Select the single best answer. Distinguish passwords, sessions, tokens, roles, and trust relationships, then connect adversary identity behavior to the telemetry and controls that can expose it.