Which two components are primary elements of a tenant?

Contracts define communication rules and security policies between Endpoint Groups (EPGs) within or across tenants, making them a primary element for application-centric policy enforcement and security within a tenant.

"Fire rules" is a generic term for firewall rules, but not a specific primary architectural component of an ACI tenant in the context of the ACI policy model.

Switch domains (e.g., VMM domains, physical domains) are infrastructure constructs that define where endpoints connect to the fabric and are referenced by tenant EPGs, but they are not primary policy elements *of* a tenant itself.

Outside Networks (Layer 3 Out and Layer 2 Out) are configured within a tenant to provide connectivity for applications to external networks, which is crucial for a tenant's communication with the world outside the ACI fabric.

Access policies are part of the underlying fabric access configuration (e.g., interface policies) that dictate how devices connect to the ACI fabric, rather than primary policy components defined directly within a tenant.