whether the channel will be MAC protected or encrypted, or both
whether Kerberos or SSL will be used to secure the channel
whether the client will delegate credentials to the server

allows the server to force the client to delegate her credentials
allows the client to control what the server can do while impersonating her
is negotiated between the client and server
The client specifies the impersonation level as a measure of how much she trusts the server with her credentials. The server cannot force the client to delegate her credentials if she doesn't want to (although if the server is trusted for protocol transition, he can obtain credentials for her directly from the domain authority, but that's quite rare).

When a call enters the server process
When a call enters any application in the process
When the server process is about to be launched due to a client activation request
When one object calls another inside a single application
a, b, and c
b and c
all of the above
Remember that the built-in access checks only happen when you cross a boundary (specifically a process or application boundary). So calls between objects in a single application don't go through any built-in access checks.

the union of roles defined by all applications in the process
the roles defined by the server application in the process
DCOMCNFG.EXE
The server application in each process dictates the process-wide security settings. Library applications have much less control.

the caller's token has a SID that has been included in the specified role
it's Tuesday
access checks have been turned off for the application
a and c
none of the above