The correct options are Application secret, Redirect URI, and Application (client) ID.

The Application (client) ID identifies which registered application is requesting the token. The identity service uses this value to look up the app configuration and to validate granted permissions for the token request.

The Application secret is the credential used by confidential applications to prove their identity when exchanging an authorization code or when performing a client credentials grant. Without the secret a confidential client cannot authenticate to the token endpoint.

The Redirect URI must match the value registered for the application because the authorization response and authorization code are returned to that address. The identity provider enforces an exact match to prevent tokens from being sent to unintended endpoints.

Directory (tenant) ID is not one of the three properties that must be included in the access token request itself. The tenant identifier is used when constructing the authorization or token endpoint URL to target a specific directory, but it is not a credential field that is sent as part of the token exchange.

Full AWS Practitioner Certification Question