A, B, and C. DHCP server logs, VPN server logs, and 802.1x authentication logs are good telemetry sources for attribution for who is the potential threat actor in a security incident or attack.