Revoke is the opposite of a Grant (at least in as much as Grant adds an access rule and Revoke Removes an access Rule) While somewhat counter-intuative Deny also adds an access rule (which of course can be removed with a Revoke).
If I grant the sales group access I can later revoke it.
However I could also deny you access, and even through you're in the sales group you'll not have access.