Exercise 1: Notarization vs. XProtect — Possible Solution
====================================================================

THE SPECIFIC DIFFERENCE
------------------------------
Per this chapter, notarization is a one-time automated check performed by Apple's servers when a developer first distributes an app - it happens once, before the app ever reaches a user. XProtect is a continuously and silently updated, on-access safety net that keeps checking files - not just at first install, but on an ongoing basis - against known-malware signatures, long after an app is already sitting on a Mac's disk. One is a single gate passed once; the other is a standing check that keeps running afterward.

WHY XPROTECT IS CALLED "A BASELINE, NOT A FULL ANTIVIRUS REPLACEMENT"
------------------------------
The chapter states that Apple is explicit XProtect is deliberately minimal - it covers known threats via signature matching, rather than attempting the broader behavioral detection a dedicated third-party security product aims for. It's meant as a baseline safety net built into the OS, not something intended to replace a full, actively developed antivirus product.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly distinguishes notarization's one-time, pre-distribution check from XProtect's ongoing, on-access checking, and correctly explains that XProtect's "baseline" framing reflects its deliberately narrow, signature-based scope rather than a claim that it's broken or ineffective.