Which three are part of an access control list (ACL) when using Real Application Security?

An Access Control List (ACL) in Real Application Security (RAS) is fundamentally a list of Access Control Entries (ACEs). Each ACE grants privileges to a principal (a user or role). Therefore, privileges (A) and roles (G) are core components. The ACL is applied to a data realm, and its effectiveness is shaped by data realm constraints (F), which provide row-level security (a WHERE clause). While technically part of the realm object, realm constraints are integral to the overall access control mechanism governed by the ACL, making this triad the most conceptually complete answer.

B. schemas: Schemas contain the objects being protected but are not part of the ACL itself. They are specified in the data realm definition.
C. data realms: A data realm is the object to which an ACL is applied; it is not a component within the ACL.
D. column constraints: This term refers to database integrity constraints (NOT NULL, UNIQUE). RAS column security is defined via privileges in the ACL, not this term.
E. policies: A RAS security policy is a container for ACLs, realms, and roles. An ACL is a component of a policy, not the other way around.

1. Oracle Database Real Application Security Administrator's and Developer's Guide, 21c. Chapter 2, "Real Application Security Architecture". This chapter describes ACLs as containing ACEs, which specify a principal (user/role) and privileges. It also describes data realm constraints as part of the realm definition.

2. Oracle Database PL/SQL Packages and Types Reference, 21c. "DBMSXSACL Package". The CREATEACE procedure shows the core components are principalname (role) and privilegelist (privileges).