> directive, this 

allows more flexibility in assigning a Forbidden status.</p>

<p>The following rule will forbid <code>.exe</code> files from being