Sessions can apply to both, depending on circumstances. There isn't a definitive/100% reliable cookie-based approach to differentiating guests and registered members.
The lack of a session cookie and the lack of a remember cookie (xf_user) would be the only way to definitely identify a guest.