Which two constructs make up a security policy within the Cisco APIC?

Which two constructs make up a security policy within the Cisco APIC? (Choose two.)

A.
bridge domain

B.
contracts

C.
virtual route forwarders

D.
endpoint groups

E.
filters